Hormoscope (“the app”, “we”) is a menstrual-cycle forecast app built privacy-first. This policy explains what data the app touches and what it does not. The short version: your cycle data lives on your device. If you choose to share a forecast with a partner, it is end-to-end encrypted — we store it, but we cannot read it. We count anonymous app events to improve the app, never what you log.
1. Data stored on your device
Your period dates, cycle settings, daily logs, notes and app preferences are stored locally on your device (and, for home-screen widgets, in a private app group on the same device). This data is not transmitted to us and is not accessible to us. If you delete the app, this local data is removed with it. Partner sharing, if you turn it on, is the one exception — see section 4.
2. Apple Health (HealthKit)
With your explicit permission, Hormoscope reads and writes certain categories in Apple Health:
- Menstrual flow — to sync your period with the system Health app.
- Sexual activity — intimacy logs are written only to Apple Health and are never shown on any screen you share.
This data lives in Apple Health under Apple’s protection and is never used for advertising. If you import your period history from Apple Health, Hormoscope uses it to set your last period start date and cycle length; those two values are part of your encrypted forecast only if you turn on partner sharing (section 4). Nothing else from Apple Health leaves your device, and your sexual-activity data is never shared. You can revoke Health access at any time in iOS Settings → Health → Data Access & Devices, and you control HealthKit data in the Health app.
3. Subscriptions (RevenueCat & Apple)
Hormoscope Pro is sold as an auto-renewing subscription. Purchases are processed by Apple; we never see your payment details. To manage subscription status and unlock Pro across your devices, we use RevenueCat as our subscription infrastructure. RevenueCat receives a randomly generated, anonymous app-user identifier and the purchase and receipt information needed to validate your subscription (such as product ID, purchase and renewal dates, and country). It does not receive your name, your cycle data or your Health data. See RevenueCat’s Privacy Policy and Apple’s Privacy Policy.
4. Partner sharing (optional)
Hormoscope lets you share a forecast with one partner. It is off until you create an invite, and you can stop at any time from the app.
- What leaves your device. An encrypted forecast containing the name you chose to show, your last period start date, your cycle length, your period length, whether you log your periods, and when you last updated it. The start date and cycle length may come from period history you imported from Apple Health. Never your symptoms, notes, daily logs or intimacy data.
- How it is protected. Your device encrypts the forecast with AES-256-GCM and a random key before it is uploaded. That key reaches your partner only inside the invite, sealed with a key derived from the 12-character invite code (PBKDF2-HMAC-SHA256, 1,200,000 iterations). The invite code is never sent to us, so we cannot decrypt your forecast. Your partner’s device decrypts it and calculates the forecast locally.
- What our server stores. The encrypted forecast; one-way SHA-256 hashes of the access tokens held by your device and your partner’s; the sealed invite (for up to 24 hours, and for 10 minutes after it is used); and your partner’s Apple push-notification token, so their app can be told when your forecast changes.
- Pro on your partner’s side. To show Pro features to your partner when you have Hormoscope Pro, your anonymous RevenueCat identifier is sent with the upload; we may use it once to ask RevenueCat about your subscription, and we store only a one-way SHA-256 hash of it. For the same purpose RevenueCat notifies our server about subscription changes of Hormoscope Pro subscribers; we keep only the hash of the anonymous identifier, the entitlement’s expiry date and the time of the latest event, until shortly after the entitlement ends.
- Where. Our server runs on Cloudflare (Workers and D1). Like any web request, Cloudflare processes your IP address to deliver it. Our code does not log identifiers, tokens or the contents of requests.
- How long. Stopping sharing deletes the encrypted forecast immediately; a record that the share was stopped, containing no forecast, is kept for 30 days so an outdated copy of the app cannot re-create it. Your partner’s access record and push token are deleted when you stop sharing, when they disconnect, or when Apple reports the token as invalid. A share that is never stopped is deleted 400 days after its last update, and partner records after 800 days.
- Deleting the app. Deleting the app does not reach our server. Stop sharing first to remove the encrypted forecast immediately; otherwise it is deleted automatically 400 days after its last update.
- What your partner sees. Your cycle phase, a weather-style summary, countdowns to PMS and your period, and the week ahead — computed on their device from the forecast above. They can disconnect at any time.
5. Analytics (PostHog)
We use PostHog, hosted in the United States, to understand how the app is used so we can improve it. The app sends explicit, content-free events — for example that onboarding reached a step, which personality archetype the onboarding quiz gave you, that a paywall was shown, a forecast screen was opened or an invite was created — together with basic device information (such as app version, device model, operating-system version and language) and anonymous identifiers: a random PostHog ID and your anonymous RevenueCat ID. Events never contain your cycle dates, logs, notes, symptoms, Health data or the names you type. We do not record screens or sessions. PostHog may derive an approximate location from your IP address. See PostHog’s Privacy Policy.
6. What we do not do
- No advertising and no advertising identifiers.
- No tracking across other companies’ apps or websites.
- No data brokers; we never sell or rent your data.
- No account, login, email or phone number required to use the app.
7. Children
Hormoscope is not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect data from them.
8. Your rights and control
Your data is stored on your own device and in your own Apple Health, so you can view, edit or delete it at any time within the app, the Health app, or by deleting the app. You can stop partner sharing, and your partner can disconnect, at any time from the app. For subscription data held by RevenueCat or Apple, analytics data held by PostHog, or anything on our partner-sharing server, contact us and we will help you exercise applicable rights (access, deletion).
9. Changes
If this policy changes, we will update the date above and post the new version at this address.
10. Contact
Questions about privacy? Email devmobileuae@gmail.com.