Effective: on first release of Cycle Sync 1.0 · Last updated: 29 August 2026
Cycle Sync is built to run on your phone. Your cycle, your symptoms, your check-ins, your recipes and your supplement plan live on your device, and the app works with no internet connection at all.
Seven things are exceptions, and they are the whole of this policy:
We do not sell your data, and we collect no location data at all. We do measure how the app itself is used, and we collect crash reports, so we can find what is broken or confusing. That measurement runs through Google Firebase and PostHog, and it records screens, taps and whether a subscription was bought, never anything you told the app about your body. Sections 12 and 12a list exactly what they cover, and Settings has a switch that turns both off.
Cycle Sync is published by Reachly Apps of 918 Tartan Trail, Highland Village, Texas 75077, United States ("we", "us"). We are the data controller for the personal data described in this policy. For any privacy question, to request your data, or to ask us to delete it, email [email protected] and put "Privacy" in the subject.
| What | Examples | Where it lives | Why |
|---|---|---|---|
| Sign-in details | The email address and optional first name your Apple or Google sign-in shares with us | Firebase Authentication | To give you an account your saves belong to |
| Cycle data | Last period start date, cycle length, period length, phase estimates | Your device, plus your account backup | The entire point of the app |
| How you feel | Reported symptoms, check-ins, cramp severity | Your device, plus your account backup | To suggest food that fits your phase |
| Food data | Saved recipes, swipes, meal logs, plate scan results, imported recipes | Your device, plus your account backup | Your kitchen, your history |
| Supplements | Products you added and what you typed from their labels | Your device, plus your account backup | To show your plan back to you |
| Meal photos | Downscaled plate scan photos | Your device only | So your history shows what you ate |
| Apple Health values | The named list in section 9, read only | Your device only | To save you retyping |
| Together preview | First name (optional), phase, cycle day, support suggestions | Firebase Firestore, shared with your invited partner | Partner sharing you turned on |
| Purchase state | Whether a subscription is active | Apple, mirrored on your device | To unlock premium |
| Preferences | Dietary preferences, allergies, reminders, focus nutrients | Your device, plus your account backup | To make suggestions fit you |
| Ad measurement | That the app was installed, and that a subscription was bought, with its price and currency. Never your cycle, symptoms, food, name or anything else | Meta (Facebook), Apple's SKAdNetwork | So we know which ad brought you here and stop paying for the ones that bring nobody. Section 12a, and you can switch it off |
| App usage and crashes | Screens opened, taps, errors shown, crash diagnostics, and that a subscription was bought with its price. Never your cycle, symptoms, weight, notes, meals or photos | Google Firebase and PostHog | To find the screens that confuse people and the bugs that break them. Section 12, and you can switch it off |
Not on this list because we do not collect them: precise or coarse location, contacts, browsing history, or anything from your photo library beyond the single photo you point the plate scan at. Your device's advertising identifier is never collected at all. See section 12a.
We also do not build, sell or license aggregated or "de-identified" datasets from your data. The only aggregate figures we ever see are Apple's own anonymous App Store statistics, such as download counts, which cannot identify you.
Everything in the table above that says "your device" is stored in the app's own container and is covered by iOS device encryption whenever your phone is locked. It is included in your own encrypted device or iCloud backup, the same way every app's data is.
You can export all of it as a JSON file from Settings, and you can delete all of it from Settings → delete all data. Deleting removes your profile, cycle information, check-ins, reminders, saved recipes, notes, swipe history, supplements, meal logs, meal photos and cramp logs from the device, and cancels every scheduled notification.
It does not stop at the device. The same tap deletes your account backup, ends any Together share you had turned on, and then deletes the sign-in record itself, so signing in again afterwards starts a genuinely new account rather than handing you the old one back. Because that last step ends your account for good, Apple or Google may ask you to sign in once more to confirm it is really you; if you close that prompt, everything else has still been deleted and only the sign-in record remains, and you can finish it by signing in and tapping delete all data again.
You can browse Cycle Sync without an account. To save anything, you sign in, with Sign in with Apple or with Google, because every save is backed up to your account. That is what makes your data come back on a new phone.
What we receive when you sign in: the email address your provider shares (Apple lets you hide yours behind a relay address) and, if you allow it, your first name so the app can greet you. We never see or store a password; Apple or Google handle that entirely.
