EKA (known in the app as "EKA / একা") is a menstrual cycle tracking application ("the App," "we," "our," or "us") developed and operated by offbits. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use the App.

This policy covers all users of the App, regardless of location. By downloading, installing, or using the App, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

2.1 Account Information

• - Email address (used for account creation and authentication)

• - Full name

• - Date of birth (minimum age of 10 is enforced)

• - Height and weight

• - Avatar selection (from six preset options)

• 2.2 Health and Cycle Data

• - Menstrual cycle start and end dates

• - Cycle length in days

• - Cycle regularity (regular or irregular)

• - Period length in days

• - Daily logs including flow type (none, spotting, light, medium, heavy), pain level (0-10 scale), mood, symptoms (cramps, headache, bloating, acne, back pain, breast tenderness, nausea, fatigue, spotting, dizziness), discharge type (dry, sticky, creamy, watery, egg-white), sleep quality (good, average, poor), medicine notes, private notes, and period delay tracking

• - Predicted period dates and fertile windows

• - Ovulation date estimates

2.3 Device Information

• - Language and locale preference (detected automatically from your device settings)

• - Notification preferences and reminder settings

• 
  

2.4 Chat Messages

• - Messages you send to the AI health chatbot

• - Responses generated by the AI chatbot

• - Chat history is stored to maintain conversation continuity across sessions

• 
  

2.5 Advertisement Requests

• If you choose to submit an advertisement inquiry, we collect:

• - Full name

• - Company name

• - Email address

• - Phone number

• - Website URL

• - Details about your advertisement request

2.6 User-Generated Content

• - Private notes and journal entries you create within the App

• - Medicine and health-related notes

2.7 Automatically Collected Information

• The App does NOT automatically collect analytics data, crash reports, usage statistics, or error logs.

• 3.1 Information You Provide Directly

• - During onboarding and account creation (name, email, birth date, height, weight, avatar)

• - When you log daily health data (symptoms, mood, flow, pain, notes)

• - When you interact with the AI chatbot

• - When you submit an advertisement request

• - When you update your profile or cycle settings

• 3.2 Information Collected Automatically

• - Device language and locale (via expo-localization)

• - Notification permission status

• 3.3 Information from Third Parties

• We do NOT collect information about you from third-party sources, data brokers, or social media platforms.

4.1 Account Management

- Creating and maintaining your account

- Authenticating your identity when you log in

- Allowing you to restore your session across app restarts

4.2 Service Delivery

- Calculating cycle phase predictions and fertile windows

- Generating period date estimates

- Providing daily logging functionality

- Delivering AI chatbot responses to your health questions

- Displaying educational articles

- Managing pad and hygiene product reminders

- Sending push notifications for period reminders, daily log reminders, and pad change reminders

4.3 Personalization

- Greeting you by name on the home screen

- Displaying your selected avatar

- Tailoring cycle insights based on your logged data

- Adapting to your language preference (18 languages supported)

4.4 Customer Support

- Responding to your inquiries sent via email or contact form

- Processing advertisement-related requests

- Assisting with account or data-related issues

4.5 Notifications

- Sending period predictions and reminders (3 days before, 2 days before, 1 day before, and day of)

- Sending daily log reminders

- Sending pad change reminders at user-configured intervals

- All notifications are local and processed on-device

4.6 Security

- Verifying your identity during login and password reset

- Detecting and preventing unauthorized access

- Securing authentication tokens and session data

4.7 Legal Compliance

- Complying with applicable laws, regulations, and legal processes

- Enforcing our Terms and Conditions

- Protecting our rights, privacy, safety, or property

5.1 What Health Data Is Collected

- Menstrual cycle dates, flow levels, pain scores, symptoms, moods, sleep quality, discharge type, and related notes

- Period predictions and cycle phase estimates

- Ovulation and fertile window estimates

5.2 How Health Data Is Used

- To provide cycle tracking and period prediction functionality

- To display cycle insights and trends

- To generate daily summaries and cycle history

- To provide educational wellness information

5.3 Health Data Storage

- Your detailed daily cycle logs, symptoms, moods, notes, and period records are stored locally on your device

- Basic account and profile configuration information necessary to provide the service is stored securely on our servers

- We do not share your menstrual tracking records, cycle logs, symptoms, moods, or health history with third parties. However, if you voluntarily use the AI chatbot, the messages you submit (which may include health-related information) are securely transmitted to our AI service provider solely to generate a response. This information is not used for advertising, marketing, or profiling

5.4 Health Data Protection

- Menstrual tracking records, daily logs, symptoms, moods, and notes remain stored locally on your device

- We do not upload or process these records on our servers unless you explicitly choose to share information through features such as the AI chatbot

