Privacy policy

Updated November 9, 2026 · Also in Herald, in Settings › Help › Privacy policy

Who we are

Done Marketing, Inc., a California corporation, 440 N Barranca Ave, Unit 8081, Covina, CA 91723, United States. Email: support@heraldjournal.app. In this policy, we means Done Marketing, Inc. Herald means our apps on supported Apple devices. This policy also covers our website and support service.

We are responsible for the personal information we process to operate Herald, its relay, website and support service. Your local journal and optional iCloud storage remain under your control. The fact that we cannot decrypt your journal does not remove responsibilities that applicable privacy laws place on us. Apple and other providers also have responsibilities for their own services.

What stays on your devices

Your entries include seizures and auras, check-ins, mood, drinks, medications and doses, sleep, action plans, rescue-kit information, notes, appointments, care-team details and other information you add. Herald stores these in its local storage. Protection depends on your device, operating system, passcode and security settings; on a Mac, keep your login and disk encryption secure.

A video you attach to an episode is stored on that iPhone or iPad. Herald does not sync that copy, include it in its encrypted backup export, or include it in the device backup. The original video may still exist in Photos or Files under those services' own settings. A video can leave Herald if you choose to share it.

Some choices stay on one device only, such as Herald's look, motion and sounds, tips, and what you've hidden on Today.

Your own iCloud, sealed

iCloud sync is off until you turn it on. With it on, Herald seals each record with a key only your devices have, then saves it in the private database of your own iCloud account. The key travels between your devices in iCloud Keychain, which Apple encrypts end to end.

Apple stores the encrypted records and can see associated metadata, including record types, identifiers, sizes, change times and the accounts participating in a share. We do not receive the journal-decryption keys. This protection does not cover information you separately export, share in a message or send to support.

If you lose the key (for example, every device is reset at once), the copy in iCloud can't be opened by anyone, us included. Herald then offers to seal your log again from a device that still has it.

Apple Health

If you connect Apple Health, Herald reads the categories you allow, such as sleep, medications and doses, caffeine and cycle information, on the device when needed. It does not copy Health-derived data into Herald's CloudKit records, trusted-contact sharing, push payloads or encrypted backup export. A report or spreadsheet you generate may include permitted Health-derived information; review its contents before sharing it. Apple Health's own storage and sync are separate.

Herald adds to Health only what you choose, each off until you turn it on: how your day feels or your mood, two symptoms after a seizure, the nights you note as time in bed, and slow breathing as mindful minutes. Delete everything offers to remove what Herald added.

Trusted contacts and heads-ups

You can invite people to see a heads-up when you start one. They need Herald and an Apple Account; you choose them, and you can remove anyone at any time.

Under What you share, heads-ups are shared with your approved contacts. Location during a heads-up, what helps, your action plan and rescue-kit location may be enabled by default; check them before sharing. Today's check-in, medications and doses, and recent episodes require you to turn their separate options on. These choices are your default; you can turn heads-ups or any of these options off, or on, for an individual contact. Action-plan medication details may still be shared through the plan unless you exclude them. Its time to call accompanies a heads-up even if sharing the rest of the plan is off. There is no separate routine sharing of mood, drinks, cycle, nights or journal notes, but text you place in a shared field or exported report can contain that information.

Shared records are encrypted for your devices and your approved contacts' devices through iCloud sharing. Removing a contact changes the sharing key for future data. Stopping sharing deletes the shared zone when the operation completes. Contacts may retain information already received, including offline copies until their devices refresh, screenshots or exports; removal cannot recall those copies.

The private part of an invite link follows the # in its address. A normal web request does not send that fragment to our server. The browser and any app or person you send the full link to can see it, so treat the link as private.

The heads-up relay

Your device sends heads-up notifications through a Cloudflare Worker to Apple's push service. Herald's relay does not use a persistent journal database or retain notification payloads as an application log. It does keep security information in temporary memory across requests, as explained below.

The relay processes the sender's IP address, Apple App Attest proofs, recipient push tokens and payloads. Rate limiting uses IP addresses and device public-key identifiers with request times; replay protection uses request fingerprints. These entries remain in volatile Worker memory beyond an individual request and are pruned or lost when that memory is cleared or the Worker instance ends. The current implementation does not guarantee deletion at a fixed elapsed time. Encrypted note contents cannot be opened by the relay.

A Live Activity push contains fields iOS needs without opening Herald: a random, pseudonymous alias, start and end times, whether a heads-up was started by mistake and its call timing. These fields are visible to the relay and Apple. They do not contain a name or coordinates, but in context they can reveal health-related activity and are not anonymous merely because the alias is random.

