Endo — Pain & Symptom Diary

Pixel Management does not collect any information from you through Endo. Specifically:

• No account. Endo has no sign-up, no login, no email address and no user profile on any server. There is nothing to register.
• No health data reaches us. Your symptoms, pain scores, cycle, medications, surgeries and lab values are never transmitted to Pixel Management. We operate no server that could receive them.
• No usage analytics. We do not measure which screens you open, which features you use, how often you log, or whether you open the app at all. There is no telemetry, anonymized or otherwise.
• No advertising. Endo contains no ads and no advertising SDKs. Your health data is not used to target anything, because it never leaves your control.
• No device identifiers. We do not collect your device ID, advertising identifier, IP address, or any fingerprinting information.
• No crash or diagnostic reports. Endo integrates no third-party crash-reporting service. No diagnostic data is sent from the app to us.
• No data sales, ever. We do not sell, rent or share your data with anyone, including data brokers, insurers, employers or advertisers. This is not a promise we have to police, it is a consequence of never receiving the data.

Endo stores what you log locally, inside the app's private sandbox on your device. Depending on what you choose to use, that can include:

• Daily log entries. Symptoms and their severity, pain ratings, mood, energy, sleep, triggers and your free-text notes.
• Pain body map. The locations and intensities you mark on the body diagram.
• Cycle record. Flow days and cycle marks, whether you entered them by hand or imported them from Apple Health.
• Flares. Dates, peak pain, the symptoms involved and your notes.
• Medications and supplements. Names, whether they are a medication or a supplement, the schedules you enter yourself, and the treatment courses you mark as started or stopped.
• Surgical history. Procedure type and date, approach, stage as recorded by your clinician, findings, surgeon and notes.
• Lab results. The values you enter, their units, dates, and the reference range from your own lab report. Endo stores these as written and never classifies them.
• Appointments and reminders. Dates, provider names, notes, and the reminder schedules you set.
• Settings. Your appearance, language and logging preferences, and which symptoms you chose to track.

This data is readable only by Endo on your device. It is covered by your device passcode and iOS file protection, and it is included in your device or iCloud backup if you have backups turned on, exactly like the data of any other app you use.

Endo has no backend. There is no Pixel Management server for the app to talk to, and the app makes no requests to any domain we operate.

The only outbound connections Endo can make are to Apple's own platform services, and only in these cases:

• iCloud (CloudKit) — only with Pro, to sync your record between your own devices. See section 4.
• App Store (StoreKit) — to show prices, complete a purchase, and check your entitlement. See section 8.
• Links you tap. Opening a link such as this privacy policy hands off to your browser. Nothing about your log goes with it.

If you use Endo for free and never open a link, the app makes no network connection at all. It works fully offline.

Without Pro, Endo runs in a strictly local mode: your record is stored only on that device and is never mirrored anywhere.

With Pro, Endo mirrors your record into the private database of its iCloud container, under your own Apple Account, using Apple's CloudKit. That is what lets your iPhone and your other devices show the same log.

We cannot see or access this data. Pixel Management operates no server and has no way to read a private CloudKit database. Apple handles the storage and transport, and Apple's privacy policy governs how iCloud stores it.

If sync cannot start, for example because you are not signed in to iCloud, Endo keeps working with your data safely on the device and tells you so under Data & privacy. Sync failing never costs you your record.

Endo can work with Apple Health, but only if you turn it on and grant permission. It is off until you do, and Endo never asks at launch, only in context on the Apple Health screen.

• Reading. With your permission, Endo imports menstrual flow from Apple Health so your cycle record stays complete without double logging. It reads only the categories you approve in the iOS permission sheet.
• Writing. Separately and optionally, Endo can write the flow you log in the app back to Apple Health. This is a distinct switch that starts off.
• Declining is normal. If you deny either permission, or never enable Health at all, Endo works entirely on what you log by hand. Nothing is blocked.

Health data read from Apple Health is used only inside the app on your device. It is never sent to us, and we never use Health data for advertising or marketing, which Apple's rules prohibit and we have no mechanism to do anyway.

