Legal
Privacy policy
Last updated 7 October 2026
BP Diary is built so that your health data stays on your phone. This policy explains the small amount of information our server does handle, why, and how you can delete it.
The short version
- Your readings never leave your phone. Blood pressure, pulse, arm and times are stored only on your device. We never receive them.
- Our server holds your account and nothing more: your name, email address and a hashed password.
- You decide who sees a report. Exports are made on your phone and sent only when you send them, from your own email or apps.
- No ads, no tracking, no analytics, no selling of data.
Who we are
BP Diary is made by Bjorn-Donald Bassey, based in Nigeria, who is the controller of the personal data described here (“we”, “us”). Contact: bpdiary@bjorncode.com.
What stays on your device
The following is stored only on your phone and is never sent to us or anyone else, unless you export it yourself:
- Your readings: systolic and diastolic pressure, pulse, arm, and when each was measured
- The recipients you save for reports (names and email addresses), kept in your phone's secure storage
- Your settings, such as your default arm and export choices
- Your sign-in session, kept in your phone's secure storage
Because this data exists only on your device, we can't see it or recover it for you. If you delete the app or lose your phone, your readings are gone. You can export a copy at any time.
What our server stores
| Data | Why | How long |
|---|---|---|
| Name, email address, password (stored hashed) | Your account and signing in | Until you delete your account |
| Sign-up and password-reset codes (stored hashed), with send times | Confirming your email address, resetting your password, and limiting how often codes are sent | Deleted about a day after the last code was sent |
We never receive or store your readings, pulse or the reports you export. Our server logs record technical information such as error types and account IDs, never health data.
Legal basis
We process your account data because we need it to provide the service you signed up for (performance of a contract), and the limits on sending codes protect the service from abuse (legitimate interests). We process no health data on our servers.
Reports you export
When you export a PDF or CSV, it is created on your phone and handed to your own email app or your phone's share sheet. It goes only where you send it. Once sent, it is handled by your email provider and the recipient, under their own privacy terms.
Service providers
We use a small number of providers to run the service:
- Supabase: account sign-in and our database
- Railway: hosting for our server and this website
- Resend: sending sign-up and password-reset emails
These providers process data only to provide their service to us. Some of them store data outside Nigeria, under contractual safeguards for international transfers. We do not sell or share your personal data with anyone else.
Your rights
Under the Nigeria Data Protection Act 2023, and wherever you live, you can ask to see, correct, export or delete the personal data we hold about you, or object to or restrict how we use it. If you are in the EU or UK, you have these rights under the GDPR and UK GDPR too. You can delete your account yourself at any time (here's how). For any other request, email bpdiary@bjorncode.com and we'll reply within 30 days. You can also complain to your local data protection authority, such as the Nigeria Data Protection Commission.
Security
Data is sent over encrypted connections (HTTPS). Passwords and codes are stored only as hashes. Your session and recipients are kept in your phone's secure storage. No system is perfectly secure, but keeping your health data off our servers means there is very little for anyone to take.
Children
BP Diary is not intended for anyone under 18.
Changes
If we change this policy, we'll update the date at the top and, for significant changes, tell you in the app.
Contact
Questions about privacy: bpdiary@bjorncode.com