Pirai

1. Plain-language summary

The detailed text below is the legally operative version. The summary is provided for convenience only.

2. Who we are and how to contact us

The data controller for the purposes of GDPR and analogous laws is Sowmiya B, Chennai, Tamil Nadu, India. You can contact us about this policy or any data-protection question at piraitracker@gmail.com.

We have not appointed a representative in the EU or the UK under GDPR Article 27 / UK GDPR. That article applies to controllers who process the personal data of people in those territories from outside them. The App transmits nothing to us: we receive no data, hold no account, and run no server, so there is no such processing for a representative to be contacted about. If that ever changes — if any future version of the App sends data to us — we will appoint a representative and name them here before that version ships.

3. What data the App processes

The App processes the following categories of data, all locally on your device:

3.1 Sensitive health data (GDPR Article 9 / "special category")

• Menstrual cycle data: period start and end dates, flow intensity, bleeding type, days bleeding lasted.
• Symptoms you log (e.g. cramps, headache, fatigue, mood states).
• Optional measurements: basal body temperature (BBT), weight, sleep duration, water intake, cervical mucus observations, sexual activity (none / protected / unprotected).
• Pregnancy data (if applicable): last menstrual period (LMP), estimated due date, kick session counts, hospital-bag checklist, birth-plan free text, scheduled appointments.
• Postpartum data (if applicable): delivery date, breastfeeding status, pre-pregnancy cycle baseline snapshot.
• Peri-menopause data (if applicable): self-reported start date, hysterectomy status, menopause-confirmation state.
• Hormonal-contraception context: method, start/stop date, post-stop flag.
• Medications and supplements you choose to track: the name and dose text you type, the times and days you want to be reminded, optional start and end dates for a course, an optional remaining-quantity count used for refill warnings, and whether that reminder should behave as an alarm.
• Appointments you add: a label, the date and time, your own notes, and how far ahead you want to be reminded.
• A record of each reminder occurrence and what you did with it — taken, skipped, snoozed, or no response before the reminder lapsed — kept so the App can show you your own adherence history.

3.2 Personal data

• Your date of birth (used to compute age and tailor age-appropriate content, including a "first-period" mode for users under 17).
• An optional display name you may enter during setup. Used only on the PDF-export report header. You can leave this blank.
• Your free-text journal entries and notes.

3.3 Configuration and preferences

• App-mode selection (period tracker, planning for baby, pregnancy, postpartum, peri-menopause).
• Reminder times and on/off toggles.
• Notification text customisations.
• Theme preference (light, dark, system).
• App-lock PIN length and biometric preference.
• One-time onboarding flags ("you have seen this screen").
• Where you turn on automatic backups: the folder you nominated (the identifier and display name your device's file provider reports for it) and the time of the last successful automatic backup.

3.4 Authentication secrets

• A salted hash of your App-Lock PIN (the PIN itself is never stored).
• A randomly generated database encryption key, stored in your operating system's keystore (Android Keystore / iOS Keychain).
• Where — and only where — you turn on automatic backups, the backup passphrase itself and the optional reminder hint you may save alongside it, held in the same keystore. See Section 5a.

3.5 Data we do not process

• No real name (beyond an optional display name you may type).
• No email address, phone number, or other contact identifier.
• No precise or coarse geolocation.
• No advertising ID (IDFA / GAID).
• No contacts, calendar, photos, microphone, camera, or other device content.
• No biometric data — biometric unlock uses an OS prompt; the App never receives or stores fingerprint / Face ID templates.
• No analytics events, crash reports, telemetry, or usage statistics.
• Payment information: We do not collect or store credit card details. If you use paid features, transactions are handled by the Apple App Store or Google Play Store. We may process anonymized subscription tokens or transaction IDs provided by these platforms to manage your access to features.

4. Where the data lives and how it is stored

• All data described in Section 3 is stored on your device, in an encrypted SQLite database (SQLCipher, AES-256) located in the App's private storage area. It goes nowhere else, except where you switch on one of the optional backup features in Sections 5a and 5b, which move an encrypted backup file — never the database itself.
• The encryption key never leaves the device's hardware-backed keystore (Android Keystore on Android, Keychain with kSecAttrAccessibleAfterFirstUnlock on iOS).
• The App does not request the Android INTERNET permission. On iOS, the App's NSAppTransportSecurity configuration blocks all outbound network traffic. As a result, the App is technically unable to transmit your data to any server, and we operate no servers that would receive it.
• The App enables FLAG_SECURE on Android to prevent screenshots and screen recordings while open. On iOS, an overlay obscures the App in the multitasking switcher.
• We do not use cookies, web beacons, or other tracking technologies.

4a. Automatic on-device copies (snapshots)

So that a failed app update or a damaged database file does not cost you your history, the App keeps a small number of copies of the encrypted database in its own private storage:

• One rolling copy per day (the three most recent are kept), one taken immediately before any database schema upgrade (the two most recent are kept), and — if the database ever fails to open — the file that failed, set aside instead of deleted so that it can be recovered.
• Each copy is the same SQLCipher-encrypted file, openable only with the key held in your device's keystore. The copies are never transmitted, are excluded from Android's backup service on every Android version, and are deleted when you uninstall the App.
• If the App cannot open your database at startup, a recovery screen lists these copies and lets you restore from one or delete them.