Endo asks for the minimum, and only when it is relevant:

• Apple Health — optional, for the cycle import and write-back described above.
• Notifications — optional, and requested only once you have set a reminder or an appointment for Endo to honor. All reminders are scheduled locally on your device. There is no push server, so no notification content ever passes through us.

Endo requests no access to your location, camera, microphone, photos or contacts.

If you use the Endo Watch app, entries you make on the wrist and a small summary for the watch face are exchanged directly between your iPhone and your paired Apple Watch using Apple's device-to-device WatchConnectivity. This never routes through a Pixel Management server.

Home Screen widgets read a small read-only file that the app writes into its own app group container on your device. It contains only a short cycle caption and your next reminder's title and time. Widgets never write data and nothing in that file leaves the device.

Endo can build a specialist-ready PDF of your record, and with Pro a CSV export of your log. Both are generated entirely on your device, by the app, without any server involvement.

When you share one, iOS shows you the standard share sheet and you choose where it goes: a message, an email, a file, a print. Pixel Management never receives a copy and has no visibility into where you send it. Once you share a report with someone, its handling is between you and them.

Endo is usable for free. Logging, your daily record, the pain body map and the watermarked doctor PDF stay free. Endo Pro is available as a monthly or yearly subscription, or as a one-time lifetime purchase, and unlocks deeper correlation and record depth, unrestricted PDF and CSV export, and iCloud sync.

All purchases, renewals, restores and cancellations are handled by Apple through the App Store. Endo never sees your name, payment details or billing address. The app receives only Apple's signed confirmation that an entitlement is valid, which it verifies on-device to unlock Pro features. Apple's privacy policy applies to the transaction, and you manage or cancel a subscription in your Apple Account settings, not through us.

We keep no record of who purchased, because there is no account for us to attach a purchase to.

Endo integrates no third-party analytics, advertising, crash-reporting, attribution or tracking SDKs. There is no Firebase, no Sentry, no Mixpanel, no AdMob, no Facebook SDK and no equivalent of any of them in the app.

The only external services Endo relies on are Apple's own: CloudKit for optional Pro sync, HealthKit if you enable it, the App Store for purchases, and local notifications. None of them receives an account identifier from us, because Endo has no accounts of its own.

Endo does not collect personal information from anyone, including children. Because no data is collected by us, the app complies with the Children's Online Privacy Protection Act (COPPA) and similar regulations by design. The app is intended for people tracking their own health, and is rated accordingly on the App Store.

Your record is yours, on your hardware and in your own iCloud, so you control all of it:

• You can delete individual log entries, flares, medications, treatment courses, surgeries, lab results, appointments and reminders from inside the app.
• You can remove all local data by deleting Endo from your device.
• If you used Pro sync, you can remove the synced copy in your device's Settings under your Apple Account, in the iCloud storage list for this app.
• Data you wrote to Apple Health is managed in the Health app, which lets you review and delete it independently of Endo.

There is no server-side copy for us to delete, and no request you need to send us, because nothing was ever sent to a server we operate.

Health data is special category data under the GDPR and sensitive personal information under laws such as the CCPA and Washington's My Health My Data Act. That is precisely why Endo is built the way it is: Pixel Management is not a controller or processor of your health data, because we never receive or process it.

Rights such as access, correction, deletion, portability and objection are, in practice, exercised directly in the app: your data is already in your hands, editable and deletable by you, and exportable as PDF or CSV. There is no cross-border transfer by us, because there is no transfer by us at all. Where you enable iCloud sync, Apple acts as your storage provider under its own terms and privacy policy.

If we update this privacy policy, we will post the revised version at this URL and update the “Last updated” date. Because Endo collects no contact information, we cannot notify you directly, so we recommend reviewing this page periodically. Any change that would affect how data leaves your device would be described here plainly before it ships.

If you have any questions about this privacy policy or Endo's data practices, you can contact us at endo1isi2omttatfh@mee5xwnsop1zpixel.management.