Privacy policy

Last updated 30 September 2026

This policy explains what happens to information in INR Tracker ("the app"), a warfarin dose and INR record for iPhone and Android.

The short version

There is no account and no sign-up.

Everything you record is kept on your device, in an encrypted database. We can't see it, and we don't receive a copy.

Your records leave your device only in a backup or export you make or turn on, a report or email you send, or, still encrypted, in your phone's own device backup.

The app has no analytics, no advertising and no tracking.

Apart from automatic backups you turn on, the only thing the app sends over the internet by itself is a check with our payment provider, RevenueCat, to confirm whether you've made the one-time purchase. That check never includes anything you've recorded.

Who we are

INR Tracker is made by Stefan Tulac, an individual developer based in the United Kingdom ("we", "us"). For anything in this policy, email inrtrackersupport@gmail.com.

For the small amount of personal data we do receive (see "Information we receive" below), we are the data controller under UK data protection law.

What the app stores on your device

The app keeps what you enter in a database on your device:

INR results and test dates
your warfarin dose schedule, and the doses you record as taken or skipped
vitamin K intake, including any foods you add
physical activity, including workouts you import from Apple Health or Health Connect
body weight (entered or imported) and alcohol units
health events, and any notes you write
photos you attach to INR results, dose schedules or health events, and their captions
the target range and alert threshold you set
clinic details you enter, such as the clinic's name, phone number and email address, your ID at the clinic, and notes
clinic report records, reminder settings and app preferences
a record of when you accepted the app's disclaimer

The database is encrypted. The key that opens it is created on your device and held in your device's secure storage (the iOS Keychain or the Android Keystore). None of this is sent to us.

The app uses your photo library only when you choose a photo to attach, and your camera only when you take one to attach or, on iPhone, to scan your meter. A photo you attach might be of a meter display or a clinic letter, and the app takes one photo at a time: the one you take or pick. It never looks through your library. Each photo you attach is re-saved as a smaller image with its location and other hidden details removed, then stored encrypted in a separate file on your device, with its own key held in the same secure storage as the database key. Photos are never sent anywhere by the app. They leave your device only inside a backup you make or turn on (see below), or, still encrypted, in your phone's own device backup.

If you buy the one-time unlock, on iPhone you can also scan your meter: the app uses your camera to read the number on the meter's display, so that it can fill in an INR result for you to check and save. The photo is processed on your device by Apple's built-in text recognition. It isn't kept: the camera's temporary copy is deleted as soon as the app has read it, the photo is held in memory only until you close the scan, it's never saved to your records or your backups, and nothing about it leaves your device. Only the INR value you choose to save is recorded, the same as one you type.

If you use the app's widgets (the home-screen widget, and on iPhone the lock-screen widgets), the app also keeps a small copy of what they show — whether today's dose is due or recorded (and the dose in mg and tablets only if you switch that on, and only on the home-screen widget), your next test day and your next clinic report date — in a separate encrypted file on your device. It never contains an INR result, is left out of your device's own backup, and is deleted when you switch the widget off or delete the app.

On iPhone, tapping Taken on the widget, or asking Siri to log today's dose or an INR result, doesn't record anything by itself. On iOS 17 or later a tap on Taken, and on iOS 16 or later a request to Siri, waits in another small encrypted file on your device until you next open the app: that you marked today's dose as taken, or the INR value you gave Siri, and when you asked. On earlier versions of iOS, and on Android, tapping Taken opens the app straight away and nothing waits in a file. When you open the app, it deletes the file and asks you to confirm before anything is recorded. It uses an INR value only if you asked within the last hour, and a dose request only on the same day; anything older is deleted without being used. Like the widget's copy, this file is left out of your device's own backup, and it is deleted when you switch the widget off or delete the app. Asking Siri to log an INR result works with the widget switched off too, and that request waits in this file until you next open the app. What you say to Siri is handled by Apple under Apple's own privacy terms; the app receives only the request, and the INR value if you give one.