Cloudflare processes requests on its network and may retain service, security and traffic information under the applicable agreements and its privacy terms. Our application logging settings do not disable every provider-level record. Apple processes information for push delivery, CloudKit, App Attest and Maps under the terms applicable to those services.

Where you are

During a real heads-up, if location is permitted and sharing is enabled, Herald obtains your location, uses Apple Maps to find a nearby address, and encrypts the place for your approved contacts. Platform indicators show when location is in use. Herald stops its location updates when the heads-up ends and updates the shared record to remove the place. Changes may take time to reach iCloud or offline contacts; a previously copied map link cannot be recalled.

A separate location lookup, where permitted, helps identify the country for the emergency number as a heads-up starts. Herald retains the country code on that device. Turning off location sharing is distinct from denying location permission. The displayed number and location can be unavailable or inaccurate.

"Text them too" opens Messages with a line and a map link for you to send yourself. Herald never sends a text.

Apple Watch, iPad, Mac and Apple Vision Pro

Your other devices use the same optional encrypted journal sync. The iPhone and Watch also communicate over Apple's device link, including journal transfer when iCloud sync is off and information needed for heads-ups. Herald does not directly monitor Watch sensors to detect seizures or use Fall Detection. Information read through Apple Health may have originated from a Watch. Health integration, location, alarms and calling features vary by platform.

Apple Intelligence

On supported devices, Herald uses Apple's on-device model for optional pattern wording and, when you request it, a report-note summary. Pattern wording uses the relevant sentence and counts. With the same setting on, it also words the "That day" line on a seizure's or aura's sheet from that day's doses, check-in and sleep, including any read from Apple Health; that wording is not saved. Note summarization uses the selected period's notes, with medication names and seizure dates as context. These model requests run on the device; Herald does not send them to a cloud AI service. The Patterns setting controls pattern wording and the "That day" line; report-note gathering is requested separately. Check generated wording for omissions or errors before using or sharing it.

Herald Plus and purchases

Purchases are processed through Apple. We do not receive your payment-card details through Herald. The app reads Apple-signed purchase and entitlement information on your device to provide access. Apple may provide the developer with sales, financial or transaction reports under its developer services; these are separate from your journal.

The report and your backup file

Reports, spreadsheets and action-plan PDFs are generated on your device and may contain readable health information, including any Health data included in the selected output. They are not protected by Herald's journal encryption after export. The system share or file interface sends or saves them where you choose. Herald's backup export is encrypted with your passphrase, which we cannot recover. Ordinary device backups are separate and may include the local journal under Apple's or your backup settings. Manage exported files, messages and backups separately.

Links and our website

External learning and help links open in the system browser interface. The destination and its providers receive normal web-request information under their own policies; Herald does not attach your journal to those links. Our website is delivered through Cloudflare, which receives request information such as an IP address. We do not use behavioral advertising or third-party advertising trackers. On our website, not in the Herald apps, we use Cloudflare Web Analytics to count visits in aggregate: the pages viewed, the site that linked to them, the visitor's country, browser, operating system and type of device, and how quickly pages load. It sets no cookies, doesn't use fingerprinting, and isn't used to identify you or follow you to other websites. We don't combine it with your journal, your emails to us or relay information. The invite page at heraldjournal.app/join has no analytics. The website uses no advertising or tracking cookies; Cloudflare may set a cookie it needs for security.

Writing to us

Report a problem and Write to us open an email in your own mail app. Report a problem adds Herald's version, your device, its system, Herald's language and region, whether an Apple Watch is paired, whether iCloud is on and how you track medications. Nothing from your log. You see it all before you send.

Done Marketing, Inc. handles support and privacy requests from the United States using Google Workspace for support@heraldjournal.app. Google processes correspondence to provide the mail service. Emails can include your address, message, attachments and health details you choose to send. We do not ask for your complete journal. We retain conversations for two years after they end, unless an earlier valid deletion request applies or a specific legal obligation or claim requires limited longer retention. Provider backup and deletion cycles may differ from removal from our active mailbox.

Crash reports

Herald has no embedded third-party analytics or crash-reporting SDK. Depending on Apple settings and services, Apple may make diagnostic or usage reports available to us. These are not intended to contain your journal; we check any report we receive for incidental personal information and delete what we do not need.

Testing Herald with TestFlight

If you join Herald's beta through Apple's TestFlight, Apple shares with us crash reports, usage information (such as how often Herald is opened, your device model and system version) and any feedback you choose to send, including screenshots and comments. If you join through our public link, we do not receive your name or email address unless you include them in feedback or write to us; if we invite you by email, we see the name and email address used for the invitation. We use this information only to test and improve Herald and do not share it with third parties. A screenshot shows what is on your screen, so it can include your journal if it is open. Apple keeps feedback for one year and describes its own handling in its TestFlight privacy notice.

