Privacy Policy

Cyclea LLC is the controller of your personal information. 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA. Contact: support@cyclea.app.

The period, cycle, and wellbeing information you enter is sensitive ("special category") personal data. We process it only to provide the Service to you, and where required by law we rely on your explicit consent. Your data is stored on our behalf by Supabase in a data center in Zürich, Switzerland, and is never shared with advertisers or data brokers.

Information you provide:

• Account information: you can create your account with an email address and a password, or by using Sign in with Apple or Sign in with Google. If you sign up with an email address, your password is stored only in hashed form by our authentication provider. If you use Apple or Google, we never receive your password — we receive only your name and email address from them, and if you choose Apple's "Hide My Email", we receive a private relay address instead of your real one. Whichever way you sign up, you then add profile details yourself — display name, username, profile photo, preferred language, and time zone. We also record which version of our Terms and Privacy Policy you accepted when you created your account, and when.
• Cycle and wellbeing data you log: period flow, cycle/period length settings, phases, and — depending on the features you use — mood, energy, symptoms, sleep, and free-text notes or journal entries; plus planner entries and cycle-prediction preferences.
• Friends: friend requests you send or accept, the accounts you block, and your visibility ("who can find me") preference.
• Communications: messages you send us, such as support emails. If you give us feedback about the app in another way — for example by WhatsApp, email or in person — we may note down what you said and how it reached us, but not who you are. If you share an image with it, we may keep the image, with anything that identifies you cropped out; location and camera details are removed from it automatically.
• Support conversations: if you write to us in the app under Profile → Help & support, we keep the messages you and our team exchange, together with your app version, device platform and language, so that we can answer you. If you asked the in-app assistant first and then pass the conversation to our team, that conversation is kept with your messages. What you write is up to you, so a message may mention your health if you write about it; we never add the cycle, period or wellbeing data you log.
• Questions to the assistant: Help & support has an assistant that answers questions about using Cyclea. We do not store your questions or its answers: the conversation stays on your phone until you close the app, unless you pass it to our team (see above). To limit use, we count how many questions each account asks per day; the count contains nothing you wrote and is deleted within two days.
• Subscriptions: if you subscribe, the payment is handled by Apple (App Store) or Google (Google Play) — we never see your card or other payment details. We receive the details of the purchase: which plan you chose, its price and currency, the store, the purchase and renewal dates, and whether it was renewed, cancelled or refunded. If you joined using a creator's referral code, we record which code you used; the creator never learns who you are.
• Safety reports: if you report another user, we collect the reason you select, any note you write, the account you are reporting, and that account's username and display name as recorded at the time of the report.
• Feedback: if you rate an article or class or leave a note on it, we collect your rating and note. If you send feedback from the app (by shaking your phone or via Settings → Send feedback), we collect your message, the category you choose (bug, idea or other), your app and system version, your language, and the screen you were on — and, unless you switch it off, a screenshot of that screen, which you can draw on before sending. A screenshot may show cycle or wellbeing data that was on screen at the time.
• Waitlist: if you join our waitlist on the website, we collect your first name and email address so we can send you updates about Cyclea. You can unsubscribe at any time.
• Newsletter: you can subscribe to our newsletter in the app, by ticking the optional box when you create your account or later under Settings → Notifications → Newsletter. It is offered to people aged 16 or older and brings cycle tips, app news and offers. For it we use your account's email address, your display name (so that we can greet you by it) and the language your phone is set to. You are subscribed only after you confirm your address through an email we send you (double opt-in). We keep a record of your consent: the email address, the version of the wording you agreed to, and when you asked, confirmed and unsubscribed. If you change your account's email address, the subscription ends and you can subscribe again with the new address. You can unsubscribe at any time.

Information created as you use the Service:

• Derived cycle data: predicted cycles, ovulation estimates, and phase windows calculated from what you log.
• Content activity: articles or classes you save or open, and your daily featured selection.
• Technical data: our hosting provider processes basic technical information (such as IP address and request logs) to run the Service securely and reliably.
• Website analytics: when you visit www.cyclea.app, we use Google Analytics to understand how visitors use the site — for example, which pages are viewed, how long visits last, and what devices and browsers are used. Google Analytics uses cookies and similar technologies to collect this information. It may include your IP address, device and browser details, and a unique cookie identifier. We do not use Google Analytics to identify you personally, and we do not link it to your Cyclea account or health data.
• Cookie-consent preference: when you choose Accept or Decline on our cookie banner, we store that choice in your browser (localStorage key "cyclea-cookie-consent") so the banner does not ask again on every visit.
• Diagnostics and error reports: when the app runs into an error or crashes, it sends us a technical report so we can find and fix the problem. These reports contain the error type and message, the stack trace, and basic app and device details such as app version, device model, and operating system version, together with technical log messages the app produces as it runs. These reports are not linked to your account or profile. Your cycle, period, symptom, mood, journal, and planner entries are never included in them. The app contains no advertising SDKs, and we do not use product analytics, behavioural profiling, or session recording.