What is backed up: the categories marked "your account backup" in section 2. That includes cycle dates, reported symptoms, check-ins, cramp severity, supplements, meal logs and saved recipes. Meal photos are not uploaded; only their file names travel, so a restore on a new phone simply shows those meals without a photo.
What this means in plain terms: with an account, your cycle and symptom history is stored on Google's servers as well as your phone. This is health-related personal data, and backing it up is the point of the account. You choose when that starts, because nothing is written until your first save.
operated by Google LLC), acting as our data processor under its Data Processing Addendum. Access from outside the app is controlled by Firestore security rules that restrict your data to your signed-in user id.
data, given when you sign in and save. You may withdraw it at any time by deleting your account.
company, so if you live elsewhere your backup is processed in the United States, whose privacy laws differ from your own; international transfers rely on Standard Contractual Clauses.
copy. Residual copies in Google's backups are purged on its normal cycle, within 90 days.
Together is optional. If you turn it on, Cycle Sync creates one code-protected record in Firebase Firestore. It contains only your optional first name, estimated cycle phase and cycle day, and general daily support suggestions. It does not contain your symptoms, check-ins, notes, meals, recipes, supplements, Apple Health data, or photographs.
The random pairing code works once and cannot be found by browsing or searching Firestore. The person who redeems it receives read-only access and cannot change your cycle. You can stop sharing from the Together screen at any time. Stopping it revokes future access and updates. Google Firebase handles encrypted network transport and storage. The app keeps a small copy of the same preview in an App Group container on your device so its Home Screen and Lock Screen widgets can change at midnight without opening the app.
Only invite someone you trust. Together copy describes possibilities, not facts: a phase estimate cannot establish how someone feels, and the partner view repeatedly tells the recipient to ask rather than assume.
The plate scan photographs a meal and names what is on the plate. It is the one feature in Cycle Sync where an AI model processes something of yours, so here is its entire data path.
What is sent: a downscaled JPEG of that photo (max 1024px on the longest side), and nothing else. No name, no profile, no cycle data, no symptoms, no health data, no account identifier, no advertising identifier, no device identifier.
Where it goes: to a server we operate on Cloudflare Workers, which passes the image to Google's Gemini model to be identified. The server exists so that the model's API key never ships inside the app.
What comes back: a list of food names drawn from a fixed vocabulary the app itself supplies, an optional rough gram estimate per food, and a rough amount phrase. Nothing else. Raw model output never reaches your phone.
What is kept at the other end: nothing. The photo is processed during the request and is not stored by us, by our server, or in any log we keep. Google processes the image to generate the response and does not use it to train its models under the terms of the paid API we use. Your photos and your data are never used to train AI models, by us or by anyone we send them to.
Where the photo lives on your phone: a downscaled JPEG copy is saved in the app's own container on your device and kept with the meal it belongs to, so your meal history can show you what you ate. It never leaves your phone again. It is not part of the account backup. It is deleted when you delete that meal, and every photo is deleted when you use "delete all data" in Settings.
If you use "fix the read", the same photo is sent once more with the note you wrote. If you take a photo while offline, it is held on your device so it can be read when you reconnect.
Nutrition figures are calculated on your phone, from a fixed table of approximate USDA FoodData Central values. The AI never produces a nutrient figure. The results are estimates, are labelled as such, and are not a medical measurement.
The recipe and article images in the app are AI-generated illustrations. They are our content, made before the app reached you; no user data is involved in creating them.
Food search. When you search for a food to quick-add, the first results come from a USDA catalog stored inside the app. If you are online, the food words you typed and the requested result count are also sent to our Cloudflare Worker, which forwards that search to USDA FoodData Central. No profile, cycle data, meal history, account identifier, device identifier or advertising identifier is included. The words are sent inside the request rather than in its web address. The Worker does not log or store the request body or response; successful responses may be cached privately on your device for one day so repeated searches feel immediate.
Barcodes. When you scan a barcode on a supplement bottle or a packaged food, the barcode number alone is sent to:
world.openfoodfacts.org), an open food database, andapi.ods.od.nih.gov), operated by theUS National Institutes of Health.
No photograph is sent. No personal information is sent. Photos taken while scanning a label are processed entirely on your device and never leave it.
These are independent services with their own privacy policies. We send them a number and receive a product record.
