Privacy Policy

Last updated: September 18, 2026

Papilio ("Papilio", "we", "us") is a private diary for Hashimoto's thyroiditis. There is no account and no sync. This policy explains exactly what is stored, where it lives, and what a small amount of purchase-related data a Papilio Pro subscription shares with our payment provider.

The short version

• Your symptoms, lab results, dose history and notes live in one database on your device.
• There is no account, no login and no cloud sync of your health data.
• The app itself never uploads a diary entry, symptom, lab value, dose or note anywhere.
• If you subscribe to Papilio Pro, our subscription provider (RevenueCat) and Apple process the purchase — see "Papilio Pro subscriptions" below for exactly what that involves.
• If your device backup (iCloud Backup or Android Auto Backup) is switched on, it includes the app's data like it does for any other app.

Data controller

Papilio is published by Mendi Tekstilwaren / Dilara Demir Caglar, Fauststrasse 44a, 81827 München, Germany. Contact: support@qrodesk.com.

What is stored on your device

Category	Examples
Daily diary	Up to 8 symptom scores per day (0–10 scale) and a free-text note.
Lab results	TSH, fT4, fT3, TPO antibodies, Tg antibodies, TRAb, ferritin, vitamin D, B12 — each with the unit and reference range you entered.
Dose history	Levothyroxine dose changes and the date each one started.
App settings	Language, unit system, display unit, medication reminder time, whether onboarding is complete.

All of this is written to a single SQLite database in the app's own storage area on your device. No account or sign-in is required or offered — there is nothing to create and nothing to log into.

What Papilio does not collect

• No account, email address, or sign-in of any kind.
• No location data.
• No access to your contacts, photos, or Health app / Health Connect data.
• No advertising trackers or ad SDKs.
• No analytics or crash-reporting SDKs.
• No diary entry, symptom, lab value, dose or note is ever sent off your device — by the app itself, in any build.

Device backups

Backups are deliberately not disabled — someone with years of thyroid history should not lose it with their phone. This means:

• iOS: the database lives in the app's Documents directory, which iCloud Backup and encrypted Finder/iTunes backups include by default, the same as any other app's documents.
• Android: the database lives in the app's internal storage, which Android Auto Backup includes by default, subject to Android's per-app backup size limit.

We do not control whether your device backup is switched on — that is your operating system's setting. We deliberately do not say "your data never leaves this device," because that would not be true when a device backup is enabled. What is true: the app itself never uploads anything, and any backup that exists is created and encrypted by your operating system, under your control.

Papilio Pro subscriptions

Papilio Pro is an optional, auto-renewing subscription that unlocks the PDF report. Subscribing requires two additional, purely transactional data flows — neither of which ever includes your health data:

• RevenueCat, our subscription infrastructure provider, receives an anonymous app-user identifier and your subscription status (active, expired, product purchased) so the app can unlock Pro features on your device. This identifier is not your name, email or Apple ID — RevenueCat's SDK contacts its servers when the app launches and when you interact with the paywall, to keep that status current.
• Apple processes the payment itself through the App Store. We never see or store your payment card details.

No diary entry, symptom, lab value, dose or note is ever sent to RevenueCat or Apple. The only things that leave your device for a subscription are the anonymous identifier and subscription status described above.

If you never open the paywall or subscribe, RevenueCat's SDK still performs this same anonymous status check in the background so the app knows whether Pro is active — it does not wait for you to tap anything. It never has access to anything you have recorded.

Other service providers

• RevenueCat — subscription status and entitlement management for Papilio Pro.
• Apple — App Store subscription billing, and platform services such as local notifications, which are scheduled entirely on your device.

We do not sell your personal data to anyone.

Your own export and backup

Settings → Export records writes a JSON or CSV file of everything you've recorded through the system share sheet — a backup path you control, free and never gated behind Papilio Pro. You can restore from your own JSON export at any time, either merging it with what's already on the device or replacing it entirely.

Deleting your data

Go to Settings → Delete all data to permanently remove every entry, lab result, dose change and note from your device — export a copy first if you want to keep one. Deleting the app itself also removes the database along with it. Since there is no account and no server-side copy of your health data, there is nothing further for us to delete on our end.

Your rights

Depending on where you live (including under GDPR and CCPA), you may have the right to access, correct, export or delete your personal data. Because your health data is stored only on your device, you can already exercise all of these rights yourself, at any time, from Settings. For questions about the limited subscription data described above, contact support@qrodesk.com.

Children's privacy

Papilio is not directed at children under 13 (or the minimum age required in your country), and we do not knowingly collect data from children.

Security

Your data is stored using the operating system's own app-storage protections. No method of storage or transmission is 100% secure, but Papilio minimizes what could ever be exposed by never uploading your health data in the first place.

Changes to this policy

We may update this policy as Papilio evolves. Material changes will be reflected by updating the "Last updated" date above.

Contact