Magno
Privacy Policy
The short version. Magno stores the health data you type in, on your device and in your private account. We don't run analytics or ad trackers, we don't sell or share your data, and you can export or delete everything yourself from the You tab at any time. Questions: [email protected].
Counting how the free reader is used
When you use the free bloods reader we count six things: that a read started, that it finished, that it found nothing, that it failed, that a share card was made, and that someone tapped through to the App Store. Each is a single number per day on our server. No cookie, no id, no session and no fingerprint is attached, so we cannot tell two readers apart or link any of it back to you, and none of your results are included. Your lab file is read on your device and is never uploaded. You can check that in your browser's network tab: the only request is the counter.
1. Who this covers
This policy applies to the Magno iPhone app, to the website at magno.fit (including the free bloods reader and the guides), and to the account you can create in the app. "We" and "us" means Magno, based in the United Kingdom. You can reach us at [email protected].
2. What we collect
Account details. Your email address, a hashed version of your password (we never store the password itself), and an optional display name.
Sign in with Apple. If you sign in with Apple, we receive an identifier Apple makes for Magno and, the first time, the email you choose to share (which can be Apple's private relay address). We don't ask Apple for your name. We keep a token Apple gives us only so we can remove your Apple sign-in when you delete your account.
Sign in with Google. If you sign in with Google, we receive an identifier Google makes for Magno and your Google email address. We don't ask Google for anything else.
Where you came from. If you arrived from one of our own links, such as the Read my bloods page or a guide, we store a short tag saying which one. It is a plain word like "read", not a tracker, and it is the only thing we keep about which of our web pages you came from (App Store ads are covered below). Our public pages also count how many times each page was opened per day, as a number, with no cookie, IP address or browser details attached.
Health data you enter. Everything you log in the app: compounds and doses, injections and injection sites, blood pressure and pulse, weight, symptom check-ins, lab results you save, and notes. Lab report files you import are read on your iPhone and never uploaded. You choose what to enter. We never collect health data from anywhere else.
Security records. When you sign in, sign up, reset a password or make a similar change, we keep a short log entry with the time, the type of action, a shortened hash of your IP address and the user agent your app or browser sends. We use it to throttle abuse and investigate problems. We don't store raw IP addresses.
Feedback. If you send feedback from the app, we keep the message along with your account email and the user agent your app sends, so we can reply.
Purchases. Magno Pro is bought in the iPhone app and paid through Apple. RevenueCat tells the app whether you have Pro: it receives an anonymous app user id (your Magno account id when you are signed in) and Apple's record of the purchase. We never see your card or Apple ID details.
App Store ads. If you installed Magno after tapping one of our ads on the App Store, Apple tells RevenueCat which ad it was (the campaign and the search word), and RevenueCat keeps that with your purchase status so we can see which ads bring people who stay. This is Apple's own ad attribution: nothing tracks you across other apps or websites.
Apple Health (iPhone app)
If you turn on Apple Health in the Magno iPhone app, Magno reads your weight and blood pressure from Apple Health (for example from a smart scale or a blood pressure cuff) and writes the weight and blood pressure you log in Magno to Apple Health. It is off until you turn it on, and you choose exactly what Magno can read and write in the Health app. Data from Apple Health is used only to show your log in Magno. It is never used for advertising, never sold or shared, and never stored in iCloud by Magno. If you have a Magno account, readings brought in from Apple Health sync to your account like anything else you log, and you can delete them, or your whole account, at any time.
Backing up your health log
If you use Magno without an account, your log stays on your iPhone. If you sign in, Magno asks for your explicit consent before it stores your health log on its servers (on Cloudflare), and records when you agreed. Without that yes, nothing from your log is stored on our servers. You withdraw consent by deleting your account in the app (You, Delete account): the account and everything stored with it are deleted, on our servers and on that phone. To keep your log, use You, Export everything first.
3. What we don't do
- No analytics, advertising or tracking scripts of any kind.
- No selling, renting or sharing of your data with anyone.
- No third-party cookies. When you are signed in, the iPhone app uses one first-party session cookie to keep you signed in. The public website pages set no cookies.
- No reading of your data by us, except when you ask for help with a specific problem and agree to it.
4. How we use your data
- To run the app and sync your data between your devices.
- To keep you signed in and secure your account.
- To send password reset emails when you ask for one.
- To process Magno Pro payments and keep your plan active.
- To answer your feedback and support requests.
- To prevent abuse of the service.
We don't use your data to train models, build profiles, or for marketing.
5. Where your data lives
Magno is local-first: your data is kept on your iPhone, and when you have an account a copy is synced to it so you can recover it and use it on other devices. Without an account nothing leaves the phone.
The account copy is stored on Cloudflare's infrastructure (the account database). All traffic uses HTTPS, and Cloudflare encrypts stored data at rest. Cloudflare runs a global network, so your data may be stored or processed outside the United Kingdom under Cloudflare's standard contractual safeguards for international transfers.
We rely on a small number of service providers, each of which only receives what it needs to do its job:
- Cloudflare hosts this website and the account database.
- Resend delivers password-reset emails.
- RevenueCat keeps your purchase status, the record of who has Magno Pro, and which App Store ad, if any, led to your install.
- Apple runs the App Store (and processes Magno Pro payments), Sign in with Apple if you choose it, and Apple Health, which stays on your device.
- Google runs Sign in with Google, only if you choose it.
6. How long we keep it
We keep your data for as long as your account exists. When you delete your account, everything tied to it is permanently removed from our servers right away, and the app clears the copy on the device you deleted it from. Encrypted infrastructure backups may hold a copy for up to 30 days before it is purged automatically.
If you use the app on more than one device, clear it from the others too by signing out or removing the app.
7. Your rights and controls
- See and export your data. In the app, You, Export everything gives you a JSON file of your whole log. The doctor report gives a PDF or CSV.
- Correct it. Every entry can be edited or archived inside the app.
- Delete it. In the app: You, Delete account. It asks for your password (or for Apple or Google to confirm, if you signed in with them), removes your Apple sign-in for Magno, and cannot be undone.
- Change your password from the You tab, or use "Forgot your password?" on the sign-in screen.
Under the UK GDPR (and the EU GDPR if you live in the European Union) you also have the right to access, correct, delete, restrict or object to how we use your data, and to receive a copy in a portable format. The tools above cover most of this; for anything else, email us and we'll help within a month. If you're unhappy with how we handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out first.
Our lawful basis for processing your account and health data is your consent. For your health log the app asks for it explicitly before backing it up, and you can withdraw it at any time by deleting your account. Keeping the security log and processing payments is in our legitimate interest in running a safe, working service and meeting our legal obligations.
8. Security
Passwords are hashed with Argon2id. Sessions use secure, HttpOnly cookies. Everything is served only over HTTPS with strict security headers. Sign-in attempts are rate-limited. No system is perfectly secure, so please use a strong, unique password. If you believe your account has been compromised, or you find a security issue, write to [email protected].
9. Age
Magno is for adults. You must be at least 18 years old to create an account. We don't knowingly collect data from anyone younger; if you think that has happened, tell us and we'll delete it.
10. Not medical advice
Magno is a personal tracking tool. Nothing in the app, including plain-words explanations of lab results, ranges, reminders and charts, is medical advice. Talk to a licensed clinician about your health decisions. See the Terms of Service for more.
11. Changes
If we change this policy, we'll update the date at the top and, for anything significant, tell you in the app. Continuing to use Magno after a change means you accept the updated policy.
12. Contact
Email [email protected] for anything about your data or this policy. A person reads every message, and we reply within 2 working days.