Prickle · Privacy
The short version: everything you log in Prickle — your daily entries, severity scores, and photos — stays on your phone. We built it that way on purpose.
Last updated: 21 July 2026
Stays on your device
All your health data. Eczema logs, severity scores, triggers, medications, and photos. We can't see any of it.
Leaves your device
Only your account. Your email and password, so you can sign in. Handled by Google Firebase.
Only if you choose
Cloud Sync (off by default). If you switch it on, your logs and photos back up so you can restore them. You can switch it off anytime.
This notice explains, in plain terms, what Prickle does and doesn't do with your information. Prickle is an eczema tracking app: a judgement-free place to log how your skin is doing and understand a chronic condition at your own pace. Showing up to log is the win.
Prickle ("we," "us," or "our") is an independent app, built and run by a solo developer — there's no company behind it, just one person who has eczema too. If anything here doesn't sit right, please don't use the app — but we'd rather hear from you first at lgpark@parkfam.com.
This summary hits the main points. Each links to the full section below.
In shortTo run your account, we collect only your email and password. Everything else you type into Prickle stays on your phone.
When you create an account, we collect:
That's the whole list for account data. You can use most of Prickle without giving us anything more.
Prickle is a health app, so the entries you make — severity scores, symptoms, triggers, medications, and skin photos — are health data, which privacy laws treat as a special, protected category. Here's the important part: this data is stored only on your device. We don't receive it, we can't read it, and it isn't sent anywhere — unless you deliberately turn on Cloud Sync (see section 3). We never process your health data to infer anything about you, and we never use it for advertising.
The app may ask permission to use:
You control all of these in your device's settings.
We use Google Firebase for sign-in (and, if you opt in, for Cloud Sync). Our use of Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
In shortYour logs and photos live in the app's own storage on your phone. Deleting the app removes them.
Prickle is local-first by design. Your daily logs, severity scores, triggers, medications, weekly assessments, and photos are stored in a private database on your device. This means:
In shortCloud Sync is entirely your choice. It backs up your data so you can restore it on a new phone. You can turn it off, and delete the backup, at any time.
Cloud Sync is an opt-in feature. It is switched off until you choose to enable it in the app's settings. It is not required to use Prickle.
What turning it on does: a copy of your logs and photos is securely stored in your private, per-user space in Google Firebase (Firestore and Cloud Storage), linked to your account. This lets you restore your history if you change phones or reinstall the app.
What we do with it: nothing beyond storing it for you. Your synced data is not read by us for any purpose, not analysed, not shared, and never sold or used commercially. Access is restricted by security rules so that only your account can read or write your data.
Turning it off: you can disable Cloud Sync at any time. You can also request that your cloud backup be deleted — see section 17. Turning off Cloud Sync does not affect the copy already on your device.
Because Cloud Sync involves your health data, we ask for your explicit consent before it's enabled, and you can withdraw that consent whenever you like.
In shortWe use your account details to let you sign in and keep your account working — and, if you ask, to help with support. That's it.
We process the little information we hold in order to:
Account messages — like a security or account notice — may be sent when they're needed to keep your account working. These aren't optional, because without them the account can't function.
App update emails are optional. When you create your account, you can choose to hear about new features and improvements by email. This is off unless you opt in, you can change it anytime in your account settings, and every email includes an unsubscribe link. We never share or sell your email, and we don't send anything else this way.
In shortWe only process your information when we have a valid legal reason under the GDPR and UK GDPR.
If you are in the EU, EEA, or UK, the legal bases we rely on are:
Withdrawing consent. Where we rely on your consent, you can withdraw it at any time — by turning off Cloud Sync in the app, turning off app-update emails in your account settings (or using the unsubscribe link in any email), or by contacting us at lgpark@parkfam.com. Withdrawing consent doesn't affect processing that already lawfully happened before you withdrew.
In shortYour account data — and, if you opt in, your synced data — is stored on Google's servers, which may be located outside your country, including in the United States.
Google Firebase may store and process data on servers in the United States and other countries. If you are in the EU, EEA, or UK, this means your information may be transferred outside your region. Where that happens, the transfer is covered by the safeguards Google provides for its customers, including the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can read more in Firebase's privacy and security documentation.