Your device's own backup service, such as iCloud Backup or Android device backup, may include the app's database file and photo files. That copy stays encrypted, and the keys that open it can't be moved to another device.

The app also keeps a short log of technical errors on your device, so that you can share it with us if you ask for help.

Apple Health and Health Connect

If you buy the one-time unlock, you can import workouts and body weight from Apple Health (on iPhone) or Health Connect (on Android). The app asks for access to read two kinds of data, and nothing else:

workouts: the type of workout, when it started and ended, and, on iPhone, the time zone Apple Health recorded it in, where there is one
body weight: the weight and when it was recorded

With each, the app also keeps the identifier Apple Health or Health Connect gives the entry, so that the same workout or weight isn't imported twice.

The app reads them only while you use Import from Health in Settings: after you tap Continue it reads the days since your last import, or the last 90 if there has been none, and then any dates you choose, to show what it found, and it adds entries only when you tap Import. It has no background access and doesn't read anything on its own. It never writes anything to Apple Health or Health Connect, and it doesn't read calories, distance, steps, heart rate, routes, location or any other health data. What it reads becomes ordinary entries in the app's encrypted database on your device: a workout as an activity entry, and a weight as that day's weight entry (a weight you entered yourself is never replaced). Imported entries are handled exactly like the rest of your records: they are never sent to us or anyone else by the app, and they leave your device only inside a backup, export or report you make or turn on (see "When information leaves your device" below), or, still encrypted, in your phone's own device backup.

Data from Apple Health or Health Connect is not used for advertising or marketing, not sold, not shared by us with anyone, and not seen by anyone unless you share a backup, export or report. You can see and change the app's access at any time: on iPhone in the Health app, or in Settings → Privacy & Security → Health; on Android in Health Connect (Settings → Health Connect on Android 14 and later, or the Health Connect app on earlier versions). Removing access stops future imports; entries already imported stay in the app until you delete them. Health Connect's own screens link to this policy.

When information leaves your device

Your records leave your device when you send them, or turn on something that sends them (your phone's own device backup is covered above):

Backups. You can save a backup file anywhere through your device's share options, and protect it with a passphrase, using AES-256 encryption. A backup includes the photos you've attached, and workouts and weight you've imported from Apple Health or Health Connect. A backup made without a passphrase, and the photos in it, can be read by anyone who has the file.
Automatic backups. If you turn them on, the app writes backups on a schedule to your own iCloud Drive (on iPhone) or to a folder you choose (on Android), which may be in a cloud storage service. They include your photos, as a manual backup does. Turning them on asks you to choose a passphrase, using the same AES-256 encryption as a manual backup, or no passphrase. That passphrase is held only on this device, in the iOS Keychain or Android Keystore — it isn't stored in the backup itself and isn't synced to your other devices. If you choose no passphrase, anyone with access to that iCloud Drive or folder can read the backups. If protection is on but the passphrase isn't on this device — for example, after restoring onto a new phone — automatic backups pause until you enter it again in Settings.
Exports. CSV and JSON exports are not encrypted, and go wherever you send them. They include your weight and alcohol entries along with the rest of what you have recorded. They don't include your photos, only each photo's caption and file details.
Clinic reports. A PDF report goes wherever you share, save or print it. No PDF and no clinic email includes the daily weight or alcohol figures you record. A health event you file under Alcohol or Weight change is a health event, and is included wherever health events are.
Emailing your clinic. The app opens your own email app with a draft. Nothing is sent until you send it, and it goes through your email provider, not through us.
Calling your clinic. The app opens your phone app with the clinic's number.
The error log. It leaves your device only if you tap Share error log. It is meant to hold technical details rather than your records, but an error message can occasionally include a piece of information the app was working with, so look through it before you share it.

Once your information is with a cloud service, an email provider, or anyone you share it with, their own privacy terms apply: for example, Apple's for iCloud Drive, or Google's for Google Drive.

Information we receive

When you contact us

If you email us, we receive your email address and whatever you send, including any attachments such as an error log. We use it only to reply to you and to fix problems you report. We keep support emails for up to two years after the conversation ends, then delete them.

