Legal
Privacy Policy
Last updated: August 2, 2026
Migraine Decoder is a health-adjacent product, so we hold ourselves to a simple standard: collect only what the product needs, be plain about where it goes, and never sell it. This page explains exactly what we collect and why.
What we collect today
Account: your email address and a password, managed through Supabase, which provides our authentication and database. Your password is stored hashed; we never see it in plain text.
Purchases: when you buy a founding seat, payment is handled by Stripe. Your card data goes directly to Stripe and never touches our servers. We receive confirmation of the payment, the amount, the tier, and the email you used, so we can attach the seat to your account and handle refunds.
Launch updates: if you join the launch list, we store the email you give us so we can tell you when the app ships.
Analytics
We use PostHog for product analytics: page views, button clicks, and where visitors came from. This tells us which parts of the site work and which do not. We use it to improve the product, not to build advertising profiles, and we do not sell or share this data for advertising.
Transactional email, such as your purchase receipt and welcome message, is sent through Resend. Resend processes your email address for delivery and nothing more. Replies to our emails go to david@setu.dev.
Health tracking data in the app
When the Migraine Decoder app launches, it will store the tracking data you choose to log: migraine attacks, symptoms, cycle information, and related details, alongside weather and pressure data we fetch for your reports. This is sensitive data and we treat it that way. It exists so YOU can see your patterns and share a report with your doctor. It is yours: we will not sell it, rent it, or share it with advertisers, data brokers, or insurers. We will publish an updated version of this policy covering the app in detail before launch.
What we never do
We do not sell your personal data. We do not run third-party ads. We do not share your health tracking data with anyone except the service providers named above, who process it only on our behalf to run the product.
Deletion and your choices
Want your account and data deleted? Email david@setu.dev from the address on your account and we will delete your account and associated data. Records we are legally required to keep, such as payment records held by Stripe, are retained as the law requires. You can unsubscribe from launch updates using the link in any email.
Changes and contact
If this policy changes, we will update the date at the top of this page, and material changes will be communicated by email to account holders. Questions about your data: david@setu.dev.