To provide core features (tracking, forecasts, planner, content, friends); to create your account, authenticate you, and provide support, including answering your questions in the app; to review feedback you send us and improve the app and its content; to send you newsletters and product updates you have asked to receive (which you can unsubscribe from at any time); to diagnose and fix crashes and errors, and to keep the Service secure and reliable; and to comply with legal obligations.

For users in the EU/EEA, UK, and Switzerland, our legal bases are: your consent for sensitive health data and for the newsletter (which you can withdraw at any time); performance of a contract to provide the Service; our legitimate interests in operating and securing it; and compliance with legal obligations.

Our website uses cookies and similar technologies for two purposes: to remember your cookie-consent choice, and — if you accept — to help us understand how people use the site through Google Analytics.

When you first visit www.cyclea.app, our cookie banner asks whether you accept analytics cookies. If you choose Decline, Google Analytics remains disabled and no analytics cookies are set. If you choose Accept, Google Analytics is enabled and processes browsing data as described above. You can change your choice at any time by clearing the "cyclea-cookie-consent" item from your browser's localStorage for cyclea.app; the banner will then appear again on your next visit.

We use Google Consent Mode, which means Google receives only limited, cookieless technical signals until you consent, and full analytics processing only after you accept.

Cyclea calculates your forecasts and phase windows from the data you log, using our own logic — we do not use artificial intelligence to process your cycle, period or wellbeing data. We may add AI-assisted insight features in the future. If we do, we will update this Policy and inform you before any of that data is processed in that way. We do use AI in two other places: an assistant in Help & support that answers questions about using the app from our help articles, described below under Infomaniak, which never sees the data you log; and an AI assistant that helps us review feedback, described below under Anthropic.

We share personal information only as described here:

