Privacy

Scope

This notice covers Health Data Restore for iPhone, the Arctic Studios website, and support email.

Restore

Restore opens the Health app export ZIP that you choose and processes it on your iPhone. It shows the records and data types that can be restored before asking for Health access or starting a purchase.

The archive is not uploaded to Arctic Studios. Restore keeps local checkpoints so an interrupted restore can continue without starting over. Removing the app removes its local app data, but it does not remove records already written to the Health app.

Health data

Restore asks for permission to write only the Health data types found in the selected export. It asks for read access to those types to look for visible date overlap with existing Health history. Apple does not tell apps whether read access was denied, so an overlap check cannot prove that no hidden records exist.

Health records, workouts, routes, the selected archive, and restore progress are processed on the device. Arctic Studios does not receive them. We do not use Health data for advertising, marketing, profiling, data mining, or sale, and we do not share it with data brokers.

Restore includes a deletion control for records it wrote. It identifies its own records before deleting them and does not delete records written by Apple Watch or other apps.

Purchase

Full Restore is a one-time in-app purchase handled by Apple. Arctic Studios receives the entitlement status needed to unlock the feature, not your payment-card details. Apple's privacy policy governs App Store payment and transaction processing.

Analytics

We measure how Restore works and which of our acquisition channels lead to downloads and purchases. Basic Vercel website statistics and aggregate PostHog reports run automatically; separate website analytics link visits and clicks only with permission. The iPhone app behaves according to its installed version:

• Version 1.0.2 and earlier have no third-party in-app analytics.
• Version 1.0.3 offers optional analytics, off until enabled in Settings.
• Version 1.0.4 collects the app analytics below automatically on new installations and installations that have never made an analytics choice. There is no analytics popup or toggle. Earlier opt-outs and deletion requests remain effective; existing opt-ins remain consent-based.

For automatic app analytics, our stated basis is our legitimate interests in improving Restore and measuring our own acquisition channels. Automatic collection is not recorded as your consent. You can object and stop it through the links below. Where you previously opted in, you can withdraw that consent through the same links. Stopping analytics does not affect scans, purchases or restores.

Optional website analytics remain off until you allow them and can be turned off in the page footer. Browser Do Not Track and Global Privacy Control prevent optional website collection.

Website events

With permission, we measure visits and App Store button clicks on Restore's product, comparison and import-guide pages. Events contain the page type, language, recognized acquisition channel/source/medium, shared App Store campaign token and registered campaign or experiment labels, not arbitrary query strings, search terms or full referring URLs. A Google click identifier may identify the channel category, but its value is not retained or sent to analytics. A random browser identifier and consent token are stored locally for up to 90 days. They are not an Apple account, email or iOS identifier. Optional analytics requests omit cookies.

Acquisition reports

Our App Store links contain shared campaign labels that describe the source and type of page, rather than an individual visitor. Recognized labels can pass between website pages without cookies or a stored visitor identifier. We combine available aggregate campaign, download, purchase and refund reports from Apple with website channel reports and Google Search Console performance reports in PostHog. These business reports do not require optional app analytics. Apple can delay, suppress or add privacy noise to small cohorts, so a missing figure does not mean zero activity. Search Console reports are aggregated search performance and are not matched to individual app buyers.

App events and attribution

When app analytics are active, Restore sends selected app-open, file-picker, scan, paid-offer, purchase, restore and restore-purchase events. Events include version/build, language and interaction time; event names describe the action and its outcome, without raw error messages. A random identifier stored on your iPhone links activity from the same installation. It is pseudonymous, not anonymous. Apple's AdServices response may associate our organization, campaign, ad-group, keyword and ad IDs and download/redownload classification with that identifier. Missing attribution is unknown, not proof of organic acquisition. Website and app identifiers are separate; we do not match individual website visitors to app users across the App Store.

Purchases and refunds

Apple handles payments and entitlements independently of analytics. For purchases made after automatic analytics registration or a prior opt-in, our service verifies Apple's signed transaction before recording a sale. A signed price and currency describe the purchase price, not developer proceeds. Restoring purchases is not a new sale, and we do not import purchases made before that registration or opt-in. Verified refund and reversal notifications provide counts only: their monetary refund amount is unknown. Raw signed transactions, Apple transaction IDs and attribution tokens are not sent to PostHog or retained in our analytics database. Apple may still send operational transaction notifications after analytics is turned off; revoked identifiers do not create new analytics events.

What is never collected

Your Health records, export, workouts, routes, medical information, record counts/types, Health-history dates, filenames, support messages and raw errors are not analytics payloads. There is no session replay, autocapture, IDFA collection, fingerprinting or Health-content profiling. Analytics does not upload the export or change restoration behavior.

Service security

To limit abuse of our relay, we keep a separate request counter keyed by a daily hash of the connection IP address, UTC date and endpoint operation. The hash uses a private key; our database does not store the raw IP address. The counter expires 24 hours after its first request and is removed by scheduled cleanup, so removal can occur later. These security counters are not joined to app or browser analytics identifiers or sent to PostHog. Hosting providers may separately retain connection information under their own policies.

