This policy explains what the App collects, why, where it is stored, and the choices you have.
Periods Tracker handles menstrual and reproductive health information. We treat that as sensitive personal data and describe our handling of it in specific terms below rather than in generalities.
1. Summary
You create an account with an email address to use the App.
Your cycle, symptom and medication data is stored in our cloud database (Supabase) and linked to your account so it is available across sessions and devices.
Each user can access only their own records.
We do not sell your data, share it with advertisers, or use it for advertising or cross-app tracking.
You can export or delete your account and data from inside the App.
2. Information we collect
2.1 Account information
Email address — used to create and secure your account, sign you in, and reset your password. Legal basis: contract.
Password — stored only as a salted hash, never in plain text. Used to authenticate you. Legal basis: contract.
Authentication tokens — used to keep you signed in. Legal basis: contract.
Sign-in is provided via email and password, and via a one-time email code. Where you choose to sign in with Apple, we receive only the identifier (and email, which Apple may relay privately) that Apple returns — we never receive your Apple password.
2.2 Profile information you provide during onboarding
Collected because the App's predictions cannot function without them:
First name or nickname (display only)
Date of birth / age
Typical cycle length and period length
Cycle regularity
Contraception type, where you choose to state it
Your stated goal for using the App (for example tracking, conceiving, or understanding symptoms)
2.3 Health and cycle information — sensitive category
Period start and end dates, and edits you make to them
Day-level cycle records, including predicted and confirmed phases
Symptoms you log, and the dates they relate to
Medications and supplements you add, including names, dosages and schedules
Reminder times you set
Under UK/EU GDPR this is special category data (Article 9) concerning health. We process it only with your explicit consent, given when you create an account and enter this information. You may withdraw consent at any time by deleting your account (section 8).
2.4 Information collected automatically
Device and app diagnostics — app version, operating system version and device model, used to diagnose faults.
Notification token — an identifier issued by Apple or Google so reminders can reach your device. It cannot read anything on your device.
We do not collect your precise location, contacts, photos, microphone or camera data. The App requests no such permissions.
2.5 Feedback you send us
If you use the in-app feedback form, we receive the message you write and the account it came from, so we can reply and fix problems.
3. Where your data is stored and who can reach it
Your data is stored in a Supabase (PostgreSQL) database hosted on infrastructure operated by Supabase Inc. and its cloud providers. Supabase acts as our data processor and processes data only on our instructions.
Access is restricted by row-level security: queries are evaluated against your authenticated user identity, so one account cannot read another account's cycle, symptom, medication or profile records.
Authentication credentials are held on your device in the operating system's protected storage. Non-sensitive app preferences are cached on the device for speed.
International transfers. Where data is processed outside your country, we rely on the UK/EU Standard Contractual Clauses or an equivalent transfer mechanism. Our database region is [DATABASE REGION].
4. How we use your information
We use your information only to:
Provide cycle predictions, calendar views and phase insights
Send the reminders you have asked for
Keep your records available when you sign in again or change device
Maintain security, prevent abuse and diagnose faults
Respond to your support requests
Comply with legal obligations
We do not use your health data for advertising, profiling for marketing, or automated decision-making that has legal effects on you.
5. What we never do
We do not sell or rent your personal data.
We do not share cycle, symptom or medication data with advertisers, data brokers, insurers or employers.
We do not use advertising identifiers, ad networks, or cross-app or cross-site tracking.
We do not disclose your data in response to informal requests. We require valid legal process, assess each demand, and will narrow or challenge requests that are overbroad. Where we are legally permitted to notify you, we will.
6. Third parties we rely on
database and authentication (data processor). Receives your account identifiers, profile, cycle, symptom, medication and reminder records.
We do not currently use analytics, crash-reporting or advertising SDKs. If that changes, we will update this policy and seek consent where required.
7. How long we keep your data
While your account is active — we keep your records so the App works.
After you delete your account — account, profile, cycle, symptom, medication and reminder records are deleted from our live database within 30 days.
Backups — residual copies may persist in encrypted backups for up to 90 days, after which they are overwritten.
Feedback messages — kept up to 24 months for support history.
8. Your rights and how to exercise them
You can, at any time:
Access and correct your profile and logged data — directly in the App, via Settings → Personal Info, Edit Periods and the tracker screens.
Delete your account and all associated data — Settings → Delete Account. This is irreversible.
Withdraw consent for health-data processing — by deleting your account.
Object or restrict, and request portability of your data — contact us at devinfo2026@gmail.com and we will respond within one month.
Turn off notifications — in the App, or in your device settings.
If you are in the UK or EEA and are unhappy with our response, you may complain to your data protection authority (in the UK, the Information Commissioner's Office, ico.org.uk).
Residents of California (CCPA/CPRA)
You have the right to know, delete, and correct your personal information, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CPRA. We will not discriminate against you for exercising these rights.
9. Security
We protect your data with:
Encryption in transit (TLS) and encryption at rest
Row-level security so records are reachable only by the account that owns them
Credentials held in the device's protected keystore
Passwords stored only as salted hashes
No system is perfectly secure. If a breach affects your personal data and presents a risk to you, we will notify you and the relevant regulator as required by law.
10. Children
The App is not directed to children under 13 (or under 16 where local law sets a higher age for health-data consent). We do not knowingly collect data from children below that age. If you believe a child has provided data, contact us and we will delete it.
11. Medical disclaimer
Periods Tracker provides predictions and general information, not medical advice. Cycle predictions are estimates calculated from the dates you enter and will not always be accurate. The App is not a contraceptive and must not be relied on to prevent or achieve pregnancy. Always consult a qualified healthcare professional about your health, medication or fertility.
12. Changes to this policy
If we make a material change — particularly to what we collect or who receives it — we will notify you in the App before the change takes effect and update the date at the top of this policy.
13. Contact
Email: devinfo2026@gmail.com