In shortWe keep your account for as long as you have one. Your on-device data is yours to keep or delete.
We keep your account information for as long as your account exists. Your on-device logs and photos remain on your device until you delete them or uninstall the app. If Cloud Sync is on, your backup is kept until you turn Cloud Sync off and/or request deletion. When we no longer need information, we delete or anonymise it.
In shortWe use reasonable technical and organisational measures — but no system is ever 100% secure.
Account credentials are handled by Google Firebase Authentication. Synced data (if enabled) is protected by encryption in transit and at rest and by per-user security rules, so only your account can access your data. Keeping most data on your own device keeps its exposure low. That said, no method of electronic storage or transmission is completely secure, so we can't guarantee absolute security. Please use the app within a secure environment.
In shortPrickle is not intended for anyone under 18.
We don't knowingly collect information from children under 18 (or the equivalent age in your jurisdiction). By using Prickle, you confirm you're at least 18, or that you're the parent or guardian consenting on a minor's behalf. If we learn we've collected data from someone under 18, we'll delete it and deactivate the account. If you believe a child has given us information, contact us at lgpark@parkfam.com.
In shortYou can access, correct, export, delete, or restrict your data, and withdraw consent, at any time.
Depending on where you live (including the EEA, UK, Switzerland, Canada, and many US states), you may have the right to:
To exercise any of these, contact us at lgpark@parkfam.com. Much of it you can also do yourself inside the app: edit your entries, delete your account, or toggle Cloud Sync.
If you're in the UK and unhappy with how we've handled your data, you can complain to us, and then to the Information Commissioner's Office (helpline 0303 123 1113). If you're in the EEA, you can complain to your local data protection authority. In Switzerland, contact the Federal Data Protection and Information Commissioner.
Most browsers offer a "Do-Not-Track" (DNT) signal. Because there's no finalised industry standard for these signals, we don't currently respond to them. Prickle doesn't track your browsing across sites in any case.
In shortResidents of many US states have rights to access, correct, delete, and opt out. We don't sell or share your data or use it for targeted advertising.
If you live in a US state with a consumer privacy law (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia), you have rights to know, access, correct, delete, and obtain a copy of your data, and not to be discriminated against for exercising them.
Here's what we actually collect:
| Category | Example | Collected? |
|---|---|---|
| Identifiers | Email address, account name | Yes |
| Sensitive personal information | Account login; health data (health data stays on-device unless you enable Cloud Sync) | Yes |
| Protected classifications | Race, age, gender, etc. | No |
| Commercial information | Purchase / payment history | No |
| Biometric information | Fingerprints, voiceprints | No |
| Internet activity | Browsing / search history | No |
| Geolocation | Device location | No |
| Inferences / profiling | Profiles about you | No |
We do not sell or share your personal information, and we don't use it for targeted advertising or profiling. You may have the right to limit the use of your sensitive data; because we don't use it beyond providing the service, there's nothing extra to limit. To exercise your rights, email lgpark@parkfam.com. You may use an authorised agent (with proof of authorisation). If we decline a request, you can appeal by emailing us; if an appeal is denied, you may contact your state attorney general.
Australia and New Zealand. We handle your information consistently with Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020, and this notice serves as the notice those Acts require. You can request access to or correction of your information at any time by contacting us. If you believe we've breached the applicable privacy principles, you can complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.
Canada. We process your information with your consent (express or, where the law allows, implied). You can withdraw consent at any time. In limited cases the law permits processing without consent (for example, fraud prevention or legal requirements).
We may update this notice from time to time. When we do, we'll change the "Last updated" date at the top, and for significant changes we'll let you know in the app. We'll ask for fresh consent if a change materially affects how we handle your health data.
Questions or concerns about this notice or your data? Email lgpark@parkfam.com — it goes straight to the developer — or use our contact form.
Prickle is operated by an independent solo developer. Email is the best way to reach us.
You can review and edit your entries directly in the app. To request access to, correction of, or deletion of your account and any cloud backup — or to withdraw consent — email lgpark@parkfam.com or use our contact form (no need to open the app). We'll verify your identity and respond in line with applicable law.