Last updated: July 4, 2026
The short version: EczemaClues uses end-to-end encryption. You sign in with your email and choose a passphrase; your journal is encrypted on your device with a key only you hold, before it is uploaded. We store only scrambled data we cannot read — and cannot read it even if we wanted to. Your email (for sign-in) is kept separately and can never unlock your health data.
EczemaClues is a private eczema journal. Logging, analysis, and reports run in your browser, on your device. Signing in is required (via a one-time link sent to your email) so your journal can be encrypted, backed up, synced across your devices, and — if you choose — shared with a co-parent. Your device also keeps a working copy of your journal so the app keeps functioning offline.
Everything you log — flare severity, affected areas, foods, products, weather, sleep, notes, and photos — is encrypted on your device with a key derived from your passphrase, before it is uploaded. We (and our hosting provider, Cloudflare) store only ciphertext; we cannot decrypt it. A plaintext working copy also lives in your browser's storage (localStorage and IndexedDB) on your own device so the app works offline.
Photos you add are compressed, then encrypted on your device with the same key and stored as ciphertext with our hosting provider. We never receive or store a viewable image — only an encrypted blob we cannot open.
Your email address (used only for sign-in) is stored separately and is never linked to or able to unlock your encrypted health data.
You can invite another parent or caregiver to share a child's journal. When you do, you are choosing to give that person access to your child's encrypted health data, including photos. Here is exactly how it works and what it means:
#) that your browser creates and that never reaches our
servers. Treat the link like a password and send it only to the person you intend,
through a channel you trust — anyone who opens it before it is used could gain access.Older versions offered a downloadable file backup (saved wherever you choose, e.g. your own iCloud/Drive — we never receive it) and a sync-code cloud backup. The sync-code path is deprecated in favor of the encrypted sync above; if you made one previously you can still restore it, and you may email us to have it deleted.
The app contains no advertising, no third-party analytics or tracking SDKs, no social media pixels, and no third-party scripts or fonts. The only servers the app ever contacts are our own (on Cloudflare): to sign you in and to store your encrypted journal. We do not sell, rent, share, or monetize your data, and we cannot read the health data you store with us.
To understand which features are used and where people get stuck, we record a small set of anonymous usage counts on our own servers — for example, that the app was opened, an entry was saved, or a report was exported. These carry no health data: we send only counts and flags (such as the number of fields filled in, never their values), and our server drops anything outside a fixed allowlist before storing it. They are tied to a random device identifier, not to your name. You can turn this off at any time in Settings.
We store your email address to send your one-time sign-in link and, occasionally, important account or service updates. Those emails are sent through Cloudflare's email service. Your email is stored separately from your health data, is never connected to it, and cannot decrypt it. If a co-parent invites you, the invited email address is stored with that invite so we can confirm it is you accepting. Request deletion anytime by writing to us.
EczemaClues is intended for use by adults — parents and caregivers logging on behalf of their children, or adults tracking their own eczema. We do not knowingly collect personal information from children directly. Data a parent logs about a child is encrypted and controlled by that parent (and any co-parent they invite), as described above.
Your journal is backed up in encrypted form, but only you hold the key to it. If you forget your passphrase and lose your recovery key, the data cannot be recovered by anyone, including us. Please store your passphrase and recovery key safely.
We may update this policy as the app evolves; the "last updated" date above will change. We ask for your explicit consent in the app before turning on encrypted sync, and again before you share a child's journal with a co-parent, and we will seek fresh consent before any materially new use of your data.
Questions or deletion requests: [email protected]
EczemaClues is not a medical device and does not provide medical advice. Patterns it shows are correlations to discuss with your doctor.