Privacy Policy

Effective Date: October 6, 2026 (Version 2.4)

Your health data — doses, symptoms, photos, notes — stays on your device. We don't operate servers, we can't see it, and we never send it anywhere. During setup we count which steps people reach, what they answer, and whether they subscribe, using a temporary code that is never saved or connected to your phone. Our subscription provider, Helium, receives device and purchase information it needs to run the subscription screen — described below. Anything else linked to your device is shared only if you turn on “Help improve Cleyra”. It's off unless you choose it, it's never offered to anyone under 18, and you can turn it off any time.

Introduction

Your privacy is important. This Privacy Policy explains what information the Cleyra app (“we” or “our”) can access, how it is used, and your choices. Cleyra is a mobile health tracking app focused on isotretinoin (Accutane) treatment. Importantly, we do not collect or store your personal health data on our servers – all health information you enter into Cleyra stays on your device only. We do collect de-identified setup statistics, Helium receives the device and purchase information described below, and — only if you opt in — usage statistics and your setup answers, as described below. By using Cleyra, you agree to this Privacy Policy. If you do not agree, please do not use the app.

What We Collect, and What We Don't

No Account or Cloud Data: Cleyra does not require you to create an account or log in. We do not collect your name, email address, or contact information, and we do not store any of your data on our servers.
Setup Questions:When you set up Cleyra we ask for your age range, gender, the state (or country) you live in, how you heard about us, and what you want the app to help with. You can answer “Prefer not to say” to any of these except age range, which we use to confirm you meet our minimum age requirement. If you choose “Something else” for how you heard about us, you may type the name of the app or site you came from.
De-identified Setup Statistics (everyone):While you set up the app, it records which setup screens you reach, your fixed-choice setup answers (not the free-text “Something else” answer), and what happened at the subscription screen shown during setup — whether you subscribed, restored a purchase, or closed it, and which plan you chose. This is sent to PostHog, our analytics provider, with a random code that exists only in the app's memory for that one setup session. It is never saved on your phone, never reused, and never connected to anything else you do in the app. It carries no device details, and PostHog discards IP addresses. We use it only in aggregate, to see which parts of setup work and what leads people to subscribe. We do not attempt to re-identify anyone from it, and we require the same of PostHog. We tell you about this on the consent screen during setup.
Help improve Cleyra (optional, off by default):If you are 18 or older, you can choose to turn on “Help improve Cleyra” during setup or later in the Me tab. When it's on:
- the app sends usage events to PostHog — for example that a check-in was saved, a photo was added, a progress video was created, a tab was opened, how long after setup your first check-in came, whether you answered a review prompt, and when you start a subscription and which plan. These use a random ID created for your install. They never include what you logged.
- your setup answers, including the free-text “Something else” answer, are shared with PostHog and with Helium, the provider that runs our subscription screens.
When it's off — which is the default, and always the case for anyone under 18 — nothing linked to your device is shared for analytics, and Helium receives none of your setup answers (it still receives the subscription-screen information described under Third-Party Services). Turning it off takes effect right away. We do not collect device identifiers for advertising, and we do not collect precise location.
No Health Data to Third Parties: Your doses, symptoms, notes, photos, appointments, and treatment history stay on your device. We never receive them, and we never send them to any third party, including our analytics and subscription providers. None of the statistics above include them.

Information Stored Locally on Your Device

Cleyra functions as a personal log for your isotretinoin journey. All data you enter into the app is stored locally on your device's storage. This includes:

Treatment Details: e.g. treatment start date, planned duration, daily dosage (mg), body weight, and cumulative dose goals you input.
Daily Check-ins: your daily logs of whether you took or skipped your dose, symptom ratings, along with any notes you add.
Photos and Videos:any progress photos or videos you capture are stored in the app's local storage (not in your public camera roll unless you export them). Like other app data, they are included in your own iCloud or device backups if you have those turned on. Those backups belong to your Apple account; we cannot access them.
Appointments: information you optionally log about doctor visits or lab tests.
Reminders: your chosen medication reminder times and notification settings.
App Preferences: settings like whether you completed onboarding and any other in-app preferences.

How This Data Is Used on Your Device: The app uses the above information to display your treatment progress — for example, showing symptom trends, calculating adherence percentage, reminding you to take medication, and storing photos to compare progress. All processing happens on your device. We do not see or collect this data.

Device Permissions

Cleyra may request certain device permissions to enable features:

Camera Access: To take progress photos directly in the app. Photos are stored locally. We do not transmit or upload them.
Photo Library Access: To let you import or export photos. The app does not scan or collect your gallery.
Notifications: For local medication reminders. No reminder data is sent to any server.

Granting permissions is optional. Core functionality works without them. You can revoke permissions in your device settings at any time.

Third-Party Services and Data Sharing

App Stores & In-App Purchases: Purchases are handled by Apple App Store or Google Play Store. We do not see your payment information.
Helium (Paywalls and Subscriptions): Helium runs our subscription screens and handles purchases, for everyone who uses the app, including teens. To show the right subscription screen, verify purchases, and report to us how those screens perform, the Helium code in the app sends Helium:
- subscription-screen events, such as when a screen is shown or closed and when a purchase or restore happens, and which plan;
- identifiers: a random ID Helium creates for your install, the ID Apple gives our app on your device (Apple's “identifier for vendor”, which is not an advertising ID), and, when you buy or restore, Apple's transaction and app-download identifiers for that purchase;
- a token Apple provides that indicates whether the app was installed after tapping an App Store search ad;
- device and app details: device model, operating system, app version, screen size and brightness, dark mode and low-power mode settings, language, time zone, App Store country, and when the app was installed;
- approximate location (city and region), which Helium derives from your IP address. We do not collect precise location.
Helium and its own service providers process this for us as our processor. It receives your setup answers only if you turn on “Help improve Cleyra”. It never receives your health data, and we do not use any of this for advertising. See Helium's Privacy Policy.
PostHog (Product Analytics):The app sends PostHog the de-identified setup statistics described above and, only if you turn on “Help improve Cleyra”, your usage events and setup answers. PostHog processes this on our behalf under a data processing agreement, stores it in the United States, discards IP addresses, and does not build a profile of you. PostHog never receives your health data. See PostHog's Privacy Policy.
Customer Support: If you email us at support@cleyra.skin, we use your information only to respond. We do not link emails to in-app data.

