Privacy Policy

The short version

• Everything you log stays on your phone by default. You don’t need an account to use Aely.
• Your data only leaves your phone if you choose to: to back it up to your account, or to share a summary with a partner.
• We don’t sell your data, we don’t show ads, and there is no advertising or analytics tracker in the app.
• You can export your history, stop syncing, or delete everything at any time.

Who is responsible for your data

The publisher of Aely, identified on our Legal notice page, is the data controller for the processing described in this policy.

For any question about your data, write to privacy@aelycycle.app.

Data that stays on your phone

When you use Aely without an account, what you enter is stored only in the app’s storage on your phone: your cycles and periods, daily logs (flow, symptoms, mood, energy, sleep, notes and tags), ovulation and pregnancy tests, pregnancy tracking, streaks, reminders and your profile (first name, age, goal, contraception method and preferences).

This data never reaches our servers, and we have no way to see it. It disappears if you use Reset all data or uninstall the app. Your phone’s own backups (iCloud or Google) may include it, under the terms of Apple or Google.

Reminders are scheduled locally on your phone. Predictions, patterns, reports and PDF exports are all computed on your phone too.

Data we process when you use optional features

Your account

An account is optional. You can create one with Sign in with Apple or Sign in with Google. We then receive, through Firebase Authentication, a technical account identifier, your email address (or the private relay address Apple provides), your name if the provider sends it, and the dates of sign-in.

• Why: to identify you across devices and enable backup, Partner Mode and restoring your subscription.
• Legal basis: performance of the service you ask for (article 6(1)(b) GDPR).

Cloud backup

Backup is off by default and only starts after you turn it on. When it is on, the following is copied to your account: periods and cycle data, daily logs (flow, symptoms, notes and tags), predictions history, ovulation and pregnancy tests, pregnancy tracking (including its outcome if you record one), pregnancy logs and weekly notes, streaks, reminders and your profile (first name, age, goal, contraception method, notification and discreet mode settings).

• Why: so your history is safe and follows you to a new phone.
• Legal basis: your explicit consent, because this is health data (articles 6(1)(a) and 9(2)(a) GDPR).
• Who can read it: only you, signed in to your account. Our security rules prevent anyone else from reading it, including a partner you share with.
• Turning it off: stops any new upload straight away. The copy already backed up stays on your account until you delete your account, or until you ask us to erase it by writing to privacy@aelycycle.app.

Partner Mode

Partner Mode is optional, requires an account and an Aely+ subscription, and only starts when you invite someone.

While it is on, your phone sends a short daily summary to our servers: current phase and cycle day, predicted next period, fertile window and ovulation, and today’s period flow, mood, pain, energy, sleep and headache. During pregnancy tracking, it sends the week of pregnancy and the due date instead. We keep only the latest summary.

From that summary, our servers build your partner’s view with only the categories you switched on. Your notes, custom tags and intimate health entries are never part of it. While pregnancy tracking is active, your partner sees the week of pregnancy and the due date.

We also store the name you give your partner, the link between your two accounts and your sharing settings. Invitation codes expire after 3 minutes. Your partner can join without creating a full account: in that case we create an anonymous account for them.

• Why: to show your partner the view you chose and send them the alerts you enabled.
• Legal basis: your explicit consent (articles 6(1)(a) and 9(2)(a) GDPR).
• Ending it: when you revoke access, or your partner leaves, the link, the summary and the shared view are deleted and your partner loses access immediately.

Notifications

Partner alerts are sent with Firebase Cloud Messaging. For that, we store a notification token for each device taking part in Partner Mode. Tokens unused for 270 days are deleted automatically. With discreet mode on, notifications use neutral wording.

Aely+ subscription

Payments are handled entirely by the App Store or Google Play. We never see your payment card details.

Subscription status is managed with RevenueCat. RevenueCat receives an anonymous identifier generated by the app (or your account identifier once you sign in), your purchase history, the product, the store and the renewal or expiry dates. We keep a copy of your subscription status linked to your account so the app knows which features to unlock.

• Why: to sell, renew and restore your subscription.
• Legal basis: performance of the contract (article 6(1)(b) GDPR).

When you contact us

If you write to us, we use your email address and message only to answer you, and keep them for as long as needed to handle your request. We will never ask you to send your health logs.

What we never do

• We don’t sell, rent or trade your data.
• We don’t use it for advertising or share it with data brokers.
• The app contains no advertising, analytics or tracking SDK.
• We don’t make automated decisions about you that have legal or similarly significant effects. Predictions are computed on your phone, for your information only.

Where your data is stored and who helps us

• Google Firebase (Google Ireland Limited and Google LLC): accounts, backup, Partner Mode and notifications. Our database is hosted in the European Union (Belgium and the Netherlands) and our server functions run in Belgium.
• RevenueCat, Inc. (United States): subscription management.
• Apple and Google: sign-in and app store purchases, under their own privacy policies.
• Cloudflare, Inc. (United States): hosting of the aelycycle.app website.

These providers act on our instructions and are bound by data processing agreements. When data is transferred outside the European Union, it is protected by the European Commission’s standard contractual clauses or by an adequacy decision such as the EU-US Data Privacy Framework.

How long we keep your data

• On your phone: until you reset the app, delete it or delete your account.
• Account and backup: until you delete your account.
• Partner Mode: the latest summary and the shared view until sharing ends. Expired invitations and rate-limiting records are purged daily.
• Anonymous partner accounts: deleted after 180 days without use, unless still linked.
• Notification tokens: deleted after 270 days without use.
• Subscription status: until you delete your account. Apple and Google keep their own purchase records.

When you delete your account, all the data described above is erased from our database. Copies may persist for a limited time in the encrypted backups of our providers before being overwritten.

Your rights

You have the right to access, correct and erase your data, to restrict or object to its processing, to receive it in a portable format and to withdraw your consent at any time, without affecting what was done before.

Many of these rights are built into the app: edit your profile, export your history as a PDF, turn off backup, end Partner Mode, reset your phone or delete your account. For anything else, write to privacy@aelycycle.app. We answer within one month.

You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or the authority of the country where you live.

Teens and minors

Aely can be used from age 10 without an account, with everything kept on the phone. In France, a person under 15 cannot consent alone to the processing of their health data online. Before 15, creating an account, turning on backup or using Partner Mode requires the consent of a parent or legal guardian.

Some content and features adapt to your age: certain library articles, contraception reminders, conception mode and fertile window sharing are only available from 15. If we learn that an account was created without the required consent, we delete it.

Security

Data is encrypted in transit between the app and our servers, and encrypted at rest by our providers. Access to backed-up data is restricted to your own account by security rules checked on the server. No system is perfectly secure, so we also recommend protecting your phone with a passcode.

The aelycycle.app website

The website does not use advertising or analytics cookies and does not track you. Fonts are served from our own domain. Cloudflare processes technical data such as your IP address to deliver the pages and protect the site against attacks.

Changes to this policy

We update this policy when the app or the law changes, and change the date at the top. If a change significantly affects how your data is used, we will let you know in the app before it applies.

Contact

Email: privacy@aelycycle.app. Publisher details are on our Legal notice page.