• With other users you connect with. When you and another user become friends, they can see your username, display name, profile photo, cycle and period lengths, current phase, current cycle day, your phase windows (dates), and a compatibility "match score." They cannot see your daily logs, symptoms, moods, journal or notes, flow entries, planner, favorites, or email. You control this by choosing whom to accept and by your visibility setting.
• With service providers who process data on our behalf, under contracts requiring appropriate protection: Supabase provides our database, authentication, and file storage, hosted in Zürich, Switzerland. Our content management system, Directus, holds our editorial content and, so that our editors can see them, the ratings and notes you leave on articles and classes, without your name, email or account identifier. The app reaches it through our own servers.
• Apple and Google (sign-in). If you choose Sign in with Apple or Sign in with Google, that company checks who you are and confirms it to us, and in doing so learns that you use Cyclea. We receive your name and email address (or Apple's private relay address) from them, and nothing else. They do not receive your cycle, period, or wellbeing data, and your password — if you have one with them — is never shared with us. Their own privacy policies govern what they do with the sign-in itself.
• Bunny.net (operated by BunnyWay d.o.o., based in Slovenia, in the European Union) delivers the app's images, videos and audio. When the app loads an image or you play a video or audio session, Bunny.net processes your device's IP address and basic request data to deliver the file from a server near you. It does not receive your account details, and never your cycle, period, or wellbeing data. Video and audio links are short-lived and expire within hours.
• PostHog provides our crash and error reporting. Diagnostic reports from the app are processed on PostHog Cloud EU, hosted in Frankfurt, Germany, under a data processing agreement. PostHog receives only the technical error and log data described above — never your cycle, period, or wellbeing data — and the reports are not tied to your identity.
• Brevo (operated by Sendinblue SAS, based in France, in the European Union) is our newsletter and waitlist email provider. If you join our waitlist, Brevo processes your first name and email address on our behalf. If you subscribe to the newsletter in the app and confirm your address, Brevo processes your email address, your display name and your language on our behalf, to manage our mailing list and deliver the emails you signed up for. It never receives your cycle, period, or wellbeing data. You can unsubscribe at any time in the app, using the link in any email, or by contacting support@cyclea.app. When you unsubscribe, Brevo keeps your contact marked as unsubscribed, so that you are not written to again by mistake; it is deleted from Brevo when you delete your Cyclea account.
• Postmark (operated by AC PM, LLC, an ActiveCampaign company based in the United States) sends our account emails — for example, a link to reset your password, or to confirm a change to your email address — and the email that asks you to confirm a newsletter subscription, and the email that tells you we have replied to your support message. That email never contains the message itself. For each of these emails, Postmark processes your email address and the content of that message on our behalf. It never receives your cycle, period, or wellbeing data. Postmark keeps message content and delivery details for 45 days; records of addresses that bounced or rejected our emails are kept longer, so that we do not keep writing to them.
• RevenueCat (operated by RevenueCat, Inc., based in the United States) manages our in-app subscriptions. When you buy, renew or restore a subscription, the app and the App Store or Google Play send RevenueCat the purchase details described above, together with your Cyclea account identifier — a random ID, not your name or email address — and basic technical data such as your app version, device platform and IP address. RevenueCat uses this to confirm your purchase and tell us which features to unlock. It never receives your name, your email address, or your cycle, period, or wellbeing data.
• Infomaniak (Infomaniak Network SA, based in Geneva, Switzerland) runs the AI model behind the assistant in Help & support. When you ask the assistant a question, your question and the conversation so far are sent to Infomaniak together with our published help articles, so that it can write the answer. It receives no name, email address or account identifier, and never the cycle, period or wellbeing data you log, only what you type into the assistant. Infomaniak processes this in Switzerland under a data processing agreement, does not keep it, and does not use it to train models. The assistant is not a medical service and does not give medical advice.
• Anthropic (Anthropic PBC, based in the United States) provides Claude, an AI assistant we use to help us read and act on feedback: feedback you send from the app, ratings and notes on content, and feedback that reaches us in other ways. It sees that text and its context (category, app version, screen, the item rated), never your name, email address or account identifier, never a screenshot or image, and never the cycle, period or wellbeing data you log. Under our account settings it is not used to train Anthropic's models. Safety reports are not shared with it. Neither are support conversations or your questions to the assistant in Help & support.
• Render (operated by Render Services, Inc., based in the United States) hosts our tools for creators and for our own administration, on servers in Frankfurt, Germany. Five kinds of information about app users reach Render. The first is statistics about sign-ups made with a creator's code — for example, how many people used a code in a given month — which contain no names, email addresses or account identifiers. The second is the feedback you send from the app: your message, the category you chose, and your app and system version, language and the screen you were on, so that we can review it. It reaches Render without your name, email or account identifier, and never with the screenshot, which stays in our Supabase storage. We also keep feedback that reaches us in other ways (see “Communications” above) in these tools, stored in our Supabase database in Zürich, Switzerland. The third is your rating of an article or class and any note you add, together with the item it is about, so that we can review it, again without your name, email or account identifier. The fourth is a report you make about another user: the reason you chose, your note, and the reported account's username and display name, never who made the report, so that we can review it and act on it. The fifth is your support conversations: the messages you and our team exchange, together with your username, display name, app version, platform, language and whether you have a subscription, so that we can answer you, never your email address or account identifier. Your message or note is whatever you choose to write, so it may mention your health if you write about it; the cycle, period, or wellbeing data you log in the app never reaches Render. Render does not keep any of this: it passes through its servers only to be displayed to the creator, or to us.
• For legal and safety reasons — if required by law, or to protect the rights, safety, and security of our users, the public, or Cyclea.
• Google Analytics (provided by Google LLC) processes website usage data on our behalf. Google may use cookies and receive information such as your IP address, browser and device details, and which pages you visit. Google Analytics is configured without advertising features and is not linked to your Cyclea account or health data.
• In a business transfer — if Cyclea is involved in a merger, acquisition, or asset sale, your information may be transferred subject to this Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Cyclea LLC is based in the United States, while your account and health data is stored in Switzerland — recognized by the EU and UK as providing an adequate level of data protection — and diagnostic error reports are processed in Germany, within the EU. Images, videos and audio are delivered by Bunny.net, an EU-based provider, from the server nearest to you. Website analytics data is processed by Google LLC in the United States. Account emails, such as password resets, and the email that asks you to confirm a newsletter subscription are sent through Postmark in the United States. Subscription and purchase records are processed by RevenueCat in the United States. Feedback reviewed with Claude is processed by Anthropic in the United States. Questions to the assistant in Help & support are processed by Infomaniak in Switzerland. Our creator and administration tools run on Render's servers in Frankfurt, Germany, operated by a US company. Where we transfer personal data internationally (including access from the US), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent mechanisms.

