Privacy policy

Account information and Google sign-in

When you create an account, Toldwell stores your name, email address, account identifier, and profile preferences. Email/password accounts store a password hash. Signing in with Google is optional; Google provides your name, email address, email-verification status, and Google account identifier so we can create or find your account and authenticate you. Its basic identity response may also contain a profile-picture URL and other basic profile claims.

Authentication records, Google identity and token information, and sessions are stored in Cloudflare D1. OAuth access and refresh tokens are encrypted by the authentication service. Google passwords are handled by Google and are never provided to Toldwell. We request only basic identity permissions, not access to Gmail, Drive, contacts, or Google health data.

The app uses this information for sign-in, your profile, account security, and identifying your record. It does not use Google account information for advertising, sell it, or use it to train AI models. Google handles its own sign-in service under Google’s privacy policy.

Subscription and tutorial preferences

We store whether you have completed or skipped the tutorial with your account. Stripe handles card collection, checkout and billing information. New trials require card setup and automatically convert to the selected paid plan unless canceled before the trial ends. Toldwell never receives full card numbers or card security codes. The app stores billing identifiers, your chosen plan, and trial and subscription dates. It does not send pain records, body markings or report contents to Stripe. Prices, refunds and cancellation are described in our terms.

Your pain records and device storage

Body markings, ratings, descriptions, timing, drafts, and preferences are saved in this browser’s local storage. Records are separated by account in the app. Local records are not encrypted by the app. Someone with access to your device or browser profile may be able to access them.

Cloud backup and sync (Plus and Evidence plans, your choice). If you turn on backup in Settings, a copy of your record (entries, readings, answers, corrections, draft, appointment date and visit notes; not your browser-local share links) is encrypted with AES-256-GCM and stored in a dedicated database hosted by Cloudflare. The encryption key is held by the service, never sent to your browser, and the copy can be read only through your signed-in account. Every read, write and removal is recorded as an audit event with an opaque account identifier and no clinical content. Devices you sign in on merge their copies; the newest edit wins and deletions carry over. Nothing is uploaded until you turn backup on. Turning it off keeps the copy until you choose “Remove server copy”, which works on every plan and takes effect immediately; deleting your account removes it too. When a paid plan ends, new backups pause and the copy is untouched.

Share links that last (Plus and Evidence) store an encrypted copy of one report on the server for the number of days you choose; the key is in the link and never reaches the server. A PIN, if you set one, is stored as a salted hash. You can see how often a link was opened and revoke it at any time.

Signing out ends your session but keeps local records and drafts on the device. You can delete individual records from Records. Clearing the site’s browser data removes its local copies and preferences; export anything you wish to keep first.

Why we use each category

We use account information only to authenticate you, secure the service, show your chosen profile, support you, and operate an account you requested. We use pain records only to let you create, review, export, and share your diary. We use security and device/network information to prevent abuse, maintain sessions, investigate faults, and protect accounts. Optional tutorial and appearance choices remember how you want the product to work.

Do not enter information the diary does not need. The app does not request contacts, precise location, photos, microphone, advertising identifiers, HealthKit, Health Connect, or body-sensor access.

Sharing is your choice

Creating a QR link uploads an encrypted snapshot of the report you selected to Cloudflare. The link carries the information needed to open it, so anyone who has the complete link can view it while it is available. Links expire after 30 minutes and can be revoked sooner. Expiry prevents further access through the service; it does not erase copies a recipient already saved.

PDFs and printed reports remain wherever you or a recipient save them. Your report name and selected record details are included; review the report and written-description option before sharing. Pain reports are not sent to Google as part of sign-in.

Security information and service providers

Cloudflare hosts the website, account database, and temporary encrypted reports. It processes the network information needed to deliver and protect the service. Authentication sessions may include IP addresses and browser information. The app keeps security events with action, outcome, time, and internal identifiers. Those audit events do not contain passwords, Google tokens, or pain descriptions.

Essential session cookies support sign-in and security. A first-party cookie remembers an explicit no-trial offer for up to 30 days; the applicable trial eligibility is saved with accounts created through that offer. Your plan, the one-time free report, the seven-day Plus trial, your backup choice and, if you answered, how you heard about the diary (a category, never an identifier) are stored with your account. Local storage also remembers your appearance settings and records. The app does not include advertising trackers. Hosting and authentication data may be processed outside your country.

First-party campaign measurement

For tagged advertising visits, we remember a general campaign category (doctor, physical therapy, or quick-entry creative) for up to 30 days. We count visits to selected public pages once per browser tab session and retain the category with newly created accounts to measure registrations, checkout activity, and current subscriptions. Public-page counts are stored by day and category, without names, email addresses, IP addresses, full URLs, or ad click identifiers. We do not collect pain records, report contents, or diary activity for these measurements, and we do not send account or subscription outcomes to advertising platforms. Global Privacy Control and Do Not Track disable this attribution. Clearing cookies removes the browser preference; account deletion removes the stored account category. Aggregate daily counts do not identify individual accounts.

No sale, advertising, or profiling with health data

We do not sell pain, diagnosis, medication, symptom, body-location, or other health data. We do not send it to advertising platforms, data brokers, cross-site advertising services, or third-party analytics, and we do not use it to build advertising profiles. We will not introduce those uses without changing the product and providing any notice and consent required by law.

Access, export, correction, and deletion

Your Records page shows the health entries held in this browser. You can correct or delete an individual entry there (on the Evidence plan, a correction made more than ten minutes after saving is recorded in an amendment ledger with the original kept, so a claims reader can see what changed), export a selected period from Share as a PDF or CSV, export everything as JSON from Settings on any plan, or use Settings to delete all health records for the active account from this browser and to remove any server copy. Review exported files before sharing them; copies you or a recipient save are outside our control.

Local records remain until you remove them or clear this site’s browser data. Server account and security records currently have no automatic account-deletion or fixed retention schedule. Expired report links are denied access, with encrypted-report cleanup handled separately; expiry is not a promise that every backup is immediately erased.

You can revoke Google access from your Google Account connections. This does not itself delete your Toldwell account or local records. If Google is your only sign-in method, revoking access may require authorizing Google again to sign in.

For an account-information copy, correction, or deletion request, email Toldwell support at info@logthepain.com. We may need to verify account ownership before acting. Do not include pain records, passwords, or authentication codes in your message.

Children

Toldwell is designed for an adult account holder. A person under 18 should use it only with a parent or guardian who controls the account and sharing. We do not knowingly create accounts for children without the involvement required by applicable law.

Changes to this notice

This page describes the current service. We will update the notice as features or data practices change and request additional Google consent before using Google data for a new purpose that requires it.