CycleAlign Privacy Policy

Last updated: October 2026

CycleAlign ("we", "our", "the app") is a cycle-awareness and planning app. This policy explains what information we collect, why, and the rights you have over it. We built CycleAlign to compute as much as possible directly on your device — most of your cycle predictions never touch our servers at all. CycleAlign adapts to how your body actually works: if your cycles are irregular or changing, it does not force you into a 28-day pattern, and it learns from what you tell us about your energy, sleep and focus instead.

Health disclaimer: CycleAlign offers general wellness and productivity guidance based on hormonal cycle patterns. It is not a medical device and does not provide medical advice, diagnosis, or treatment, it does not diagnose PCOS, PCOD, perimenopause or any other condition, and it is not a form of contraception. Always consult a qualified healthcare professional for medical concerns, symptoms, or reproductive health questions.

What we collect

• Account information: name, email address, and authentication data if you sign in with Google or Apple.
• Cycle data: period start/end dates, average cycle and period length — used to compute your phase predictions.
• Daily check-ins: energy level, mood, and optional notes you choose to log ("Quick Log"). If you choose to add more detail, this can also include focus, decision confidence, sleep quality and hours, stress, symptoms you notice, and bleeding. Every one of these extra fields is optional.
• About you (optional): how predictable your cycles are and a short description of your situation (for example PCOS/PCOD, irregular cycles, perimenopause, postpartum). This is information you choose to give us so we can personalise recommendations. It is not a diagnosis, and you can change or remove it at any time in Profile.
• Task and calendar data: task categories you plan (never task descriptions unless you type one), and — only if you explicitly connect it — access to your Google, Outlook or Apple Calendar to score existing events against your cycle phase and, only when you tap a suggested date and confirm, to move that event to the date you chose.
• Sensitive information: cycle, sleep, symptom, bleeding and health-context details are health-related, so we treat them as sensitive. They are used only to give you your own guidance, are protected by account-level access rules, and are never used for advertising or sold.
• AI Coach conversations: if you use "Ask Align", your questions and the coach's replies are stored to your account and used to generate contextual answers.

Google user data — what we access, how we use it

CycleAlign's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access: if you choose to sign in with Google, we receive your basic profile information (name, email address) to create and authenticate your account. If you choose to connect Google Calendar (entirely optional, and separate from sign-in), we request access to view and edit your calendar events (Google OAuth scope https://www.googleapis.com/auth/calendar.events). We read event titles and times to score them, and we change an event's date only when you tap a suggested date and confirm it. We never create or delete events, and calendar data is never shared or sold.
• How we use it: your Google profile info is used solely to sign you in. Your Google Calendar data is used solely to display your existing events inside CycleAlign and score them against your cycle phase or your own check-in patterns, so you can see which days may be more demanding. CycleAlign never creates or deletes any event on your Google Calendar. It changes an existing event's date or time only when you tap a suggested better time and confirm it, and it never reads data from calendars you haven't explicitly connected.
• Who we share it with: your Google profile and Calendar data are not shared, sold, rented, or transferred to any third party — including our AI Coach ("Ask Align"). The AI Coach never receives your Google Calendar data or Google profile information; it only receives information you've entered directly into the app, such as a summary of your check-ins (see "Where it's processed" below).
• How it's protected: your Google Calendar events and the Google Calendar access tokens stay on your device only, in the app's private storage. They are never uploaded to our servers. The app talks to Google directly over HTTPS/TLS. The only Google data on our servers is the name and email address from Google sign-in, kept in our Supabase database, encrypted in transit (HTTPS/TLS) and at rest, and protected by row-level security so only your own account can access it.
• Retention & deletion: calendar events are kept on your device only while Google Calendar is connected. Tapping Disconnect on the Plan tab immediately deletes the stored events and access tokens from your device and stops all further access, and uninstalling the app removes them too. You can also revoke CycleAlign's access at any time at myaccount.google.com/permissions. Your Google sign-in name and email are kept while your account is active. Deleting your CycleAlign account (in-app or by emailing us, see "Delete your account" in Support) permanently removes them from our servers within 30 days.

Limited Use compliance statement: the use of raw or derived user data received from Google APIs by CycleAlign will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data — raw, aggregated, or derived — to train, develop, or improve any AI or machine-learning model, ours or any third party's.

How we use it

Your data is used solely to power CycleAlign's features: phase predictions (only where your cycle is a reliable input), task and meeting timing recommendations, personalized insights and patterns drawn from your own check-ins, and the AI coach. We do not sell your data, and we do not use it for third-party advertising. The optional in-app shop never influences the timing recommendations we give you.

Where it's processed

• On your device: cycle predictions, phase calculations, and task scoring are computed locally.
• Supabase (our backend provider): stores your account, profile answers, cycle logs, and daily check-ins so you can restore your data across devices.
• Google / Apple: used only for sign-in authentication, if you choose those options.
• Anthropic (Claude): if you use the AI Coach, your question and the context you've chosen to share (such as your cycle phase where your cycle is a reliable input, and a summary of how you're doing today — energy, sleep, focus) are sent to Anthropic's API to generate a response. Your calendar events are never sent. Anthropic does not use this data to train their models under our agreement with them.

What other people can see

• Partner Mode: entirely optional and controlled by you. Your partner sees only a short, general message about how you're doing and, if you switch it on, your cycle phase. They never see your logs, symptoms, bleeding, health context or calendar, and they cannot change your calendar or profile. You can switch sharing off or disconnect at any time.
• Community: your posts do not include any health information. Your cycle phase appears on a post only if you switch that on for that single post; your day of cycle, health context and symptoms are never shared.
• Clinician summary: if you choose to export a summary of what you've logged to take to a healthcare professional, it is created on your device and shared only through the share menu when you tap it.

Your rights

Wherever you are, you have the right to:

• Access — request a copy of all personal data we hold about you.
• Rectification — correct inaccurate data (editable directly in-app).
• Erasure — delete your account and all associated data permanently, available directly in the app under Privacy Settings, or by contacting us.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — stop any data processing at any time, including notifications and cloud sync.
• Lodge a complaint — with your local data protection authority if you believe we've fallen short.

Data retention

We retain your data for as long as your account is active. If you delete your account, your data is permanently removed from our servers within 30 days.

Children's privacy

CycleAlign is not directed at children under 13, and we do not knowingly collect data from children under 13.

Changes to this policy

We'll update the date at the top of this page if this policy changes, and notify users of material changes in-app.

Contact us

Questions about this policy or your data: hellocyclealign@gmail.com