When you share a recipe link or a Pinterest pin to Cycle Sync, your phone fetches that page directly, the same way Safari would if you opened the link. For a pin, the app follows it to the page the pin points at, and downloads the recipe photo to keep as the recipe's picture on your device.
That means the website you are importing from, and Pinterest if the link is a pin, see an ordinary web request from your internet address. They see the same thing they would see if you visited in a browser, and their own privacy policies apply to it. Nothing goes through our servers, and nothing about you, your cycle or your account is attached to the request.
The imported recipe and its photo are stored on your device like any recipe you wrote yourself, and back up with your account like one too.
If you connect Apple Health, Cycle Sync reads these and only these:
protein and fibre, as already logged by you or by another app.
Cycle Sync never writes anything to Apple Health.
Health data read this way stays on your device and is used only to show your own numbers back to you and to keep your cycle dates accurate without retyping. In line with Apple's requirements, we never use Health data for advertising, marketing or data mining, and we never share it with third parties. It is not sent to our plate-scan server. If you have an account, values derived from Health that are stored in your profile, your cycle start date and confirmed ovulation date, back up with the rest of your profile as described in section 4. Apple Health readings are never placed in a Together share.
You can turn the connection off in Settings → apple health. Because Apple provides no way for an app to hand read access back, that screen also tells you how to revoke it in the Health app itself.
Subscriptions are handled by Apple. We never see your payment details, card number or billing address. We receive only whether an active subscription exists.
Reminders you set are scheduled locally on your device by the app. There is no push notification service behind them: their content is composed on your phone and never leaves it. You can turn them off in the app or in iOS Settings at any time, and iOS controls whether their content shows on your Lock Screen.
This section is about measuring the app itself, through Google Firebase and PostHog. Advertising is separate and is section 12a. Nothing in this section is used to track you across other apps or websites, and none of it reaches Meta or any other advertiser. We use it to find the screens that confuse people and the bugs that break them.
Both services receive the same events. Firebase is where crashes are read; PostHog is where we look at how far people get through the setup questions, because it can show the drop-off screen by screen and Firebase cannot. We do not use PostHog's session recording, which would capture what is on screen, and it is switched off in the app's code.
What is recorded: which screens you open and in what order, which tab you moved to, how far you got in the setup questions, whether you were shown the subscription screen and whether you closed it, which articles you opened and roughly how long you read for, error messages you were shown, whether a subscription was bought and its price and currency, and the technical details of a crash. Records carry your app version, device model and iOS version, and the anonymous per-install identifier each service assigns.
If you sign in, we tell PostHog that this install belongs to your account, using the same account identifier Firebase issues and nothing else. No email, no name, and none of your answers. It exists so that setup, which happens before you sign in, and a subscription bought afterwards are not counted as two different people. Signing out ends it.
What is never recorded, and this is the part that matters: nothing you tell the app about yourself. Not your period dates, cycle length or phase. Not your symptoms, check-ins or cramp severity. Not your weight, your name, your notes, your meals, your supplements, your Apple Health values or your photos. Articles are counted by their fixed catalogue id, which says what you read and nothing about you.
You can turn it off. Settings has a "help improve the app" switch. Turn it off and the app stops recording and stops sending, on that device, immediately. Everything else in the app continues to work exactly as before.
Who processes it and where. Firebase is operated by Google LLC and PostHog by PostHog, Inc., both acting as our data processors under their standard data processing terms. We use PostHog's United States cloud region, so these records are stored in the United States. International transfers rely on Standard Contractual Clauses, as in section 16a.
We have turned off Firebase's advertising features, and none of the data in this section is used for advertising or shared with data brokers. We do not build advertising profiles about you, and we do not sell personal information as that term is defined by the California Consumer Privacy Act. What we do share with Meta, and what that means under Californian law, is set out next.
We buy ads for Cycle Sync on Facebook and Instagram, and we need to know which of those ads actually brought someone who stayed. That is the only reason anything in this section exists.
What the app tells Meta, in full: that Cycle Sync was installed and opened, and that a subscription was purchased, with its price, its currency and which plan it was. That is the entire list. Meta also receives, as any app or website does, your IP address, your device model and your iOS version, and an anonymous identifier for this installation.
