Privacy
What happens to your data
In plain language, no legal boilerplate: almost everything you enter in Comeback stays on your phone. This page says exactly what that means and lists the one exception.
Last updated 16 September 2026.
The short version
Your check-ins, your notes and your photos never leave your phone. They live in the device's own storage and whatever backup your phone already does — iCloud or Google. We never receive them, so there is nothing of yours for us to leak, lose, or be asked to hand over.
The only thing that goes to a server is an entry you deliberately write and choose to publish, so somebody at your week can read it. Nothing else. Never photos.
There is no account. No email address, no phone number, no social login. If there's no login, there's no identity to leak.
What a published entry contains
Six things. This is the complete list, and the server rejects anything else outright rather than quietly storing it.
Some early builds ship with publishing turned off entirely — the app says so plainly on the publish screen rather than pretending it happened. What follows describes what publishing sends whenever it is switched on.
The handle is generated on your phone and is not derived from anything — not your name, not your device, not your surgery date. It exists only so a reader can tell that two entries came from the same person.
We have never asked for most of these, so there is nothing to withhold.
Why “week 6” and never a date
A surgery date plus a rough location is a strong identifier — it can be matched against a real person. “Week 6” cannot.
The app only ever needs the offset to match you to people at your stage, so the date itself stays on your phone and the server never learns it. That single choice removes most of the re-identification risk from the whole thing. The same applies to the “where they are now” line on an entry: it stores “month 11”, never a calendar date.
Photos
Photos are never shared inside the app, now or in the future. There is no publish path for them.
A photo of a body part tied to a surgery date is the most sensitive thing this app could hold, and a shared photo can't be un-shared. They are never attached to the entries you write and never used to illustrate anything for anyone else.
The only way a photo leaves your phone is you sending it, to someone you chose — your physio, your surgeon, whoever. The app will build you a PDF of the set with your logged numbers alongside, on the device, and hand it to your phone's own share sheet. Nothing is uploaded to make it.
Consent, and taking it back
Using the app needs no consent at all, because nothing is transmitted. You're only asked to consent at the moment you choose to publish.
Publishing an entry is its own separate decision, taken at the moment you publish. Before anything is sent you're shown exactly what will be — the six items above, and the list of what won't. Nothing is pre-ticked and nothing is bundled into a terms-of-service checkbox.
Withdrawing is one control, in Settings. Unpublishing removes an entry for everyone, immediately and permanently — a real deletion, not a hidden flag. Your own copy stays on your phone unless you delete that too. Nothing else about the app stops working; you just stop appearing in other people's reading.
The app keeps a record, on your phone, of what you agreed to and the exact wording you were shown — like everything else here, that record never reaches us either.
Age
16 and over, for this first version. The app asks before anything else, and it's the only question with no way to skip it.
This is because handling health information for under-16s carries stricter rules that this first version isn't built to meet — not because a younger person's recovery matters less.
Other things worth stating plainly
No analytics, no trackers, no advertising, in the app. No third-party SDKs watching what you tap.
This website is the same way. It sets no cookies and loads nothing from anyone else's servers — no fonts, no scripts, no embedded anything.
The publishing server keeps no logs. Not IP addresses, not what you looked at. Who read what, and when, is never recorded.
Published entries don't live forever. They're deleted automatically after three years.
You can take everything with you. Export the lot as a readable document plus a machine-readable file, built on your phone. And “delete everything” wipes the device and withdraws anything published, self-service, without emailing anybody.
Questions
If anything here doesn't answer what you need to know before you'd trust it, that's completely reasonable, and I'd rather you ask than assume. Get in touch →