- You can access and manage your health data through the App at any time

- You can delete all health data from the App settings at any time

- We never sell, share, or use your health data for advertising, marketing, or profiling purposes

6.1 AI Processing

- The App includes an AI-powered chatbot that uses Groq AI infrastructure with the Llama 3.1-8B-Instruct model

- The chatbot provides general educational information about women's health topics

- The chatbot can detect and respond in multiple languages

6.2 AI Limitations

- AI responses are for informational and educational purposes only and may contain inaccuracies. They do NOT constitute medical advice, diagnosis, or treatment

- AI-generated responses should never replace professional medical advice, diagnosis, or treatment

- The AI cannot respond to emergency medical situations or provide urgent care

- You should always consult a qualified healthcare professional for medical concerns

6.3 Data Sent to AI Services

- When you use the chatbot, your message and recent conversation history are sent to Groq AI's API for processing

- We use Groq AI solely to generate responses to your requests. Data submitted to the AI service is processed in accordance with Groq's Privacy Policy

- Chat history is stored in our Cloudflare D1 database for maintaining conversation context across sessions

7.1 Local Device Storage

The following data is stored exclusively on your device:

- All menstrual cycle data (dates, flow, symptoms, moods, pain, sleep, discharge)

- Daily logs and private notes

- Medicine notes

- Reminder settings and notification preferences

- Pad reminder configurations

- App settings and language preference

7.2 Cloud Storage (Cloudflare D1)

The following data is stored on Cloudflare's D1 edge database:

- Account information (email, name, birth date, height, weight, cycle length, cycle regularity, avatar)

- Chat history (user messages and AI responses with timestamps)

- Authentication session tokens are securely stored and managed for authentication purposes

- Password reset OTP hashes and related data

- Advertisement requests (name, company, email, phone, website, details)

7.3 Secure Storage

- Authentication tokens are stored securely using expo-secure-store (EncryptedSharedPreferences on Android, Keychain on iOS)

- Passwords are hashed using PBKDF2 before storage

7.4 No Server Storage of Health Data

We do NOT store your menstrual cycle data, daily logs, symptoms, pain levels, moods, notes, or any other health-related information on our servers. Health data remains on your device at all times.

• 8.1 Account Data Retention

• - We retain your account information and chat history only while your account remains active or as necessary to provide our services

• - After a verified account deletion request, we permanently delete or anonymize your personal data within a reasonable period unless we are legally required to retain certain information

• - You may request account deletion by contacting us at susmoydas6@gmail.com

• 
  

• 8.2 Health Data Retention

• - Health data is retained on your device for as long as you choose to keep it

• - You can delete individual logs or all data at any time

• - Health data is not stored on our servers

• 
  

• 8.3 Chat History Retention

• - Chat messages are retained in our Cloudflare D1 database to provide conversation continuity

• - You can delete your chat history at any time by using the in-app option or by contacting us

• - Deleted chat history is permanently removed from our servers

• 
  

• 8.4 Automatic Deletion

• - Failed password reset attempts and expired OTPs may be automatically cleaned from our database

• - Expired session tokens may be automatically removed

• 
  

• 8.5 Legal Retention Requirements

• - We may retain certain information if required by applicable law or for legitimate business purposes such as fraud prevention

• - Retained data under legal obligation will be securely isolated and protected

9.1 Requesting Account Deletion

- Users may request account deletion by contacting us at susmoydas6@gmail.com

- We will process your request and confirm once your account and associated data have been removed

9.2 Data Deletion Process

When we process an account deletion request, the following occurs:

- Your account information is removed from Cloudflare D1

- Your chat history is removed from Cloudflare D1

- Your session tokens are invalidated

- Local data on your device can be cleared separately via the "Delete all data" option in Settings

9.3 Retention After Deletion

- After account deletion, we do not retain your personal information unless required by law

- Advertisement requests previously submitted may be retained as necessary for legitimate business purposes

9.4 Verification Requirements

- We may need to verify your identity before processing an account deletion request to ensure the request is legitimate

10.1 Service Providers

We share limited data with service providers who help us operate the App:

- Cloudflare (Workers + D1): Hosts our backend API and stores account data, chat history, and advertisement requests

- Groq AI: Processes chat messages to generate AI responses

- MailChannels: Sends transactional emails for password reset

10.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests by public authorities (e.g., a court order or government agency).

10.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

10.4 No Sale of Personal Data

We do NOT sell your personal data to any third party. We do NOT rent, trade, or share your personal data for monetary consideration.

