Privacy Policy

We collect what you give us directly, and what the app generates as you use it:

• Account: email address and password (handled by our authentication provider, Supabase — we never see or store your password in plain text).
• Profile: first name, last name, date of birth.
• Cycle & health data: last period start date, typical cycle length, whether your cycle is irregular, hormonal contraception use, and PCOS or endometriosis status (diagnosed, suspected, or not sure).
• Goals: what you’re training for or working towards, including event type and date, or a health-management focus.
• Daily logs: anything you choose to log — overall feeling, energy, mood, motivation, sleep quality and timing, bleed days and heaviness, symptoms, positive experiences, water intake, and free-text notes.
• Preferences: dietary restrictions, exercise location, and activity level.
• Conversations with Liv: the messages you send our AI coach and her replies, including any plan changes or symptoms you mention in chat.
• Generated content: the weekly plans Liv builds for you, and the cycle phase insights shown on your dashboard.
• Payment information: we never see or store your card details. Subscriptions are handled entirely by Stripe — we hold only a Stripe customer reference and your subscription status.
• Technical data: standard authentication session cookies needed to keep you signed in. We do not currently use analytics, advertising, or third-party tracking cookies.

For cycle and health data specifically (a “special category” under UK/EU GDPR Article 9), our legal basis is your explicit consent, which you give during sign-up and can withdraw at any time by deleting your account. For everything else needed to run your account and generate plans, our basis is contractual necessity — we can’t provide the service without it.

• To calculate your cycle phase and generate personalised training, nutrition, and sleep recommendations.
• To power conversations with Liv, including remembering context across a session so she can act on what you tell her.
• To detect patterns in how you feel across your cycle, so recommendations can shift from general research towards your own data over time.
• To process payments and manage your trial or subscription.
• To operate, secure, and improve the app.

We don’t sell your data, and we don’t share it for advertising. We use a small number of processors to run the app, each of whom only receives what they need to do their job:

• Supabase — hosts our database and handles authentication. All of the data described above is stored here, protected by row-level security so only you (and, where technically necessary, our systems acting on your behalf) can access your records.
• OpenAI — powers Liv. When you chat with Liv or generate a plan, relevant context (your cycle phase, goal, dietary restrictions, recent logs, and conversation) is sent to OpenAI’s API to generate a response. OpenAI processes this under its API data usage policy and does not use API data to train its models. For chat conversations, we ask OpenAI to delete the stored response record immediately after each turn completes; plan generation doesn’t create a stored record on OpenAI’s side in the first place. Where OpenAI retains anything beyond this, it’s governed by their own data retention policy, not ours.
• Stripe — processes payments and manages subscriptions. Stripe receives your payment details directly; we never handle your card number.

Some of these processors may store or process data outside the UK and EEA (for example, in the United States). Where that happens, they do so under appropriate safeguards, such as standard contractual clauses.

We keep your data for as long as your account is active, so Liv can keep learning from your history and building progressively on past weeks. If you delete your account, we permanently delete your profile, cycle and health data, logs, chat history, and generated plans. Some minimal records (such as that an email address previously used a free trial) are kept to prevent abuse of trial offers, and anything we’re legally required to retain — for example, payment records for tax purposes — is kept only as long as the law requires.

Under UK/EU data protection law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data — most of this you can edit directly in your profile.
• Delete your account and all associated data, at any time, from your profile page.
• Withdraw consent for processing of your health data (which, practically, means deleting your account, since that data is core to the service).
• Request a copy of your data in a portable format.
• Object to or restrict certain processing, and lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office).

To exercise any of these rights beyond what’s available in your profile settings, email coachyourcycle@gmail.com.

Your data is protected by row-level security policies at the database level, meaning access is restricted to your account by default. Authentication is handled by Supabase Auth. No system is perfectly secure, and we can’t guarantee absolute security, but we take reasonable technical measures to protect your information and do not store payment card details ourselves.

HerRhythm is not directed at, and should not be used by, anyone under 16. We do not knowingly collect data from children under 16.

If we make material changes to how we handle your data, we’ll update this page and, where the change is significant, let you know directly.

Questions about this policy or your data? Email coachyourcycle@gmail.com.