What Meta is never told: anything you have entered about yourself. Not your period dates, cycle length or phase. Not your symptoms, check-ins or cramp severity. Not your weight, your name, your email, your notes, your meals, your supplements, your Apple Health values or your photos. There is no version of this app in which your cycle data is sent to an advertising company.
We never ask to track you, because we never do. Cycle Sync does not show Apple's tracking prompt, and your advertising identifier is not collected under any answer, setting or subscription state. Meta therefore cannot connect what it is told to you personally. All ad measurement runs on Apple's SKAdNetwork, which reports campaign totals to us with no individual identity attached, and we do not track you across other companies' apps or websites.
Turning it off entirely. The "help improve the app" switch in Settings governs this section too. Turn it off and the app stops sending anything to Meta, on that device, immediately.
What Meta does with it. Meta acts as our processor for measurement, and separately as its own controller under its own data policy, which is at https://www.facebook.com/privacy/policy. We have no access to any other data Meta holds about you, and we cannot see who you are from anything Meta reports to us; the reports we get are campaign totals, not lists of people. We do not upload customer lists to Meta and we run no retargeting audiences.
Like every internet service, the servers that answer the app's few network requests see your IP address in order to reply to it. Ours use it for nothing else and do not log it.
The web pages this policy and our terms are published on are static. They contain no analytics, no advertising and no tracking pixels, and we set no cookies on them. They are served through Cloudflare, our network provider, which may set a strictly necessary security cookie to protect the site; it is not used to track you.
| Data | Kept until |
|---|---|
| Everything on your device | You delete the item, use "delete all data", or delete the app |
| Your account backup | You delete your account, then purged from residual backups within 90 days |
| Your sign-in record | You delete your account |
| The Together share | You stop sharing, or delete your account |
| A plate scan photo, server side | Never stored; it exists only for the seconds the request takes |
| A food search, server side | Never stored |
| The install and purchase events sent to Meta | Held by Meta under its own retention rules; we hold no copy beyond campaign totals |
| App measurement records in Firebase and PostHog | Held under each service's retention settings, and deleted on request under section 16 |
| Emails you send us | As long as needed to resolve the question, then routine deletion |
We keep no server-side logs of who scanned what, searched what, or ate what.
Data on your device is protected by iOS device encryption. Data in transit is encrypted with TLS. Backed-up data is encrypted at rest by Google Cloud, and access to it is restricted to your signed-in user id by Firestore security rules that we treat as production access control, not a formality. Together sharing uses those same rules plus a one-use, unlistable pairing code. Our plate-scan server holds no database and stores no images, which means there is no stockpile of photos or scans to breach. API keys for the AI model and the USDA database live only on that server, never in the app.
No system is perfect. If a breach ever puts your data at risk, we will tell affected users and the relevant regulator without undue delay, as GDPR Articles 33 and 34 and US state breach laws require.
Cycle data is sensitive in a way most app data is not, and we designed Cycle Sync so there is as little as possible for anyone to demand.
preview record.
If we receive a subpoena, court order or other legal demand for your data, we will require valid legal process, we will interpret every demand as narrowly as the law allows, and we will challenge demands that are overbroad or improper. Unless a law or court order forbids it, we will tell you before we produce anything, so you have the chance to object yourself. We do not volunteer user data to any government, and we have never been asked to.
You always hold the strongest protection yourself: deleting your account removes the backup, and "delete all data" clears your phone.
Wherever you live, you can ask us for a copy of your data, ask us to correct it, or ask us to delete it. The export and delete-all controls in Settings do most of this immediately for the copy on your device, and deleting your account in the app removes the cloud copy. For anything else, email [email protected] with "Privacy" in the subject. We will confirm your request within a few days, answer within 30 days, never charge for it, and never treat you worse for asking. Because we hold so little about you, we verify requests against your signed-in account email rather than asking you for more identity documents.
If you use an authorised agent to make a request, we will ask for evidence that you authorised them.
If we ever refuse a request, we will say why, and you can appeal by replying with "Appeal" in the subject; a different review will answer within 60 days, and if you are still unhappy we will tell you how to raise it with your state attorney general or supervisory authority.
