Privacy policy
The short version. There’s no account. What you enter in Period Pals stays on your iPhone, and we never receive it. When you use pals, what you share with them is encrypted on your phone before it leaves, so our server can pass it on but can’t read it. There are no ads, no analytics and no tracking.
If you join the waiting list on our website, we keep your email address for one purpose: to tell you when you can join.
What stays on your phone
Everything you enter: your period days, check-ins, moods, how you feel, notes, your gardens, your companions and your settings. It is stored in the app on your iPhone. Like other app data, it is included in your iPhone’s own backup (in iCloud or on your computer, if you use one), which is protected by your Apple account. We don’t have a copy and can’t see it.
If you use Save a backup in Settings, the app makes a file with your data and you choose where it goes. We never receive it.
What passes through our server when you use pals
Pals need a way to reach each other, so Period Pals uses a small server we run (the “relay”). It is only used once you invite a pal or accept an invitation.
Invitations
An invitation is locked on your phone with its invitation code before it is sent to the relay. The code itself only travels in the message you send to your pal; the relay doesn’t receive it. Invitations are deleted after 7 days, or after 90 days for an invitation given as a present, or as soon as they’ve been used.
What you share with a pal
Each pal receives the name you use in the app, how you’re doing (a sticker based on your daily mood, which also shows when you’re on your period), the things you’ve said help on harder days, and, unless you turn it off for that pal, when your next period is due. They also receive whatever you choose to send them, such as stickers and notes. Pals never see your garden, your notes to yourself or your history. All of this is encrypted on your phone with a key that only your phone and your pal’s phone share (ECDH P-256 key agreement with AES-256-GCM, using the encryption built into iOS). The relay stores these sealed messages until your pal’s phone collects them, then deletes them. A message that is never collected is deleted after 30 days.
If you join as someone’s pal without tracking yourself, the same applies the other way: your name and what you send reach only their phone, sealed in the same way.
The relay doesn’t know your name, your pal’s name or what’s in a message. Each phone has an anonymous mailbox identified only by a random number.
Notifications
If you allow notifications, your phone gives the relay a device token from Apple, so it can ask Apple to show “Something arrived in Pals.” when a pal sends you something. The notification text is always the same and says nothing about you or the message. The token is deleted when you turn notifications off in the app, when you use Delete everything, or when Apple reports that it is no longer valid. Notifications are delivered by Apple’s Push Notification service.
Network addresses
Like any server, the relay sees the IP address of a phone that connects to it. We use it only to limit how often invitation codes can be tried and messages sent, to prevent abuse. These counters are deleted after 15 minutes. We don’t keep request logs.
The relay runs on Cloudflare’s network (Cloudflare, Inc.), which processes this technical traffic on our behalf to deliver and protect it.
Where this happens
Cloudflare operates data centres worldwide, including in the United States, and handles the relay’s traffic in the one nearest to you. Cloudflare does this under its data processing agreement, which includes the standard safeguards for transfers abroad. Notifications go through Apple’s notification service, which is part of iOS and covered by Apple’s own privacy policy.
The waiting list
On periodpals.app you can leave your email address to hear when you can join. We keep only the address and the day you left it, and we use it only to tell you when you can join Period Pals: when the beta opens, and later when it’s in the App Store. That’s at most a few emails. No newsletter, no marketing, no tracking in the emails, and we never share the list.
The list is stored on the same Cloudflare service as the relay. We delete it once the App Store email has gone out, and we remove your address earlier whenever you ask: write to hello@periodpals.app or reply to any of our emails. We keep your address because you asked us to (your consent), and you can withdraw that at any time.
What we don’t do
- The app has no accounts and never asks for an email address or a phone number.
- No analytics, advertising or tracking tools, and no third-party code that collects data.
- We don’t sell or share your data, and we can’t read your health information.
During the beta
While Period Pals is in beta, it is distributed through Apple’s TestFlight. If the app crashes, or if you send feedback from TestFlight (for example a screenshot with a comment), Apple passes this on to us together with basic technical information such as your device model and iOS version, and, depending on how you joined, your name and email address. We use it only to fix problems and improve the app. Apple’s TestFlight terms and privacy policy apply to TestFlight itself.
Deleting your data
- Everything at once: in the app, open Settings (the gear on Today) and tap Delete everything. This removes all your data from the phone, lets your pals’ phones know you’ve left, and deletes your notification token from the relay.
- Deleting the app also removes its data from your phone. Copies in older iPhone backups are handled by Apple and replaced over time.
- Sealed messages waiting on the relay are deleted automatically within 30 days.
Health information
Period and mood data is sensitive. That’s why Period Pals is built so we never receive it in a readable form. Period Pals is not a medical device and not a method of contraception. Predictions are estimates based on your past cycles.
Children
Period Pals is not directed at children under 13.
Your rights
Depending on where you live, you have rights over your personal data, such as access, correction and deletion, and you can complain to a data protection authority (in Switzerland, the Federal Data Protection and Information Commissioner). Because we don’t hold data that identifies you, there is usually nothing for us to look up, but write to us with any question and we’ll answer.
Who is responsible
Gabriel Esposito, Zollikon, Switzerland. Email: hello@periodpals.app
Changes
If this policy changes, we’ll update it here and change the date at the top. If a change affects what leaves your phone, we’ll also tell you in the app.