Privacy at Cuffy
Last updated: October 2026
Cuffy helps you keep track of your blood pressure and your pills, and puts together a report for your doctor. That is health data. So it stays on your iPhone unless you decide otherwise. Here is exactly what goes where.
In short
- Your readings, medications, doses, onboarding answers and reports are stored on your iPhone.
- An account is optional. Your health data is only uploaded if you are signed in and give your explicit consent in a separate step. The servers are in the EU.
- The photo of your monitor is read on your iPhone and never sent anywhere.
- Usage statistics are sent only if you agree. They never contain health values.
- No ads, no tracking across other companies' apps, no selling of data.
Who is responsible?
Oguz Etlioglu, YZ Digital Studio
Burgundischestrasse 27, 30455 Hannover, Germany
Email: info@yzdigitalstudio.com
1. What is stored on your iPhone
- Your readings: systolic and diastolic values, pulse, date and time, arm, situation (for example "after getting up") and your note
- Your medications: name, dose, times, supply, and when you ticked off a dose
- Your onboarding answers: first name (optional), goals, age, height, weight, conditions, measuring times and target values
- Your PDF reports and settings
This is health data. We do not receive it unless you turn on the cloud backup (section 3). Your onboarding answers never leave your iPhone. If you use iCloud Backup for your iPhone, this data is included like for any app. That backup is managed by Apple, not by us.
2. Camera, Apple Health, notifications
- Photo of your monitor: When you take a photo of your blood pressure monitor, Apple's text recognition reads the numbers on your iPhone. The photo is neither stored nor sent. The camera is only used after you allow it.
- Apple Health: If you allow it, Cuffy reads blood pressure and pulse from Apple Health and writes your readings there. This happens directly on your iPhone. Data from Apple Health is never used for advertising and never shared with third parties.
- Reminders: Measuring and pill reminders are scheduled on your iPhone. Nothing is sent to us for this.
- Sharing a report: Cuffy creates the PDF report on your iPhone. It is only shared when you send it yourself, for example by email to your doctor's practice.
3. Account and cloud backup (optional)
You can use Cuffy without an account. With an account you can use Cuffy Plus on several devices and, if you want, back up your data. You can sign in with Apple, with Google or with a code sent by email.
- Stored for the account: your email address (with Sign in with Apple, optionally a hidden address from Apple), an account ID and the time of sign-in.
- Cloud backup: Only if you are signed in and give your explicit consent in a separate step are your readings, medications and doses uploaded, so they appear on your other devices and are not lost. Your onboarding answers are not uploaded.
- Where: Supabase (Supabase Inc.), servers in the EU (Ireland). The data is protected so that only your account can read it.
- Sign in with Google: Google confirms your email address and your name to us. We receive no other data from your Google account.
- Email code: The sign-in code is sent through our email account at Google Workspace.
- Legal basis: for the account, performance of the contract (Art. 6(1)(b) GDPR); for health data, your explicit consent (Art. 9(2)(a) GDPR). You can withdraw your consent at any time in your profile. After that nothing is uploaded.
- Deletion: Profile → Delete account deletes your account and all uploaded data immediately. The data on your iPhone stays until you delete it there.
4. Usage statistics (PostHog), only with your consent
Cuffy asks once whether anonymous usage statistics may be sent. They stay off until you agree. If you agree, Cuffy sends events to PostHog so we can see what helps and what does not, for example "onboarding step shown", "paywall shown" or "reading added".
- What is sent: the event, the app language, the app version, device model and iOS version, app opens and closes, and a random ID created only for these statistics.
- What is never sent: readings, pulse, medications, your answers, your name or your email address.
- IP address: It is transmitted technically when sending but not stored by PostHog.
- Where: PostHog Inc., servers in the EU (Frankfurt).
- Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in your profile under "Anonymous statistics".
- Retention: at most 12 months.
5. Cuffy Plus and purchases
Cuffy Plus is available as a subscription (yearly with a free trial, or monthly) or as a one-time purchase. Single reports can also be bought once. Payment runs entirely through the App Store and is handled by Apple. We never see your name or payment details.
So your purchases work on all your devices, we use RevenueCat (RevenueCat Inc., USA). RevenueCat receives Apple's purchase receipts (product, purchase date, trial, expiry), a random customer ID (your account ID when signed in), the country of your App Store account, the device model and the iOS version. RevenueCat never receives health data.
- Legal basis: performance of the purchase contract (Art. 6(1)(b) GDPR).
- Transfer to the USA: based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
- Retention: as long as the purchase is valid and afterwards as long as legal retention periods apply.
You can cancel at any time in your iPhone settings under Apple ID → Subscriptions.
6. Not a medical device
Cuffy is a diary for your readings and pills. Cuffy is not a medical device, does not measure anything itself and does not diagnose. The classification of your readings follows published guidelines and does not replace talking to a doctor. If a reading worries you, please talk to your doctor, and in an emergency call your local emergency number.
7. What we do not do
- No ads and no ad networks
- No tracking across other companies' apps and websites (that is why Cuffy never asks about "App Tracking")
- No selling or sharing of your health data
- No location, no access to your photos or contacts
8. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent. Just write to info@yzdigitalstudio.com.
You can also complain to a data protection supervisory authority, for example the one where you live.
9. Children
Cuffy is meant for adults. We do not knowingly collect data from children under 16.
10. Changes
If this policy changes, the new date appears here. For important changes we let you know in the app.