We process your data on these legal bases:
| Processing | Basis |
|---|---|
| Running the app on your device | Performance of our contract with you (Art. 6(1)(b)) |
| Backing up health-related data to your account | Your explicit consent (Art. 9(2)(a)) |
| The Together share you turn on | Your explicit consent (Art. 9(2)(a)) |
| Answering a plate scan or food search you request | Performance of our contract |
| Measuring which ad brought you (section 12a) | Your consent, revocable at any time with the "help improve the app" switch in our Settings (Art. 6(1)(a)) |
| Keeping the service secure | Our legitimate interest in running it safely (Art. 6(1)(f)) |
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting prior processing. Withdrawing consent for backup means deleting your account, which the app lets you do directly. You may complain to your supervisory authority; in the UK that is the Information Commissioner's Office (ico.org.uk). We do not use your data for automated decision-making that produces legal or similarly significant effects. International transfers to our processors rely on Standard Contractual Clauses.
If you live in France, you may also give us instructions for what should happen to your data after your death, and we will follow them.
In the last 12 months we collected these categories of personal information: identifiers (sign-in email, optional first name); health information you chose to record (cycle dates, symptoms, check-ins); commercial information (subscription status only); and user-generated content (recipes, notes, meal logs). We collected them directly from you, for the purposes in section 2, and disclosed them only to the service providers named in this policy for the purposes named here. We do not sell personal information and we have no financial incentive programs tied to your data.
We do "share" personal information for cross-context behavioural advertising in one narrow way, in the CPRA's sense of that word: the install and purchase events described in section 12a, sent to Meta so it can measure and improve the ads we run. The categories involved are identifiers (an installation identifier, never your advertising identifier, which we do not collect) and commercial information (that a subscription was bought, and its price). No health or sensitive information is ever shared, and no category listed above is sold. To opt out, turn off "help improve the app" in Settings; it is honoured immediately and it changes nothing else about the app. We treat a Global Privacy Control signal reaching our web pages as a valid opt-out request as well.
Your cycle and symptom data is sensitive personal information under the CPRA. We use it only to provide the service you asked for, which is the use the law permits without a "Limit the Use of My Sensitive Personal Information" link; we offer no other use to limit.
You have the rights to know, to access, to correct, to delete, to portability, and to non-discrimination for exercising them. Exercise any of them in Settings, in the app's account screen, or by email as described above.
Cycle data is "consumer health data" under Washington's My Health My Data Act and Nevada's SB 370. Section 2 is our complete list of the consumer health data we collect; we collect it from you alone, use it only to operate the app, and share it only with the processors this policy names. No consumer health data is ever sent to Meta or to any other advertiser; section 12a is the complete list of what advertising measurement receives, and no part of it touches your body or your food. We do not sell consumer health data, and we will not, because there is no version of this app where that is acceptable. We do not use geofencing of any kind, let alone around health care facilities. You have the rights to access your consumer health data, to withdraw consent, and to have it deleted, exercised in the app or by email as described above.
If you live in Canada, we handle your data with your consent, which this policy asks for in plain words and which you may withdraw at any time by deleting your account. You have the rights to access and correct your data, and to complain to the Office of the Privacy Commissioner of Canada or your provincial regulator. Because saving requires an account, declining to sign in simply leaves the app in browse-only mode; nothing is collected either way. If you live in Quebec, you also have the right to data portability, which the JSON export in Settings satisfies, and the right to ask us to stop disseminating your data, which is easy to honour because we never disseminate it.
If you live in Texas, the Texas Data Privacy and Security Act gives you rights to confirm, access, correct, delete and port your data, and to appeal a refusal; the appeal route above satisfies that, and if you are still unhappy you may contact the Texas Attorney General. Similar laws in Virginia, Colorado, Connecticut, Utah, Oregon and other states give you materially identical rights, and we honour them all the same way: we hold your data to run the app for you, we sell nothing, we profile nobody, and you can see, take or erase what is yours whenever you choose.
Cycle Sync is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child under 13 has provided us data, email us and we will delete it. Cycle Sync is a teen-and-up app under App Store age ratings.
If we change this policy in a way that materially affects how your data is handled, we will raise the effective date above and tell you in the app before the change applies to you. Earlier versions are available from us on request.
Cycle Sync provides general wellness and nutrition information. It does not diagnose, treat, cure or prevent any disease, it never recommends a supplement dose, and it is not a substitute for advice from a qualified clinician. Cycle phase information is an estimate. Talk to a doctor or pharmacist before changing what you take, especially if you are pregnant, breastfeeding, or on prescription medication.