The App uses the following third-party services:

Cloudflare (Workers + D1)

Purpose: Backend API hosting, edge database, serverless compute

Data shared: Account information, chat messages, advertisement requests

Privacy policy: https://www.cloudflare.com/privacypolicy/

Groq AI

Purpose: AI chatbot response generation using Llama 3.1-8B-Instruct

Data shared: Chat messages (user messages and assistant responses)

Privacy policy: https://groq.com/privacy-policy/

MailChannels

Purpose: Transactional email delivery for password reset OTP

Data shared: Email address

Privacy policy: https://www.mailchannels.com/privacy-policy/

Expo (expo-notifications, expo-secure-store, expo-file-system, expo-sharing, expo-localization, expo-web-browser)

Purpose: Provides the application framework and supporting libraries used to operate the App (including local notifications, secure storage, file system access, sharing, localization, and browser links)

Data shared: Expo is not used by us for advertising, analytics, or tracking purposes. It provides the development framework and runtime environment for the App

Privacy policy: https://expo.dev/privacy

We do NOT use:

- Analytics services (e.g., Google Analytics, Firebase Analytics)

- Advertising services (e.g., AdMob, Facebook Ads)

- Crash reporting tools (e.g., Crashlytics, Sentry)

- Social media SDKs (e.g., Facebook SDK, Twitter SDK)

- Location services

- Camera or microphone access

- HealthKit or Google Fit (despite placeholder entries in configuration files)

Your data may be transferred to and processed in countries where our service providers operate:

- Cloudflare operates a global edge network with data centers worldwide

- Groq AI processes data in the United States

- MailChannels processes data through their global email infrastructure

When we transfer your data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

The App supports 18 languages, indicating a global user base. Where we transfer your data to trusted service providers in different countries, we do so only as necessary to provide the service and in accordance with applicable privacy laws and appropriate safeguards.

13.1 Encryption

- All network communications between the App and our servers use HTTPS/TLS encryption

- Passwords are hashed using PBKDF2 (Password-Based Key Derivation Function 2)

- Authentication tokens are encrypted at rest using platform-native secure storage

13.2 Authentication

- Session-based authentication using bearer tokens

- Tokens are stored in expo-secure-store (EncryptedSharedPreferences on Android)

- Password reset requires email-based OTP verification

13.3 Secure Transmission

- API calls to Cloudflare Workers are encrypted via HTTPS

- AI chatbot requests to Groq API are encrypted via HTTPS

- Email communications via MailChannels API are encrypted via HTTPS

13.4 Data Protection Practices

- Your detailed health logs (such as symptoms, moods, notes, and daily cycle records) remain stored locally on your device

- Only the minimum account and configuration information required to provide the service is stored securely on our servers

- We follow a data minimization approach, collecting only what is necessary

- We conduct regular reviews of our data practices

EKA is intended for users who are at least 10 years of age. During account creation, users are required to provide their date of birth. If a user does not meet the minimum age requirement, the App may restrict access to certain features or services.

We do not knowingly collect, use, or process personal information from children under the applicable minimum age. If we become aware that personal information from a child has been collected unintentionally, we will take reasonable steps to delete it as soon as practicable.

Where required by applicable law, parental or guardian consent may be required before a child can use the App.

If you believe that a child has provided personal information through the App, please contact us at susmoydas6@gmail.com so that we can investigate and take appropriate action.

The App is not directed to children under the applicable minimum age and is not intended to be used by them without any legally required parental or guardian consent.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

15.1 Access

You have the right to access the personal data we hold about you. You can review your data through the App.

15.2 Correction

You have the right to correct inaccurate or incomplete personal data. You can edit your profile information and cycle settings within the App.

15.3 Deletion

You have the right to request deletion of your personal data. You can delete all local data from the App settings, or request account deletion by contacting us at susmoydas6@gmail.com.

15.4 Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

15.5 Withdraw Consent

You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

15.6 Object to Processing

You have the right to object to the processing of your personal data for certain purposes, including direct marketing.

15.7 Restrict Processing

You have the right to request restriction of processing of your personal data in certain circumstances.

To exercise any of these rights, please contact us at susmoydas6@gmail.com or use the in-app settings.

16.1 Cookies

The App does NOT use cookies. Our backend API (Cloudflare Workers) does not set or read cookies.

16.2 SDKs

The App uses the following SDKs for functionality only:

- React Native (UI framework)

- Expo SDK (app development framework)

- These SDKs do NOT track your activity or collect personal data for advertising or analytics

16.3 Local Storage

- Data is stored locally on your device for app functionality

- This is not a tracking technology; it is used solely for app functionality

- Local storage data remains on your device and is not accessible to third parties

16.4 Tracking Technologies

The App does NOT use:

- Web beacons, pixel tags, or clear GIFs

- Fingerprinting techniques

- Social media tracking pixels

- Cross-app tracking

- Any form of behavioral tracking or advertising ID collection

The App may request the following permissions. All permissions are optional and can be revoked at any time through your device settings.