Please include only the health details needed to answer your question. If you do include health information, we use it only to answer you, and you can ask us to delete it at any time.

Legal basis: our legitimate interest in answering you and keeping the app working. Where you choose to send us health information, your explicit consent.

The one-time purchase

The app offers a one-time purchase through the App Store or Google Play. We use RevenueCat, Inc. to confirm and restore purchases. When the app opens, and when you buy or restore the purchase, the app contacts RevenueCat. RevenueCat receives:

a random ID the app creates for this purpose, which is not based on your name, your email address or any account you hold
purchase and transaction details from the App Store or Google Play
technical details needed to handle the request, such as your device model, operating system version, app version, store country and IP address

RevenueCat never receives anything you've recorded in the app. We use this information only to confirm and restore your purchase.

RevenueCat is based in the United States. Where your personal data is transferred outside the UK, it is protected by the safeguards UK data protection law requires. See RevenueCat's privacy policy.

Apple or Google take the payment itself. We never receive your name, payment card or billing details. Apple's or Google's privacy policy applies to the payment.

Legal basis: to perform our contract with you, by providing and restoring the features you've paid for.

Crash reports and statistics from Apple and Google

If you've chosen in your device settings to share analytics with app developers, Apple or Google may give us crash reports and app statistics. Apple or Google prepare these, and they don't identify you. The app itself doesn't collect them.

What we don't do

There is no account or sign-in.
The app contains no analytics or advertising tools.
We don't track you across other apps or websites.
We don't sell your personal data, share it with advertisers, or use it for marketing.
The app doesn't use your location or contacts.
The app never writes to Apple Health or Health Connect, and reads from them only while you use Import from Health in Settings.
The app doesn't use your camera or photo library except when you choose to attach a photo or scan your meter, and it never sends your photos anywhere.

Notifications

Reminders are scheduled on your device. They don't come from a server. A notification can appear on your lock screen. Dose reminders say "Today's dose is due." and don't show your dose amount, unless you turn on Show dose in reminders and widget in Settings. With that on, a dose reminder shows today's dose in mg, and anyone who can see your lock screen can read it. You can change what appears on your lock screen in your device's notification settings.

The app asks for permission to show notifications. On Android, it can also schedule them for an exact time and restore them after your device restarts.

Children

The app is intended for adults. It is not directed at children, and we don't knowingly receive personal data from anyone under 18.

Your rights

Your records are on your device, so you control them. You can view, change and export them in the app. When you delete an entry, it no longer appears in the app, but it stays in the database on your device and is included in backups and in CSV and JSON exports. A photo you delete works the same way for 30 days, including in backups you make in that time; after that, it is permanently removed from your device the next time you open the app. Deleting the app removes its database from your device. Backups and exports you've saved elsewhere stay where you put them until you delete them. We don't hold a copy, so we can't recover your records if they are lost.

Under UK data protection law, you have rights over the personal data we do hold (support emails, and purchase records held by RevenueCat). You can ask to access it, correct it, delete it, restrict or object to how it's used, or receive a copy of it. Email us to use any of these rights. The purchase ID isn't linked to your name, so to find purchase records we may ask for details such as your App Store or Google Play order number.

If you're unhappy with how we've handled your personal data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to put things right first, so please contact us before you do.

Security

Your database and photos are encrypted on your device, and any backup protected with a passphrase — manual or automatic — is encrypted with a key made from that passphrase. We don't run a server that holds your records. No method of storing or sending data is completely secure, so keep your device locked and your backup passphrase private.

These web pages

These pages are hosted on Cloudflare Pages. They use no cookies, analytics or tracking scripts. Cloudflare processes technical information, such as your IP address, to deliver the pages and protect them from abuse. See Cloudflare's privacy policy.

Changes to this policy

If we change this policy, we'll update this page and the date at the top. If a change affects what information leaves your device, we'll also say so in the release notes of the app update that makes the change.

Contact

Stefan Tulac
inrtrackersupport@gmail.com