Why we may handle this

Where applicable law requires a legal basis, service delivery relies on the applicable contract basis; proportionate security, support administration and aggregate website analytics may rely on legitimate interests; and required records rely on legal obligations. Processing health information requires an additional applicable sensitive-data ground, such as explicit consent. Consent to optional Health access, sharing and location is requested through the relevant feature and system controls. You can withdraw consent prospectively; this does not invalidate earlier lawful processing. Where a feature cannot work without the information, withdrawal may make that feature unavailable. There is no advertising sale or solely automated decision with legal or similarly significant effects.

Where it's handled

Information is processed on your devices, in the locations used by Apple for your selected services, through Cloudflare’s international network and through Google Workspace for support email. Our company staff handle support from the United States. Google’s processing may occur outside the United States; we do not promise US-only hosting. Where required, the responsible exporter must use an applicable adequacy decision, valid certification or appropriate contractual safeguards. A provider’s transfer terms do not automatically cover a separate transfer to Done Marketing. Contact us for information about the safeguards applicable to your request.

How long

Journal entries remain until you delete them, subject to your sync and backup choices. Relay memory retention is described above; Cloudflare, including for website analytics, and Apple may have their own service-retention periods. Support correspondence normally lasts two years after closure. Consent, transaction, complaint and incident records may require separate, limited retention for legal obligations or claims. Deleting the app does not delete those separate records.

Your choices and rights

You can view, correct and export journal information in Herald. Delete everything applies to this device and, when iCloud sync is enabled and reachable, the connected iCloud journal; other devices must receive the deletion. With sync off, copies elsewhere are not erased by a local deletion. A failed cloud deletion may require you to retry. Uninstalling is not a reliable way to erase iCloud, other devices, Apple Health, exports, recipient copies or device backups. Use the in-app deletion and sharing controls first and manage those separate copies yourself. Deleting Herald does not cancel a subscription.

We cannot retrieve or decrypt your journal for you. We will still assist with privacy requests, explain available in-app controls, and address information held in support or other company-controlled systems. We do not require you to send the journal, password or encryption keys to make a request. We may ask for proportionate information to verify a request.

Depending on applicable law, you may have rights to information, access, correction, deletion, portability, restriction, objection, withdrawal of consent and a complaint or appeal. Send requests to support@heraldjournal.app. We respond within the applicable deadline, generally within one month for EEA/UK requests and within the state-law periods explained in our consumer-health notice. We explain any lawful extension or refusal and the available review route. Mandatory local rights apply even if they are not named here.

Your age

Where available, Herald asks Apple’s Declared Age Range service for an age band rather than a date of birth. The source and verification level can vary by account, platform and region. Otherwise, setup asks the person operating Herald to declare that they are at least 13 or a parent or guardian. Consent choices, policy versions, date and available age information are stored in the encrypted journal. We do not use this checkbox to claim that a parent’s identity or relationship has been independently verified.

Children

Herald’s under-13 use case is a parent or legal guardian operating the app to record the child’s information. Herald is not offered for direct use by children under 13. The adult must have authority to record and share that information and should share only what is appropriate. The adult operating Herald and the child whose information is recorded are distinct. An Apple age response is not proof of parental authority. Local rules for children’s health information and for older minors still apply. Contact us about a child’s information or suspected unauthorized use; we will investigate, assist with available deletion controls and address information we control.

US state notices

We do not sell personal information, share it for cross-context behavioral advertising, or use advertising tracking across apps and websites. User-directed sharing and service-provider processing described above still occur. Local Plus prompts can respond to journal activity, such as sufficient check-ins or an upcoming appointment; this is distinct from third-party advertising.

Our Consumer Health Data Privacy Policy at heraldjournal.app/consumer-health provides additional information for Washington and Nevada consumers. Other applicable state rights remain available.

Security

Herald uses app-level encryption for its CloudKit journal and shared records, system security for local storage and transport, and App Attest for relay requests. Clear delivery metadata, exported documents and support emails are outside the journal's end-to-end encryption. No system is infallible. We investigate incidents and provide notifications where required.

Changes

The date above identifies this version. We will explain material changes and seek any new consent required before introducing new processing. Continued use alone does not substitute for consent where the law requires an affirmative choice.

Contact

Done Marketing, Inc., a California corporation, 440 N Barranca Ave, Unit 8081, Covina, CA 91723, United States. Email: support@heraldjournal.app.

You may complain to the privacy regulator with jurisdiction where you live or where the relevant processing occurs. Contact us for assistance identifying the appropriate route; contacting us first does not limit that right.