sCycle Privacy Policy

1. Introduction

Welcome to the Privacy Policy for sCycle ("we", "us", or "our"). sCycle is a private period tracking app designed to help you understand your menstrual cycle while keeping your personal health data completely secure and private.

sCycle operates on a local-only principle: all your health data is stored exclusively on your device using encrypted local storage and is never transmitted to external servers or cloud services. This Privacy Policy explains how we handle your data when you use our app.

Please read this policy carefully to understand how we treat your sensitive health information.

Data Controller

The data controller responsible for your personal data is:

Anthony Eli Rasch - sapplify
PO Box 004
91501 Nové Mesto nad Váhom
Slovakia

Email: contact@sapplify.com

2. Data Collection

Local Storage Only: sCycle is a privacy-first period tracking app. All your health data is stored exclusively on your device using encrypted local storage and is never transmitted to external servers or cloud services.

Health Data We Store Locally

The app collects and stores the following health information that you actively enter:

• Menstrual cycle dates: Period start and end dates
• Daily period logs: Flow intensity (light, medium, heavy, very heavy)
• Symptoms: Cramps, headache, bloating, fatigue, mood changes, and other tracked symptoms with intensity levels
• Pain levels: Daily pain tracking (1-10 scale)
• Personal notes: Your observations and cycle notes
• Calculated data: Average cycle length and period length based on your entries

App Settings & Preferences

• Notification preferences and timing settings
• Quiet hours (do-not-disturb schedule)
• Language and theme preferences
• Biometric authentication settings (if enabled)
• App lock timeout settings
• Trial start date (for 30-day free trial)

Storage Technologies

We use the following secure local storage technologies:

• SQLCipher: Military-grade AES-256 encryption for your health data with PBKDF2-HMAC-SHA512 key derivation
• Flutter Secure Storage: For storing encryption keys and sensitive settings in your device's secure hardware enclave (iOS Keychain / Android Keystore)
• Shared Preferences: For non-sensitive app preferences (encrypted on Android)

Strictly Necessary Storage

Under the EU ePrivacy Directive, the local storage technologies we use are strictly necessary for providing the period tracking service you requested. A period tracking app cannot function without storing your cycle data locally. Therefore, no separate consent is required for this storage, and we do not display a "cookie consent" pop-up for these essential functions.

What We DO NOT Do

• We DO NOT collect any personal identifying information
• We DO NOT transmit your health data to our servers or any third party
• We DO NOT sell, share, or analyze your personal health data
• We DO NOT display advertisements or use tracking technologies
• We DO NOT use analytics tools or external monitoring services
• We DO NOT require user accounts or registration

3. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR) and applicable data protection laws, we process your personal data based on the following legal grounds:

Contract Performance

We process your data when necessary to provide you with the sCycle service:

• Storing your menstrual health data locally on your device
• Providing cycle predictions and insights based on your data
• Managing your subscription status

Consent

We process certain data only with your explicit consent:

• Sending notifications (you enable this in settings)
• Using biometric authentication (you choose to enable this)
• Exporting or sharing your data (you initiate this action)
• Submitting feedback with device information (you choose to send feedback)

You can withdraw consent at any time by disabling the relevant features in app settings.

Legitimate Interest

We may process limited data based on our legitimate interests:

• Ensuring security and preventing unauthorized access to your data
• Responding to support inquiries
• Improving the app based on anonymous, aggregated feedback

Legal Obligations

We may process data when required by law, such as responding to valid legal requests from authorities.

Special Category Data

Your menstrual health data constitutes "special category data" under GDPR Article 9. We process this data based on your explicit consent when you enter it into the app, and solely for the purpose of providing you with the period tracking service. This data is stored exclusively on your device and is never transmitted to our servers.

4. App Permissions

sCycle requests only the permissions necessary for its features to function properly. All permissions are opt-in and requested only when needed:

Core Permissions

• Secure Storage Access: To store your encrypted health data locally on your device
• Internet Access: Required only for subscription validation, app store purchases, and optional feedback submission

Optional Permissions (Requested When Needed)

• Biometric Authentication (Face ID/Touch ID/Fingerprint): To protect your data with biometric security. Requested only if you enable app lock.
• Notifications: To send you optional period predictions and cycle reminders. Requested only if you enable notifications.
• File Access: To enable data export/import for backup purposes. Requested only when you initiate export or import.
• Camera: For potential future features like document capture. Currently not actively used.
• Microphone: For potential future features like voice notes. Currently not actively used.

