Privacy Policy

Who we are

MilesCone is the personal information controller for the records in your account. You can reach us at support@milescone.salesonline.com for any question or request in this policy.

This policy is written to meet the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). Much of what you record is sensitive personal information under that Act, and we treat all of it that way.

What we store

Three things, and nothing else:

• Your account.An email address and a password. The password is hashed by our authentication provider — it is never stored in a form we or anyone else can read.
• What you record. Profiles you create and everything you enter about them: milestones, goals, medication and doses, therapy and care sessions, exercises, check-ups, health events, conditions, allergies, daily check-ins, little wins, communication entries and any notes. Optionally a name, a date of birth and a profile photo.
• Your subscription status. Which plan you are on and when the paid period ends. Card details are handled entirely by our payment provider and never reach us.

You decide how much to enter. A name is not required. You can use initials, a nickname or anything else. MilesCone works exactly the same either way.

What we do not do

• No advertising. There are no ads in MilesCone and no ad network receives anything about you.
• No analytics or tracking. No analytics service, no tracking pixels, no session recording, no third-party scripts of any kind.
• We never sell or share your records. Not to advertisers, insurers, employers, researchers, data brokers or anyone else. There is no arrangement under which this could happen.
• No profiling or automated decisions. MilesCone does not diagnose, score, rank or compare anyone against an average, and no automated decision is made about any person from what you record.
• No microphone. Talking practice speaks words aloud using your own device’s built-in voice. Nothing is listened to and nothing is recorded.

Who can see your records

Only your account. Every table holding household information is protected by row-level security in the database itself, scoped to the account that owns it. This is not a rule in the app that could be bypassed by calling the API directly — the database will not return another household’s row to your session at all.

Our staff do not browse your records. Access to production data is limited to what is genuinely necessary to keep the service running or to resolve a problem you have reported to us.

We may disclose information where the law requires it — a valid court order, for example. If that ever happens we will tell you, unless we are legally prohibited from doing so.

Where your records are kept

Your records are stored in a managed Postgres database operated by Supabase in the Singaporeregion, and the application is served by Vercel’s global network. This means your information is transferred outside the Philippines and processed abroad.

Both providers apply encryption in transit and at rest, and both act only on our instructions. By using MilesCone you consent to this cross-border transfer, which is necessary for the service to function.

Our processors

• Supabase — database, authentication and file storage (Singapore).
• Vercel — application hosting and delivery.
• Our email provider — account emails such as confirmation, password reset and renewal reminders. These contain no health information.
• Our payment provider — subscription payments. They receive your billing details, never your records.

We will update this list before adding any new processor.

Records about children and about other adults

MilesCone is for adults. You must be 18 or older to hold an account, and the app is not directed at children.

Much of what MilesCone is for, though, is recording information about someone else — a child, a parent, someone you care for. By entering it you confirm you are that person’s parent, guardian or authorised carer, or that they have agreed to it.

Where the person is able to understand, we would encourage you to tell them what is being recorded and why. It is their history as much as yours. Where a young person later wants their record removed or handed to them, contact us and we will help.

Photos, reports and your device

• Profile photosare reduced on your own device before they are uploaded — resized and re-encoded to a small square. The original full-size photo from your camera roll never leaves your phone.
• Reports are made when you ask for one. A report is assembled from your records at the moment you open it and printed by your browser. We do not keep a copy on our servers, and no permanent file of your health history exists outside your account.
• Offline support caches the app, never your records. When installed to your phone, MilesCone stores its own screens and images so it opens without a connection. Every request for your actual data goes to the network and is never written into that cache.

How long we keep things

Your records are kept for as long as your account exists, because that is the point — a health history is only useful if it goes back. Nothing is deleted because you moved to a different plan or let a subscription lapse.

On the Free plan the timeline shows the most recent 60 days. Older records are hidden from that view, not removed, and become visible again on a paid plan.

When you delete your account, the records belonging to it are deleted with it. Backups are overwritten on a rolling cycle, so a copy may persist in an encrypted backup for a short period before ageing out.

Your rights

Under the Data Privacy Act you have the right to:

• Be informed about how your information is used — that is this page.
• Access a copy of what we hold about you.
• Correct anything inaccurate. Most records can be edited directly in the app.
• Erase or block your information, including deleting your account entirely.
• Object to processing, and to withdraw consent.
• Data portability — receive your records in a portable electronic format.
• Damages for a violation of your rights under the Act.

Email support@milescone.salesonline.com to exercise any of these. We will respond within 30 days. There is no charge.

If you are not satisfied with how we handle a request, you may complain to the National Privacy Commission of the Philippines.

Keeping it secure

• Every household record is isolated at the database level, not merely in the interface.
• All traffic is encrypted in transit; stored data is encrypted at rest.
• Passwords are hashed, and must be at least 12 characters with mixed case and a number.
• Reports and file storage are restricted per account.

No service can promise perfect security. If a breach ever affects your information, we will notify you and the National Privacy Commission as the Act requires.

Your password is the key to a health record. Please use one you do not use anywhere else, and tell us straight away if you think someone else has it.

Cookies

MilesCone sets one kind of cookie: the session cookie that keeps you logged in. There are no advertising cookies, no analytics cookies and no third-party cookies. There is nothing to opt out of, which is why you have not been shown a consent banner.

Changes to this policy

If we change how information is handled in a way that affects you, we will email the address on your account before the change takes effect — not merely update this page and change the date.