Privacy policy
Last updated 7 October 2026
Heart Pain Tracker is a small, independent web app for keeping a personal log of chest pain episodes. It is run by an individual, not a company, and it is not medical software. This page explains what it stores about you, why, who else is involved, and how to get a copy of your data or delete it.
The short version: we store what you log so you can see it again. It is not sold, not used for advertising, and not shared with anyone except the services needed to run the app. You can download it or delete it yourself at any time from your profile.
What we store
| Data | Where it comes from | Why |
|---|---|---|
| Your email address, and – if you sign in with a provider – your name and that provider’s identifier for you | Google or Facebook when you sign in with them, or you, when you ask for a sign-in link by email | To know which log is yours, and to show your name |
| A display name, if you choose one | You, on your profile | To call you what you prefer |
| Sign-in links you ask for: your email address and a scrambled copy of the one-time link and code, which expire after 30 minutes | You, when you sign in by email | To let you in without a password. The link and code themselves are only in the email; what we keep cannot be turned back into either one |
| Each episode: when it happened, how severe it was, what you wrote about it, and optionally how active you were | You | This is the log itself |
| When your account was created and when you last used it | Recorded automatically | To run the service and count how many people use it |
| If you chip in: the amount, currency, date, and the email you gave at checkout | Stripe, after a payment | To thank you on your profile and keep an accurate record of money received |
What you log about your symptoms is health information. You decide what to record, and the app only uses it to show it back to you – in lists, charts and your downloads.
We never see or store your payment card details. Payments are taken on Stripe’s own checkout page.
Cookies and similar technology
- A sign-in cookie, which keeps you signed in for up to 60 days after you last used the app. The app cannot work without it, and it is not used for tracking. Signing out removes it.
- Short-lived security cookies used during sign-in and to protect forms against forgery.
- Your browser’s local storage remembers if you have dismissed the “chip in” banner. It never leaves your device.
There are no advertising or third-party analytics cookies.
Who else is involved
These services process data on our behalf, only as needed to run the app:
- DigitalOcean – hosting. The web server is in New York, USA, and the database is in Toronto, Canada.
- Google and Facebook (Meta) – sign-in, if you use them. We receive your name, email and an identifier; we do not post anything or read anything else from your account.
- Our email provider – delivering sign-in links, if you sign in by email. It receives your email address and the message itself. Nothing you log is ever emailed.
- Stripe – payments, if you chip in. Stripe’s own privacy policy covers what it collects at checkout.
- New Relic – performance and error monitoring. It receives technical information about requests, such as which page was loaded, how long it took and any errors. It does not receive what you log.
The web server also keeps standard access logs – including IP addresses and browser type – for a limited time, for security and troubleshooting.
Your data may be stored and processed in Canada and the United States. We do not sell it, rent it, or share it for marketing, and we will only disclose it if the law requires us to.
Who can see your log
Only you, when signed in. The administrator can see account details – name, email, when you joined and last visited, how many episodes you have logged and whether you have chipped in – in order to run the service and deal with problems, but the admin screens do not show what your episodes say.
How long we keep it
Your account and everything in it are kept until you delete it. When you do, your account and all your episodes are erased immediately. Payment records are kept as anonymous amounts and dates, with your name and email removed, because a record of money received is needed for accounting.
We also keep a record that a deletion happened, so we can show that requests are honoured. It holds the date, which sign-in provider was used, how long the account had existed and how many episodes and payments were removed – and, in place of your email address, a one-way fingerprint of it. A fingerprint cannot be turned back into an address; its only use is to confirm, if you ask us later, that your data was deleted.
Your rights
Wherever you live, you can do the following yourself from your profile:
- See and copy your data – download everything we store about you as JSON, or your episodes as CSV for a spreadsheet.
- Correct it – change your display name, or delete individual episodes from your history.
- Delete it – delete your account and all your episodes. See how to delete your data.
Depending on where you live – for example under the GDPR in Europe and the UK, PIPEDA in Canada, or state laws in the United States – you may have further rights, such as objecting to how your data is used or complaining to your data protection authority. Write to shawnstott@gmail.com about any of these.
We rely on your consent to store the health information you choose to log, and you can withdraw it at any time by deleting your account.
Consumer health data
Some laws – Washington’s My Health My Data Act and Nevada’s SB 370 among them – use the term consumer health data for information that identifies a person’s health status. What you log here is exactly that, and this section says how it is treated.
- What we collect: the episodes you log – date and time, the severity you give, your note, and optionally your activity level – along with the name and email from your sign-in.
- Why: only to show your own log back to you. Nothing else.
- Consent: we ask before storing anything you log, and record that you agreed. You can withdraw it by deleting your account, which erases it all at once.
- Who we share it with: nobody. It is never sold, and never shared for advertising. The services listed above – hosting, sign-in, payments, monitoring – process data on our behalf to run the app, and none of them receive what you log, except the hosting provider that stores it.
- Your rights: see it, get a copy, correct it, and delete it – all from your profile, without asking anyone. You can also appeal a refused request by writing to us; there is nothing to refuse today, since the tools are self-service.
- Who else can see it: nobody but you. An administrator can see that an account exists and how much is logged, but not what the episodes say.
Children
The app is not intended for anyone under 16, and we do not knowingly hold data about children.
Security
Connections are encrypted with HTTPS, the database only accepts encrypted connections from the web server, and there are no passwords stored here at all – signing in is handled by Google or Facebook, or by a one-time link sent to your email, of which we keep only a scrambled copy that expires. No system is perfectly secure, but we take reasonable care, and would tell affected users if their data were compromised.
Changes
If this policy changes, the date at the top will change. A change that affects how your existing data is used will not be applied to it without asking you first.
Contact
Questions about your data or this policy: shawnstott@gmail.com.