We keep your information for as long as your account exists. When you delete your account, we delete your profile and all associated data — logs, cycles, planner, favorites, friendships, profile photo, and feedback including screenshots — and this cannot be undone. Residual copies in routine backups are removed on a rolling basis, and temporary media links expire within hours. If you signed in with Apple, deleting your account also revokes Cyclea's Sign in with Apple connection, so the app no longer appears in your Apple ID settings. Your purchase records are deleted with your account, and we ask RevenueCat to delete its record of you as well. Apple and Google keep their own records of your purchases under their own privacy policies.

Copies of content ratings or notes in our content management system are not linked to your account and remain there after your account is deleted. Feedback you give us outside the app is not linked to your account either, so it is not deleted with it; if you would like it deleted, write to support@cyclea.app and tell us roughly what you sent and when.

Safety reports are an exception. So that a report cannot be erased simply by deleting an account, we keep abuse reports after an account is deleted: the link to the accounts involved is removed, while the report itself — the reason, any note, and the username recorded at the time — is retained for up to 12 months for safety and legal purposes. Our record of how we handled a report is deleted together with it.

Support conversations are kept while they are open. A conversation closes when you mark it as solved, when we close it, or 30 days after our last reply if you don't answer, and is deleted 12 months after it closed. Deleting your account deletes your support conversations at once. The daily count of questions you ask the assistant is deleted within two days.

The newsletter is another exception. So that we can show a subscription was asked for and confirmed, we keep the record of your consent — the email address, the version of the wording you agreed to, and the dates you asked, confirmed and unsubscribed — for three years after you delete your account, without any link to that account. A request you never confirmed is deleted after 30 days, or with your account if that comes first. When you delete your account, we also delete your contact from Brevo.

You can delete your account and all associated data at any time in the app (Profile → Account → Delete account) or by emailing support@cyclea.app.

You can unsubscribe from the newsletter at any time in the app (Settings → Notifications → Newsletter), using the link in any newsletter, or by emailing support@cyclea.app.

Depending on where you live, you may also have rights to: access, correct, or receive a copy of your information (portability); delete it; restrict or object to certain processing and withdraw consent; opt out of the "sale" or "sharing" of personal information (we do neither for advertising); and lodge a complaint with your data protection authority.

• EU/EEA, UK & Switzerland (GDPR / UK GDPR / Swiss FADP): the rights above, plus the right to complain to your supervisory authority (in Switzerland, the Federal Data Protection and Information Commissioner, FDPIC/EDÖB).
• United States (including California): rights to know, delete, and correct, and to opt out of sale/sharing — which we do not do. We will not discriminate against you for exercising your rights.
• Canada, Australia & New Zealand: rights of access and correction under PIPEDA, the Australian Privacy Principles, and the New Zealand Privacy Act.

To exercise any right, email support@cyclea.app. We may need to verify your identity.

Data is encrypted in transit. On your device, your login session is stored in the iOS Keychain / Android Keystore. Access is restricted at the database level so you — and, for the limited fields above, friends you approve — can access only your own data. No method of transmission or storage is completely secure, but we work to protect your information. Before an error report leaves your device, the app strips fields known to carry personal information, and health data is excluded from error reporting by design.

Home and lock screen widgets. If you add a Cyclea widget to your home screen or lock screen, the app keeps a small copy on your device of what the widgets show for about the next two weeks — your current phase, cycle day, the estimate for your next period, your planned activities and the day's featured content — so the widgets stay current without the app being open. This copy is stored only on your device, in storage shared between the app and its widgets; it is never sent to us or to anyone else, and it is deleted when you sign out. On iPhone, widget content is hidden while your phone is locked. Widgets on your home screen can be seen by anyone who can see your unlocked screen, so you can remove them at any time.

Cyclea is not directed to children under 13, and we do not knowingly collect their personal information. If you are between 13 and the age of digital consent in your country (up to 16 in parts of the EU), use Cyclea only with the involvement and consent of a parent or guardian. If you believe a child has provided us personal information, contact support@cyclea.app and we will delete it. The newsletter is offered only to people aged 16 or older.

We may update this Policy from time to time. If we make material changes, we will notify you in the app or on our website and update the effective date above.

Cyclea LLC — support@cyclea.app — 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA.