Cure Privacy Policy

Effective date: May 19, 2026 Last updated: May 19, 2026

This Privacy Policy describes how Cure ("the app," "we," "us") collects, uses, stores, and shares information when you use the Cure iOS application and the related pages at phenolog.io/cure. Cure is a curing and drying journal for flower, dried herbs, tea, mushrooms, and fruit.

Cure is operated by Matt Cohen, sole proprietor, located in the State of Maine, United States. For any privacy question or request, contact hello@phenolog.app.

1. Information we collect

We collect only the information we need to run the app. Categories below describe exactly what we gather and where it comes from.

1.1 Account information

When you create an account, we collect:

• Email address. Used as your sign-in identifier and to send transactional messages (such as a password reset).
• Password. Stored only as a salted hash by our authentication provider (Supabase). We never see your plaintext password and cannot recover it.
• A randomly generated user identifier (UUID). Used internally to associate your records with your account.

1.2 Content you create

When you use the app, you create records that we store on your behalf so they sync across your devices. This includes:

• Batches (names, batch type, lifecycle stage, harvest and timing data, weights).
• Readings (water activity, moisture content, container and ambient humidity and temperature, weight, and other numeric values you log over time).
• Containers (the individual jars or totes you track within a batch, with their own readings and burp logs).
• Burp events (timestamps and any notes you record when you open a container).
• Reminder settings and free-text notes.

You own this content. We host it only to provide the service.

1.3 Purchase information

When you subscribe to a paid plan or buy the lifetime option, the following are involved:

• Apple StoreKit processes the actual purchase. We never receive your payment-card information, billing address, or any other Apple Account data.
• RevenueCat is the subscription-management service that records which entitlement you hold ("premium") and reports state changes back to us. We identify you to RevenueCat using your Cure user identifier. RevenueCat receives no other personal information from us.
• We store your subscription status and a RevenueCat reference identifier in your Cure profile so the app can unlock paid features.

1.4 Reminders

Cure's burp reminders are local notifications scheduled on your device. They do not involve a push server, and no reminder data leaves your device. We do not collect a push-notification token.

1.5 Information we do not collect

For clarity, we do not:

• Collect or upload photos. Cure has no photo feature.
• Use crash-reporting or diagnostics SDKs.
• Send your data to any artificial-intelligence service.
• Display ads or work with any advertising network.
• Track you across other apps or websites.
• Use third-party analytics SDKs for behavioral tracking.
• Collect your real name, postal address, phone number, location, or contacts.
• Collect health, financial, or other sensitive personal information.

We have not implemented Apple's App Tracking Transparency tracking and do not request the IDFA.

2. How we use information

We use the information described above only for the purposes listed below:

• To provide the core features of the app (account login, syncing your data across devices, computing drying loss, and generating the reports you export).
• To process subscription purchases and unlock paid features.
• To respond to support requests you send us.
• To comply with legal obligations.

We do not sell your personal information. We do not share it with advertisers. We do not use it to train any machine-learning model.

3. Third-party processors (subprocessors)

We rely on the following third-party services to operate Cure. Each is bound by its own terms and privacy policy. We provide each only the minimum data needed to perform its function.

If you would like the current privacy policy of any of these processors, search for "[service name] privacy policy."

4. Where data is stored

Cure's database is hosted in the United States by Supabase. Our subprocessors are also based in the United States. If you access the app from outside the United States (including the European Union, the United Kingdom, or other regions), your information will be transferred to and processed in the United States.

For users in the EU, UK, and other regions whose laws require it, transfers are made in reliance on Standard Contractual Clauses or equivalent transfer mechanisms maintained by each subprocessor.

5. How long we keep your data

We keep your account information and content for as long as your account is active. If you delete your account (which you can do at any time from Settings → Delete account inside the app), we permanently delete your account and all associated content, except where retention is required by law (for example, tax records related to purchases).

6. Your rights

Depending on where you live, you have rights regarding your personal information. We honor the rights below for all users, regardless of location.

6.1 Rights for everyone

• Access. You can request a copy of the personal information we hold about you.
• Correction. You can correct most fields directly in the app. If something cannot be corrected in-app, email us.
• Deletion. You can delete your account and content yourself from Settings → Delete account, or request deletion by email.
• Export. You can export your batches and readings as a PDF or CSV report from within the app, or request a machine-readable copy by email.

6.2 Additional rights for users in the European Economic Area, the United Kingdom, and Switzerland (GDPR)

In addition to the rights above, you have the right to:

• Restrict or object to processing of your personal information.
• Withdraw consent at any time where we rely on consent.
• Lodge a complaint with your local data-protection supervisory authority.

Our legal bases for processing under GDPR are:

• Contract (to provide the app you signed up for).
• Legitimate interests (to keep the service running and prevent abuse).

6.3 Additional rights for California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and share.
• Delete personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising.
• Limit the use of sensitive personal information. We do not collect sensitive personal information as defined by the CPRA.
• Be free from discrimination for exercising your rights.

6.4 How to exercise your rights

To exercise any of the rights above, email hello@phenolog.app from the email address associated with your account. We will respond within 30 days, or within the timeframe required by your applicable law if shorter.

7. Security

We take reasonable measures to protect your information:

• All data is transmitted over TLS.
• Database access is governed by Row Level Security policies that restrict each user to their own rows.
• The Supabase service-role key lives only on our server, never on your device.
• Passwords are stored only as salted hashes by Supabase.

No system is perfectly secure. If we ever experience a breach affecting your information, we will notify you and any required authorities consistent with applicable law.

8. Children

Cure is rated 17+ on the App Store and is not intended for, marketed to, or knowingly used by anyone under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make a material change, we will update the "Last updated" date at the top and, where the change is material to your rights, notify you in-app or by email before the change takes effect.

10. Contact

For any question, request, or complaint about this policy or your personal information, contact:

Matt Cohen Email: hello@phenolog.app Location: State of Maine, United States