Privacy Policy

Privacy Policy for Humra

Last updated: 27 August 2026

Humra ("the app", "we", "us") is provided by Humra.

This policy explains what the app collects, why, where it goes, and what control

you have over it.

If you have questions, contact us at humrasupport@gmail.com.

1. Summary

  • We store the things you put into the app — medicines, appointments, to-dos, budgets, notes — on our server so they are there when you sign in again.

  • Some of the most sensitive permissions the app asks for (SMS and contacts) are read only on your phone. Their contents are never uploaded.

  • We do not sell your personal data, and we do not use it for advertising.

  • You can delete your account and everything in it — see section 8.

2. What we collect

2.1 Account information

  • Data  —  Why

  • Email address  —  Identifies your account, password resets

  • Password (stored only as a bcrypt hash — we never see the original)  —  Signing in

  • Name and profile details you enter  —  Personalising the app

If you sign in with Google or Apple, we receive your email address and

basic profile information from them. We do not receive your Google or Apple

password.

2.2 Content you create in the app

Stored on our server, tied to your account:

  • Medicines, dose times and which doses you ticked off

  • Medical profile (blood group, allergies, conditions, family doctor)

  • Medical records you add — the file itself. When you scan or upload a report, X-ray, prescription or blood panel, the document is uploaded and stored on our server in a folder belonging to your account, alongside the title and date you gave it. It is served back only to you, over HTTPS, when you are signed in. It is never sent to an advertiser or a data broker, and it is deleted with your account (section 8).

  • Calendar events and appointments

  • To-dos and reminders

  • Budgets, expenses and instalments

  • Family members you add

  • Documents, travel plans, packing lists and saved jobs

  • Messages you exchange with the in-app assistant — see section 3.1 for what reaches the AI service and how to switch it off

Health data note. Medicines, doses, allergies, conditions and medical

records are health information. We treat them as sensitive: they are only ever

used to run the features you enabled, and they are never sold, shared for

advertising, or used to profile you.

2.3 Device permissions

  • Permission  —  What it is used for  —  Does the data leave your phone?

  • SMS (READ_SMS)  —  Finding appointment and bill details in your messages  —  No. Messages are read and parsed entirely on your device. Only the calendar entry or reminder that you keep is saved. Message text is never uploaded.

  • Contacts  —  Putting a name to a phone number that appears in a message  —  No. Names and phone numbers are read on your device only.

  • Calendar  —  Two-way sync with the calendar already on your phone  —  Events you keep in the app are stored on our server.

  • Location (coarse)  —  Finding jobs near you  —  Only the name of your city is used. Precise GPS coordinates are never requested, stored or shared.

  • Microphone  —  Speaking a to-do instead of typing it  —  Speech is converted to text by your phone's own speech recognition.

  • Notifications & alarms  —  Medicine, appointment and payment reminders  —  No. Reminders are scheduled and delivered by your phone itself.

  • Biometrics / screen lock  —  Passkey sign-in  —  No. See section 4.

Every one of these is optional and off until you turn the feature on. Refusing

any of them leaves the rest of the app working.

2.4 What we do not collect

We do not collect advertising identifiers, we do not track you across other

apps or websites, and we do not use third-party analytics or advertising SDKs.

3. Who we share data with

We share only what a feature needs, only with the services below.

  • Service  —  What it receives  —  Why

  • Anthropic, PBC (Claude API, United States)  —  See section 3.1  —  Generating the assistant's replies

  • Open-Meteo  —  A city name  —  Weather forecast

  • RapidAPI — JSearch  —  A job search query and a city name  —  Job search results

  • RapidAPI — Sky Scrapper  —  Flight search details you enter  —  Flight prices

  • Google / Apple  —  Sign-in request  —  Signing in with your Google or Apple account

  • Our email relay (SMTP)  —  Your email address  —  Password reset emails

These providers process the data to deliver their service and are bound by

their own privacy policies, which require them to protect it to a standard at

least equal to this one. We do not sell your data to anyone, and no data is

shared with data brokers or advertisers.

3.1 The AI assistant, in detail

The in-app assistant is answered by Claude, an AI service operated by

Anthropic, PBC, in the United States. Nothing is sent to Anthropic until you

have been shown this list inside the app and have agreed to it. Until then the

assistant cannot reply, and you can withdraw at any time under

Profile → AI assistant, which stops anything further being sent.

Sent to Anthropic when you use the assistant:

  • The messages you type or dictate, and the assistant's replies, so the conversation makes sense

  • Any photo you attach to a message — a bill, a prescription, a medicine box

  • Your first name and today's date, so it can address you and understand "tomorrow"

  • When you ask the assistant to do something, the items it needs from that part of the app: to-dos, calendar events, reminders, budget categories, expenses and instalments, medicines, medical records, family members, documents and packing items

Never sent to Anthropic:

  • Readings from Apple Health or Health Connect

  • Your SMS messages or contacts

  • Your password

  • Files kept in Docs or Medical records, unless you attach one to a message yourself

Anthropic processes this only to generate the reply, under its own privacy

policy and commercial terms, which bind it to protect the data to a standard at

least equal to this one. See https://www.anthropic.com/legal/privacy. We do

not use the assistant's conversations for advertising or profiling, and we do

not sell them.

4. Passkey sign-in

If you turn on passkey sign-in, your device creates a cryptographic key pair.

  • The private key never leaves your phone. It is held in the Android Keystore, behind your fingerprint, face or screen lock.

  • We only ever receive the public half, which cannot be used to sign in as you.

  • Your fingerprint or face is never transmitted to us, and we never see it — your phone's operating system handles that check and only tells the app whether it passed.

5. Where your data is stored

Your data is stored in a PostgreSQL database on our own server, located in

India. Documents you upload — including

medical records — are stored as files on that same server, in a directory

belonging to your account, not with any third-party storage provider. Traffic

between the app and the server is encrypted with HTTPS.

Health readings from Apple Health and Health Connect are not stored on our

server at all. Steps, sleep, heart rate and the rest are read on your phone,

used to draw that day's wellbeing screen, and discarded. They are never

uploaded, and never used for advertising.

6. How long we keep data

We keep your data for as long as your account exists. When you delete your

account, your data is deleted as described in section 8.

7. Children

Humra is not directed at children under 13, and we do not knowingly collect

data from them. If you believe a child has given us personal data, contact us

and we will delete it.

8. Your rights and choices

You can:

  • Access and correct anything you have entered, directly in the app.

  • Turn off any permission at any time in your phone's settings, or turn the matching feature off in the app.

  • Delete individual items — a medicine, an event, a record — in the app.

  • Delete your entire account and all its data, from inside the app: Settings → Delete my account. You will be asked for your password (or, if you signed in with Google or Apple, to type DELETE) and it happens immediately — your account and everything listed in section 2.2 are removed from our database at once. We keep no copy and there is no recovery period, so please be sure before you confirm.

  If you can no longer sign in, email humrasupport@gmail.com from the

  address on your account and we will delete it for you within 30 days.

Depending on where you live, you may also have the right to a copy of your data

or to object to its processing. Email us at humrasupport@gmail.com and we will

help.

9. Security

Passwords are stored only as bcrypt hashes. Traffic is encrypted in transit

with HTTPS. Passkey private keys stay in your phone's hardware-backed keystore.

No system is perfectly secure, but we take reasonable steps to protect your

information.

10. Changes to this policy

If we change this policy we will update the date at the top and, for

significant changes, tell you in the app.

11. Contact

Humra

humrasupport@gmail.com