Our privacy policy in plain language, the 2-minute version

Our full privacy policy is thorough, and therefore long. Fair enough: it's a legal document. But most people just want to know: what do you actually do with my data?

Here's the complete TL;DR. No marketing fluff, no fine print. Want the original? It's here.

What we store

• Account: email, an optional display name, and an authentication ID (only for Sign in with Google or Apple).
• Cycle & health (special category data under GDPR art. 9): period dates, flow, symptoms (pain, mood, energy, libido, sleep), free-text notes, spotting, contraception method, reproductive goal, and optionally basal body temperature and sexual activity. Only what you log yourself.
• Medical conditions you tick yourself: endometriosis, PCOS, PMS, PMDD.
• AI conversations: the messages you type, plus the cycle context we send with each message.
• Operational logs: event names ("opened Today screen") and a session ID, so we can fix bugs. We don't log symptom values, free text, or AI message contents.

What we don't do

• ❌ No advertising trackers.
• ❌ No third-party analytics SDKs (no PostHog, Mixpanel, Amplitude, Google Analytics, Segment, Facebook SDK, Adjust, Singular).
• ❌ No ads. Anywhere.
• ❌ No selling, renting or sharing data for marketing.
• ❌ No location, no persistent advertising device ID.
• ❌ No payment card data (Apple and Google handle payments).

Where your data lives

• 📍 Postgres database on Supabase, hosted in Frankfurt (EU).
• 🔒 Encrypted at rest (AES-256) and in transit (TLS 1.2+).
• 🛡️ Row-level security at the database level: only you can read your own rows.
• 📜 Hosting infrastructure is SOC 2 Type II and ISO 27001:2022 certified.

The AI assistant

• ✅ Only works after explicit in-app consent; you can use the app fully without ever opening it.
• ✅ Our AI provider (Google Gemini, via a secure gateway) commits to: not using your data to train their models, and not retaining prompts/responses longer than needed.
• ✅ Chat history lives in our own database, not at the AI provider.
• ✅ We deliberately don't send: your email address, your sexual-activity flag, or notes marked as a private journal.
• ✅ Withdraw consent: Settings → Privacy → Revoke AI consent.

Who helps us (sub-processors)

• Supabase, database hosting (EU region).
• Google (Gemini), AI Cycle Assistant.
• Google (OAuth/Workspace), optional Google login and our team email.
• Apple, App Store, Sign in with Apple, push notifications.
• Resend, transactional email.
• AppsFlyer, install attribution, iOS app only. Measures whether an install came from one of our campaigns; receives no advertising ID and no cycle or health data.
• RevenueCat, subscription management for PERIOD. plus. Sees payment status, no health data.
• EU-hosted infrastructure platform, application platform and AI gateway routing (Ireland).

We have a data processing agreement with every vendor. For parties outside the EU we rely on the Standard Contractual Clauses (SCCs, Module 2, 2021/914) and where applicable the EU, US Data Privacy Framework. Current list: /sub-processors.

Your rights

• Access: everything we have is visible in the app.
• Edit: change it yourself, anytime.
• Delete: Settings → Delete account. One button. Live data removed within 30 days, backups within another 14, including AI conversations.
• Question or complaint: email privacy@myperiod.app, or file a complaint with your national data protection authority.

That's it.

No hidden chapters. Everything above is also, in more detail and legally precise, in the full privacy policy.

Questions? Email privacy@myperiod.app. We always reply ourselves, no support bot.

Want to try PERIOD.? Download on the App Store or via Google Play. Free. No ads. Your data stays yours.