Permissions We DO NOT Request

• Location services
• Contact list access
• Calendar access
• Background location
• Health app integration (data stays within sCycle only)

5. Purchases & Payments

sCycle offers a premium subscription to unlock advanced features. We also offer a 30-day free trial for new users.

Subscription Options

• Free Trial: 30-day trial with full access to premium features. Trial start date is stored locally on your device.
• Premium Subscription: Recurring subscription for continued access to advanced predictions, insights, and analytics.

Payment Processing

All payments are processed through the platform's app store:

• Apple App Store: For iOS users - Apple Privacy Policy
• Google Play Store: For Android users - Google Privacy Policy
• Huawei AppGallery: For Huawei device users - Huawei Privacy Policy

What We Store Locally

• Purchase status (active/expired)
• Purchase date
• Product type (trial or regular subscription)
• Transaction ID (from app store, for restore purchases functionality)

What We DO NOT Store

• Credit card or payment method details
• Billing address
• Bank account information

We never see or store your payment details. All payment processing is handled securely by the respective app stores. Subscription management (cancellation, renewal) is done through your device's app store subscription settings.

6. Feedback & Support

sCycle includes an optional feedback feature that allows you to report bugs, request features, or contact support directly from the app.

What Happens When You Submit Feedback

When you choose to submit feedback, the following information is sent to our server (api.sapplify.com):

• Your feedback message: The text you write
• Feedback type: Bug report, feature request, or general feedback
• Email address: Only if you choose to provide it for follow-up
• App version: To help us identify version-specific issues
• Device information: Manufacturer, model, and OS version (to help diagnose technical issues)

What We DO NOT Send

• Your health data (cycle dates, symptoms, notes)
• Your app settings or preferences
• Any personally identifiable information unless you provide it

Your Control

• Feedback submission is entirely optional
• You can choose whether or not to include your email
• Feedback is transmitted securely over HTTPS
• We use feedback solely to improve sCycle and respond to your inquiries

7. Data Sharing

sCycle is designed with privacy as the core principle - we do not automatically share any of your health data.

We DO NOT Share Your Health Data With

• Advertisers or marketing companies
• Data brokers or analytics firms
• Social media platforms
• Healthcare providers (unless you explicitly choose to share)
• Insurance companies
• Government agencies (except when legally required)
• Any third party for commercial purposes

Third-Party Services

The following third-party services may process limited data as part of providing sCycle:

• Apple App Store / Google Play / Huawei AppGallery: Process payments and manage subscriptions
• Sapplify API (European Union): Receives optional feedback submissions (not health data)

These providers are bound by their respective privacy policies and terms of service. A Data Processing Agreement (DPA) is in place with all sub-processors where required to ensure GDPR compliance as required by Article 28 of the GDPR.

User-Initiated Sharing

You have full control over sharing your data through manual export features:

• Export your cycle data for backup or transfer to another device (JSON/CSV)
• Share individual cycle insights or summaries (your choice)
• Generate reports for healthcare providers (if you choose)

All sharing is explicit, user-initiated, and you maintain full control over what information is shared and with whom.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Cycle predictions are generated locally on your device for your personal use only.

Legal Requirements

We may disclose information if required by law, such as in response to a valid court order or government request. Since your health data is stored only on your device and we do not have access to it, we cannot disclose what we do not possess. We will notify you of such requests when legally permitted.

8. Data Security

Your menstrual health data is highly sensitive, and we implement multiple layers of security to protect it:

Encryption & Security Measures

Secure Logging

Internal app logs automatically redact sensitive information. Health-related data (dates, symptoms, notes) is never written to logs in readable form.