5. Backups you create

You may choose to export an encrypted backup file (.ctbk) or an encrypted PDF report (.pdf.enc) from the App. When you do:

• The file is encrypted on your device with a passphrase you choose (AES, with the key derived from your passphrase). We never see, receive, or have access to your passphrase — we operate no servers and nothing is transmitted to us.
• The App then hands the file to your operating system's share sheet. Where it goes from there (cloud drive, email, messaging app, local folder) is your choice. Once the file leaves the App, the privacy properties of the destination service apply, not ours.
• If you lose the passphrase, the file is unrecoverable. We cannot reset, recover, or bypass it.

5a. Automatic backups (optional, off by default)

You may choose a folder and have the App save an encrypted backup there once a day without being asked each time. This is off until you turn it on.

• Because nobody is present to type a passphrase when an automatic backup runs, the App stores your backup passphrase on your device when — and only when — you switch this feature on. It is held in the operating system's protected keystore (Android Keystore / iOS Keychain), the same place the database encryption key lives. It is never written into a backup file and never transmitted anywhere. Turning automatic backups off deletes it.
• If the folder you pick belongs to a cloud app (OneDrive, Nextcloud and similar), that app syncs the file according to its own policies. The App itself still has no internet permission and makes no network connection; it only writes a file to a folder you nominated.
• The Settings screen states plainly whether your chosen folder actually leaves the device, so that a folder on internal storage is not mistaken for protection against losing the phone.

5b. Copying backups to your Google Drive (optional, off by default)

On Android you may opt in to letting Android's own backup service carry a copy of your encrypted backup file to the Google Drive of the account signed in on your phone. This is off unless you turn it on, and it is the only feature in the App that results in your data being stored anywhere other than your device.

• The transfer is performed by the operating system, not by the App. The App has no internet permission and opens no connection.
• Only the encrypted .ctbk backup file is eligible. Your health database, your app-lock PIN, and your settings are excluded on every Android version.
• The file is already encrypted with your passphrase before Android touches it. On Android 9 and later Android additionally encrypts your backup with your device PIN before it leaves the phone, so Google cannot read it.
• Turning the option off deletes the staged file, so nothing further is carried.

6. Notifications and alarms

The App schedules local notifications and exact alarms on your device for: cycle predictions, medication reminders and refill warnings, appointment reminders, ovulation-predictor-kit reminders (opt-in), pregnancy-test reminders (opt-in), and wellness reminders (morning sun, evening wind-down).

• These notifications are scheduled and delivered by your device's operating system, not by any server we operate.
• Notification text is deliberately discreet by default (e.g. "Daily check-in") to avoid leaking cycle information to anyone glancing at your lock screen. You can customise the text.
• You may mark an individual medication reminder as an alarm. An alarm repeats until you answer it and, if you also allow it, can turn the screen on and appear over your lock screen. What appears there is limited to the words "Medication reminder" and the Taken / Snooze buttons — the medicine name and dose are never shown on the lock screen and stay behind your App Lock. On Android 14 and later this requires a permission you are asked for separately; refusing it means the reminder simply arrives as an ordinary notification.
• Your answer to a reminder (taken, skipped, snoozed, or no answer) is written to the encrypted database on your device, as described in Section 3.1. Nothing about it is transmitted.

7. Why we process this data (lawful basis under GDPR)

Where GDPR or analogous laws apply, our lawful basis for processing your data is:

• Performance of a contract / provision of the service (Article 6(1)(b)): we process your inputs only because you have asked the App to track them.
• Your explicit consent (Article 9(2)(a) — for special-category data): by entering health-related information into the App, you explicitly consent to its on-device processing for the purpose of presenting it back to you. Nothing is transmitted to us or to any third party, so this consent does not extend to anyone else. Where you switch on an optional backup feature (Sections 5a, 5b), you are choosing to place an encrypted file with a provider of your own choosing, and your relationship with that provider governs it.

You can withdraw consent at any time by deleting your data (Section 9) or uninstalling the App. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8. Who we share data with

No one. The App does not transmit your health or personal data off your device. We operate no server, employ no service providers who would process your data, and integrate no third-party SDK for analytics, advertising, or crash reporting.

If you choose to export a backup or PDF report, you are the one sharing the file. The recipient's handling of that file is governed by their own practices, not ours. The same applies to the optional features in Sections 5a and 5b: where you have switched them on, an encrypted backup file is handled by a cloud app you chose or by Android's own backup service, under that provider's terms — never by us, and never through any connection the App makes.

Payment-related metadata (e.g., subscription status) is managed by your platform provider (Apple or Google) and is subject to their respective privacy policies.

We will not sell, rent, lease, or otherwise share your personal data, and we cannot do so because we do not have it.