17.1 Notifications (POST_NOTIFICATIONS on Android 13+)

Purpose: To send you period reminders, daily log reminders, and pad change reminders.

All notifications are generated locally on your device.

17.2 Storage (READ_EXTERNAL_STORAGE / WRITE_EXTERNAL_STORAGE)

Purpose: Required for certain app functions that involve accessing or saving files on your device.

17.3 Exact Alarm (SCHEDULE_EXACT_ALARM / USE_EXACT_ALARM on Android 12+)

Purpose: To schedule accurate pad change reminders and other time-sensitive notifications at user-configured intervals.

17.4 Boot Completed (RECEIVE_BOOT_COMPLETED)

Purpose: To reschedule notifications after your device restarts.

17.5 Vibrate (VIBRATE)

Purpose: To provide vibration feedback for notifications.

17.6 Wake Lock (WAKE_LOCK)

Purpose: To ensure notifications are delivered reliably.

The App does NOT request or use the following permissions:

- Camera

- Microphone

- Location (GPS or network-based)

- Contacts

- Calendar (device calendar)

- Phone

- SMS

- Bluetooth

- Body Sensors

- Activity Recognition

If you are a resident of California, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

18.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you.

18.2 Right to Delete

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.

18.3 Right to Opt-Out of Sale

We do NOT sell your personal information. You do not need to opt out.

18.4 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights.

18.5 Right to Correct

You have the right to request correction of inaccurate personal information.

18.6 Right to Limit Use of Sensitive Personal Information

We only use sensitive personal information (such as health data) for purposes you reasonably expect: providing the cycle tracking service. We do not use sensitive data for cross-context behavioral advertising or profiling.

18.7 Categories of Personal Information Collected in the Past 12 Months

- Identifiers: email address, name

- Personal information categories listed in the California Customer Records statute: birth date, height, weight

- Protected classification characteristics: age (date of birth)

- Commercial information: advertisement requests (company name, phone, website)

- Internet or other electronic network activity information: none collected

- Geolocation data: none collected

- Sensory data: none collected

- Professional or employment-related information: company name (from advertisement requests)

- Inferences drawn from personal information: cycle predictions and fertile window estimates

18.8 Categories of Personal Information Disclosed for a Business Purpose in the Past 12 Months

- Identifiers (email) shared with MailChannels for password reset emails

- Chat messages shared with Groq AI for chatbot responses

18.9 Categories of Personal Information Sold in the Past 12 Months

We have NOT sold any personal information in the past 12 months.

To exercise your California rights, contact us at susmoydas6@gmail.com. We will verify your request using the email address associated with your account.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

19.1 Lawful Basis for Processing

We process your personal data based on:

- Consent: You provide explicit consent during onboarding and when using features like the AI chatbot

- Contract performance: Processing is necessary to provide the cycle tracking service you have requested

- Legitimate interests: Security, fraud prevention, and legal compliance

19.2 Your GDPR Rights

- Right to access (Article 15): Request a copy of your personal data

- Right to rectification (Article 16): Correct inaccurate data

- Right to erasure (Article 17): Request deletion of your data (right to be forgotten)

- Right to restrict processing (Article 18): Limit how we use your data

- Right to data portability (Article 20): Receive your data in a structured, commonly used, and machine-readable format

- Right to object (Article 21): Object to processing based on legitimate interests

- Rights related to automated decision-making (Article 22): The App's cycle predictions are estimates and do not produce legal effects concerning you

19.3 Data Controller

For the purposes of GDPR, the data controller is:

Data Controller: offbits

Representative: Susmoy Das

Email: susmoydas6@gmail.com

Website: https://sites.google.com/view/eka-app

19.4 Data Protection Officer (DPO)

We have not appointed a formal Data Protection Officer as we are a small-scale operation. For all data protection inquiries, please contact us at susmoydas6@gmail.com.

19.5 International Transfers

Your data may be transferred to countries outside the EEA (including the United States for Cloudflare and Groq AI processing). We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where applicable.

19.6 Complaints

You have the right to lodge a complaint with your local data protection authority if you believe our processing of your personal data violates GDPR.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or app functionality.

When we make changes:

- We will update the "Last Updated" date at the top of this policy

- We will post the updated policy within the App

- If changes are material, we will provide additional notice (such as an in-app notification or email)

We encourage you to review this Privacy Policy periodically. Your continued use of the App after changes take effect constitutes your acceptance of the updated policy.

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Developer: Susmoy Das

Email: susmoydas6@gmail.com

Website: https://sites.google.com/view/eka-app

For faster assistance with data-related requests, please use the email address associated with your account when contacting us.

This Privacy Policy is effective as of July 29, 2026. It replaces any previous privacy policies or data practice descriptions associated with the App.