Your Responsibility

To maximize the security of your health data, we recommend:

• Enable device lock screen protection (PIN, password, biometric)
• Enable sCycle's app lock feature for additional security
• Keep your device operating system and sCycle app updated
• Create regular encrypted backups of your data via the export feature
• Do not share your device unlock credentials with others

9. Data Retention & Deletion

Local Data Retention

• Your health data remains on your device as long as you use the app
• Data persists until you explicitly delete it or uninstall the app
• Uninstalling the app permanently removes all local data
• We recommend exporting your data before uninstalling if you want to keep a backup

Trial Information

• Trial start date is stored locally to track your 30-day free trial
• This information is deleted when you uninstall the app

Feedback Data

• Feedback submissions are retained for support purposes
• You can request deletion of your feedback by contacting privacy@sapplify.com

How to Delete Your Data

Delete All Data

Go to Settings > Privacy > Delete All Data. This will:

• Permanently delete all cycle entries and symptoms
• Reset all app settings to defaults
• Remove trial information
• This action cannot be undone

Delete Individual Entries

You can delete individual cycle entries, symptoms, or notes directly within the app by editing or removing them.

Export Before Deletion

We recommend exporting your data before deletion. Use the Export feature in Settings to save a backup in JSON or CSV format.

Complete Removal

To completely remove all data, delete your data within the app, then uninstall sCycle from your device.

10. Your Rights

You have full control over your personal health data. Since all data is stored locally on your device, you can exercise most rights directly within the app.

Access Your Data

View all your data within the app at any time. Use the Export feature to download a complete copy in JSON or CSV format.

Correct Your Data

Edit any cycle entry, symptom, or note directly within the app.

Delete Your Data

Delete individual items or all data from Settings > Privacy > Delete All Data. See the Data Retention & Deletion section for details.

Data Portability

Export your data in standard formats (JSON, CSV) to transfer to other services or for your own records.

Withdraw Consent

You can disable any optional feature at any time:

• Disable notifications in app settings
• Disable biometric authentication
• Choose not to submit feedback

GDPR Rights (EU Users)

If you are in the European Union, you have additional rights under GDPR including:

• Right to access: Request confirmation of whether we process your data and obtain a copy
• Right to rectification: Correct inaccurate personal data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: Request limitation of processing in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to lodge a complaint: File a complaint with a supervisory authority

Since your health data is stored only on your device, you can exercise access, rectification, erasure, and portability rights directly within the app without contacting us.

CCPA/CPRA Rights (California Users)

California residents have the right to:

• Know what personal information is collected
• Request deletion of personal information
• Opt-out of the sale of personal information
• Non-discrimination for exercising privacy rights

We do not sell or share your personal information. We do not "sell" your data as defined by the CCPA, nor do we "share" it for cross-contextual behavioral advertising purposes. We have no advertising in our app and do not monetize your data in any way.

Sensitive Personal Information: Your menstrual health data is considered "Sensitive Personal Information" under California law. We only use this information for the purpose of providing the sCycle period tracking service that you requested. This data never leaves your device. We do not use your sensitive personal information for any secondary purposes, and therefore a "Limit the Use of My Sensitive Personal Information" option is not required.

Exercising Your Rights

For rights you cannot exercise directly in the app (such as feedback deletion), contact us at privacy@sapplify.com. We will respond within 30 days.

11. AI & Insights

sCycle includes AI-powered insights to help you understand your menstrual cycle patterns:

Local AI Processing

How Predictions Work

sCycle analyzes your historical cycle data to predict:

• Next period start date
• Fertile window (if tracking for fertility awareness)
• Expected symptoms based on cycle phase
• Cycle length variations and trends

These predictions are based solely on data you've entered and are generated entirely on your device.

Medical Disclaimer

sCycle's predictions and insights are for informational purposes only and should not be used as medical advice, contraception, or for diagnosing health conditions. Always consult a healthcare professional for medical concerns.

12. Children's Privacy

sCycle is intended for individuals who menstruate, typically aged 13 and older. We take special care to protect the privacy of younger users.

Age Requirements

• We do not knowingly collect personal information from children under 13
• In some EU member states, the minimum age for consenting to data processing may be higher (up to 16 years) in accordance with GDPR Article 8
• Users under the applicable age should use the app only with parental/guardian supervision

Privacy Protection for Young Users

• All data is stored locally on the device, providing maximum privacy protection
• No personal information is required to use the app
• No account creation or registration is needed
• Parents/guardians can help set up app lock and biometric protection

Parental Guidance

• Parents/guardians should review this privacy policy
• Help young users understand how to use the app safely
• Consider enabling app lock to prevent unauthorized access
• Monitor app usage as appropriate

If you believe a child under 13 has provided us with personal information through the feedback feature, please contact us at privacy@sapplify.com and we will delete it promptly.