9. Your rights

You have the following rights under GDPR, UK GDPR, CCPA / CPRA, and analogous laws. Because all your data is on your device, you can exercise most of them directly inside the App:

For users in California (CCPA / CPRA):

• We do not "sell" or "share" personal information as those terms are defined under California law.
• The categories of personal information we collect on-device are listed in Section 3.
• You may exercise access and deletion rights as described above.

If you cannot exercise a right through the App itself, contact us at piraitracker@gmail.com and we will assist.

10. Children's data

The App offers an age-appropriate "first-period" mode for users under 17, derived from the date of birth you enter.

• The App is not intended for use by children under 14 years of age without parental supervision.
• We do not knowingly collect personal information from children below that age beyond what the user enters themselves to operate the App on their own device. Because we receive nothing — the App cannot connect to the internet and we run no servers — no data about a child is ever received by us.
• Parents or guardians may delete a child's data at any time via Settings → Erase all data or by uninstalling the App.

Under the United States Children's Online Privacy Protection Act (COPPA), the App is not directed to children under 13. We collect no personal information from anyone, child or adult, because nothing the App holds is ever transmitted to us.

11. Reproductive-health considerations

This App was designed with the threat model that menstrual and reproductive data may, in some jurisdictions and contexts, be subject to legal compulsion. To minimise risk:

• We hold no copy of your data on any server we operate. A subpoena to us would produce nothing relevant because nothing relevant exists outside your device.
• The data on your device is encrypted at rest. Without your device's unlock credential and (where you enable it) the App's PIN or biometric, the data is not readable.
• Every backup the App writes is passphrase-protected, so even a backup file that ends up in someone else's hands is unreadable without your passphrase.
• Consider this before switching on either optional off-device feature (Sections 5a and 5b): a backup file synced by a cloud app, or carried to Google Drive by Android, exists on that provider's systems and is subject to that provider's policies and to legal process directed at them. It remains encrypted with your passphrase, which they do not have. If your threat model includes compelled disclosure by a cloud provider, keep both features off and keep your backups on media you control.

11a. Law-enforcement and third-party requests

If we receive a request from law enforcement, a court, or any other third party for your data:

• We have nothing to give. We operate no server and receive no data from the App, so there is no account, no database, and no backup in our possession to search, disclose, or preserve. The only truthful answer we can give to such a request is that no responsive data exists.
• We cannot decrypt anything. Backup files are encrypted with a passphrase we never see and cannot recover or reset, and the database key never leaves your device's keystore. A demand that we unlock either is one we are technically unable to satisfy — not one we decline.
• Requests to others are outside our control. If you have switched on one of the optional backup features in Sections 5a and 5b, a request may be directed at your cloud provider rather than at us. What they hold, how they respond, and whether they tell you is governed by their policies, not ours. That is one more reason to read Section 11 before switching either feature on.

12. Data retention

• We retain no data, because we receive no data.
• Data on your device is retained until you delete it or uninstall the App.
• The automatic on-device copies described in Section 4a rotate on their own: three daily copies and two pre-upgrade copies are kept, and older ones are deleted as new ones are made. A copy set aside after a failed start is kept until you act on it, because nothing else would recover it.
• After Settings → Erase all data, the App deletes every row, destroys the encryption key held in the OS keystore (together with your App-Lock PIN hash and any stored backup passphrase), and removes the database file. Any automatic copy made before the erase remains on disk as a file until it rotates out or you uninstall the App, but the key that could open it no longer exists anywhere, so its contents cannot be read again — by you, by us, or by anyone else.
• Backup files you exported, and files written to a folder you nominated for automatic backups, are outside the App's control and are not touched by Erase all data. Delete those yourself if you want them gone.

13. Security

We protect the data on your device using:

• AES-256 full-database encryption (SQLCipher).
• A device-bound encryption key stored in the OS keystore (Android Keystore / iOS Keychain), never written to disk in plaintext.
• An optional App-Lock layer requiring a 4- or 6-digit PIN and/or biometric authentication before the UI is visible.
• Screen-capture suppression (FLAG_SECURE on Android, multitasking overlay on iOS).
• Passphrase-derived AES encryption for user-exported backup files.
• Where you enable automatic backups, your backup passphrase stored in the OS keystore rather than in application storage — see Section 5a.
• Automatic on-device copies that stay inside the App's private storage and remain encrypted under the same device-bound key — see Section 4a.

14. Permissions the App requests

We do not request: internet access, location, contacts, calendar, camera, microphone, photos, broad storage access, advertising identifier, or any other sensitive permission.

The App has no general file-system permission. If you set up automatic backups, you pick one folder in your device's own file picker and the system grants the App access to that folder only, so that it can write backup files there. You can withdraw that access at any time by turning automatic backups off, or from your device's settings.

15. International users

The App processes data locally on your device, wherever you are. We do not transfer your data across borders because we do not transfer your data at all.

16. Changes to this policy

We may update this policy from time to time. When we do, we will:

• Update the "Last updated" date at the top.
• For material changes affecting how your data is handled, surface a notice in the App on next launch and require you to acknowledge it before continuing.

The current version of this policy is always available within the App under Settings → Privacy & lock → Privacy policy, and on this page.

17. Questions

For any question about this policy or our data-protection practices, contact piraitracker@gmail.com.