We will not disclose your information to third parties unless required by law. We do not sell your data, and we do not use any of it for advertising.

Consumer Health Data

Some information you enter into Cleyra relates to your health, including your doses, symptoms, photos, notes, appointments, and treatment history. This information is stored only on your device. We do not collect it, we do not have access to it, and we do not share it with anyone.

Because Cleyra is an app for people taking isotretinoin, some laws — such as Washington's My Health My Data Act — treat even app usage linked to your device as consumer health data. That is why the linked analytics described above are off unless you choose “Help improve Cleyra”. Our Consumer Health Data Privacy Policy explains exactly what we collect, why, who receives it, and how to exercise your rights.

You can withdraw your consent at any time by turning off “Help improve Cleyra” in the Me tab. Sharing stops right away. You can also email support@cleyra.skin with any request about your data.

Data Retention and Deletion

All data stays on your device until you delete it. Uninstalling Cleyra permanently removes all locally stored data, including your setup answers. We have no copy to restore. We encourage you to export photos or notes before deleting.

On our current plan, PostHog deletes analytics data after one year. Turning off “Help improve Cleyra”, or uninstalling the app, stops any further sharing, but it does not by itself erase what has already been sent to PostHog or Helium. Email us at support@cleyra.skinif you want that data removed and we will pass the request on. De-identified setup statistics can't be traced back to you, so they can't be found or removed for a particular person.

To request deletion of any data we might have (e.g., support emails), contact us at support@cleyra.skin.

International Transfers

Analytics data is stored by PostHog in the United States. If you use Cleyra from outside the US, including the European Union or the United Kingdom, that data is transferred to the US under the EU–US Data Privacy Framework, with standard contractual clauses as a fallback. Health data you enter in the app is never transferred anywhere — it stays on your device.

Security Measures

Our local-first approach reduces breach risk. Your data remains under your control. We recommend using a strong device passcode and keeping your OS updated. All network communications (e.g., subscription verification) use HTTPS encryption.

This Website

This policy covers both the Cleyra app and the Cleyra website at cleyra.skin. Most of the sections above describe the app; this section describes the website.

The website collects nothing. We run no analytics, no advertising, and no tracking scripts on cleyra.skin. We set no cookies. There is no sign-up, no email field, and no account. Web-server logs kept by our hosting provider for security and reliability may record standard request data such as IP address, and we do not use those logs to build any profile of you.

The tools on this website run entirely in your browser. Free calculators and trackers we publish — including the Accutane Progress Tracker — perform their arithmetic on your own device. Values you type in, such as a start date, a dose, a schedule, or a body weight, are never transmitted to us, never written to our servers, and never saved to your device. They exist only in the page while it is open, and are discarded when you reload or close it. Because nothing is collected, there is nothing for us to retain, share, sell, or disclose, and nothing for you to request or delete.

Fonts used on the website are served from our own domain, so viewing a page makes no request to any third-party host. We do not share website usage with PostHog or any other analytics provider — the analytics described in the sections above relate solely to the app.

Children's Privacy

Cleyra is not intended for children under 13. During setup the app asks for your age range, and anyone who indicates they are under 13 is blocked from continuing. That answer is not saved and nothing is shared with anyone. Teens 13-17 may use the app with parental consent and supervision. “Help improve Cleyra” is never offered to anyone under 18, so for teens nothing linked to their device is shared for analytics. Teens contribute only to the de-identified setup statistics, and Helium receives the subscription-screen information described above because it runs the subscription screen for everyone.

California Privacy Rights (CCPA)

We take a privacy-by-design approach. We do not sell personal information. California residents may contact us at support@cleyra.skin to exercise their CCPA rights.

Changes to This Privacy Policy

We may update this policy as needed. We will notify users of significant changes by updating the Effective Date and version number above, and via in-app or app store notices. Past versions and the substance of each change are recorded in the version history at the end of this policy.

Version History

Version 2.4 — October 6, 2026 (current): Listed in full what Helium receives when it runs the subscription screens, including identifiers, device details, Apple's ad-attribution token, and approximate city-level location, and that this applies to teens. Renamed “anonymous” setup statistics to “de-identified”. Noted that app data is included in your own device or iCloud backups, and clarified PostHog retention.
Version 2.3 — October 1, 2026: Made linked analytics and setup-answer sharing opt-in through “Help improve Cleyra” (off by default, adults only). Disclosed that the app now sends analytics to PostHog directly, and that Helium no longer forwards events to PostHog. Added anonymous setup statistics, retention and international transfer details, and the Consumer Health Data Privacy Policy.
Version 2.2 — September 11, 2026:Added the “This Website” section, stating that cleyra.app runs no analytics or cookies and that the free tools published there compute entirely in your browser without collecting anything.
Version 2.1 — August 4, 2026: Disclosed PostHog as a recipient of analytics forwarded from the app, and disclosed that setup answers are included in those analytics.
Version 2.0 and earlier — April 2026: Initial published policy covering the Cleyra app, with subsequent revisions to the identification of the operator.

Contact Us

Michael Curtis (d/b/a Cleyra)
San Diego, California, USA
Email: support@cleyra.skin