13. International Users

sCycle is available to users worldwide. Since all health data is stored locally on your device and we do not collect or transfer any health data to external servers, there are no cross-border data transfer concerns for your health information.

Data Location

• Health Data: Stored exclusively on your device, in your jurisdiction
• Feedback Data: If you submit feedback, it is processed on servers in the European Union
• Payment Data: Processed by Apple/Google/Huawei in accordance with their respective privacy policies

Data Protection Standards

Regardless of where you are located, we apply high standards of data protection:

• Military-grade AES-256 encryption for all health data
• Secure key storage in hardware-protected enclaves
• No tracking or analytics
• Privacy-by-design architecture

Supported Languages

sCycle currently supports 15 languages:

• English
• German (Deutsch)
• French (Français)
• Italian (Italiano)
• Spanish (Español)
• Portuguese (Português)
• Dutch (Nederlands)
• Polish (Polski)
• Czech (Čeština)
• Slovak (Slovenčina)
• Turkish (Türkçe)
• Russian (Русский)
• Japanese (日本語)
• Chinese (中文)
• Korean (한국어)

14. Data Breach Notification

We take data security seriously. Since your health data is stored only on your device and never transmitted to our servers, server-side breaches cannot affect your health information.

Your Local Data

Data stored locally on your device is protected by:

• Device-level encryption and security
• sCycle's AES-256 encryption
• Optional biometric authentication

Your local data security depends on your device security. We recommend keeping your device updated and using strong authentication.

Feedback Data

In the unlikely event of a breach affecting feedback data you've submitted, we will:

• Assess the breach: Immediately investigate the scope and impact
• Notify authorities: Report to relevant data protection authorities within 72 hours as required by GDPR Article 33
• Notify affected users: Inform you without undue delay if the breach poses a high risk to your rights and freedoms (GDPR Article 34)
• Provide details: Nature of the breach, potential consequences, and measures taken

What We Will Communicate

• Description of the breach and data involved
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Recommendations for protecting yourself
• Contact information for follow-up questions

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, add new features, or comply with legal requirements.

How We Notify You

When we make material changes, we will notify you by:

• Posting an in-app notification when you next open sCycle
• Updating the "Last updated" date at the top of this policy
• Updating the privacy policy in app store descriptions
• Sending a notification (if you have notifications enabled)

Your Continued Use

Your continued use of sCycle after changes are posted constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should export your data and stop using the app.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your health data.

16. Governing Law

This Privacy Policy and any disputes arising from it are governed by the laws of the Slovak Republic, without regard to conflict of law principles. This does not affect your mandatory consumer protection rights under EU law, which may provide additional protections regardless of the governing law.

Jurisdiction

For users in the European Union, any disputes shall be subject to the jurisdiction of the courts in Slovakia, unless mandatory consumer protection laws in your country of residence provide otherwise.

EU Users

If you are located in the European Union, you have the right to lodge a complaint with your local data protection supervisory authority if you believe we have violated your data protection rights.

As we are based in Slovakia, our lead supervisory authority is:

Úrad na ochranu osobných údajov Slovenskej republiky
(Office for Personal Data Protection of the Slovak Republic)
Hraničná 12
820 07 Bratislava 27
Slovak Republic
Website: dataprotection.gov.sk
Email: statny.dozor@pdp.gov.sk

Dispute Resolution

We encourage you to contact us first at privacy@sapplify.com to resolve any concerns or disputes. We are committed to working with you to reach a fair resolution.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

Anthony Eli Rasch - sapplify
PO Box 004
91501 Nové Mesto nad Váhom
Slovakia

General Inquiries: contact@sapplify.com

Privacy & Data Protection: privacy@sapplify.com

We are committed to addressing your privacy concerns and will respond to your inquiry within 30 days.

Data Protection Inquiries

For specific data protection requests (access, deletion, correction of feedback data), please email us with:

• A clear description of your request
• Your email address (if you provided one when submitting feedback)
• Any relevant details to help us locate your data

We may need to verify your identity before processing certain requests to ensure the security of your data.