Providers and retention

Events pass through Arctic Studios' Vercel service and a US Neon registration/consent and delivery database to PostHog US Cloud. These providers process analytics for Arctic Studios. IP discard is enabled; the relay does not forward visitor IPs or request geolocation enrichment. Hosting providers process network information needed to serve and protect requests. See PostHog privacy, Neon/Databricks privacy and Vercel privacy.

Delivered relay payloads expire after seven days and client-event deduplication hashes after 180 days when scheduled cleanup runs. Minimal replay keys and revoked-identity records remain to prevent duplicate sales and reactivation. Our PostHog plan offers up to seven years of event-query history. This is a query-access window, not a guarantee of automatic deletion; historical erasure is handled separately. Analytics cover only activity available to this service and do not replace Apple's complete sales reports.

Stop app analytics or request deletion

On the iPhone with Restore 1.0.4 installed, choose Stop app analytics to object to automatic collection or withdraw a prior opt-in. The link opens Restore and stops new collection on that installation, clears its queued events, and asks the server to purge undelivered events and attribution. Version 1.0.3 has these controls in Settings. The app remembers the stopped state. If offline, it retains minimal credentials to retry the server request; an in-flight request may finish before revocation reaches the server.

Stopping collection does not delete historical PostHog events. Choose Request deletion of app analytics to open Restore, stop collection and request deletion for analytics identities retained by that installation. The links contain no identifiers or credentials. The request's status remains pending until historical provider erasure is independently verified. Historical deletion may require provider support; opening the app or an accepted request does not establish erasure. We cannot promise a completion time or deletion from provider backups.

Use these links on the iPhone where the app is installed. For help, or other privacy requests, use our support page without sending passwords, bearer tokens or Health exports.

Website

We use Vercel Web Analytics on the Restore product page, its Health Data Importer comparison page, and its localized import guides to understand visits and clicks on the App Store download links. We do not load this analytics script on support, privacy, legal, or other product pages. The website has no advertising, accounts, or newsletter sign-ups, and this analytics integration does not set cookies or store analytics identifiers in your browser.

Basic website statistics are collected automatically without enabling optional analytics. Analytics records page views, a source-classified restore_page_view event and an app_store_click event. Both custom events record whether the page is the product page, a guide, or the comparison page, and the page's language. A shared campaign code records the page type, recognized acquisition source and channel, and any registered campaign. These shared labels identify an acquisition source or experiment, not a person; no arbitrary query values or Google click-identifier values are collected. Recognized labels can continue through Restore page links and App Store download buttons, without cookies or stored identifiers. Vercel also processes technical information such as page path, referring site, time, approximate location, device, operating system, and browser. We remove query parameters and fragments from analytics page URLs and skip analytics if an external referring URL contains query parameters or a fragment.

We import aggregate Vercel page-view and click reports into PostHog to compare pages and acquisition channels with available Apple campaign reports and Google Search Console reports. These imports contain counts and shared categories, not Vercel visitor identifiers or a record matching individual website visitors to app purchasers. The source-classified page-view event describes the same visit as the ordinary page view; the two counts are not added together. Browser Do Not Track, Global Privacy Control and the footer's internal-testing exclusion prevent this automatic collection.

Vercel derives a temporary visitor identifier from request information and discards that identifier after 24 hours. That does not mean the aggregated analytics reports are deleted after 24 hours; our plan provides up to 12 months of viewable reporting history. See Vercel's Web Analytics privacy documentation for its processing details.

We do not send Health records, export files, support-message contents, or in-app activity to this service. There are no session recordings or advertising profiles. The Restore iPhone app has no advertising SDK. Versions 1.0.2 and earlier contain no third-party in-app analytics. Version 1.0.3 optional analytics and version 1.0.4 automatic analytics are described above.

Hosting

When your browser requests a page, the hosting provider processes standard technical information, such as an IP address, browser type, requested URL, and request time, to deliver the site and protect it from abuse. Arctic Studios does not use this information to profile visitors or to advertise.

Support email

If you contact Arctic Studios by email, your email provider and ours process your address, subject, message, and related delivery information so the message can be delivered.

We use your message and email address to reply and handle follow-up; we do not use them for marketing. Correspondence is kept for as long as needed to handle the request and any related legal obligations.

Do not send Health app exports, passwords, security codes, payment details, or medical records in a support email. Arctic Studios does not ask for them. If something sensitive is sent by mistake, tell us in a follow-up email; we will take reasonable steps to remove it, subject to provider and legal retention requirements.

Sharing

Arctic Studios does not sell or rent information from support messages. Vercel hosts the site and processes the limited website analytics described above; email providers process correspondence for delivery. Information may be disclosed if the law requires it or if it is needed to protect the service from abuse.

Your choices

You can read this website without an account or a sign-up, and the site sets no cookies of its own. You decide what goes into a support email. You can ask the studio to show, correct, or delete personal information from a support conversation, subject to legal and operational requirements; contact us through the support page.

We do not load website analytics when your browser sends a Do Not Track or Global Privacy Control preference. The website and its download links also work with JavaScript disabled or analytics blocked. These choices do not prevent the hosting requests needed to deliver the pages.

Contact

Privacy questions can be sent through the support page or by post: