Barsuk e.U., Auhofstrasse 245A/5A, 1130 Vienna, Austria. Contact for privacy requests: info@barsukai.com.
Ciclunia stores all entries (cycle, period, symptoms, temperature, mood, weight, sleep, medication, notes, photos) on your device. The app uses no analytics or tracking services and sends no crash reports containing content. Apart from the photo transfer described in section 3, no data is transferred to us or third parties. Photos are downscaled, stripped of location metadata and stored encrypted with a device-bound key.
You can export your data as JSON or CSV at any time and remove everything with "Delete all my data".
Photos you add in Ciclunia are also transferred to us to improve the app. This feature is on by default. It is shown to you during setup in the step "Your data is yours" and can be switched off there and at any time under Profile → Privacy & data → "Share photos to improve Ciclunia". Completing setup with the switch on counts as your consent; date and status are stored on your device.
Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR (consent to processing health data), given by completing setup after the disclosure was shown.
Data shared: the photo (downscaled, without metadata such as location), the category you chose (e.g. skin, belly) and the cycle day of the photo. Each photo is linked to a random pseudonym generated on your device.
Never shared: name, birth year, calendar dates, notes, other entries, device identifiers, advertising ids.
Purpose: analysing photos to improve the app's documentation and comparison features and to develop new functions. No sharing with third parties, no training of third-party models without a separate consent.
Transfer and storage: encrypted (HTTPS) to a server under our control hosted by Hetzner Online GmbH, data centre Falkenstein, Germany. Access is restricted to the developer of Ciclunia.
Retention: until revocation, at most 24 months after transfer, then automatic deletion.
Revocation: at any time by switching sharing off in the app. All photos shared so far are then deleted from our server. Deleting a single photo in the app deletes its shared copy as well. "Delete all my data" also deletes all shared photos. Revocation does not affect the lawfulness of processing carried out before it.
Reminders are generated locally on the device and contain no cycle data.
Notifications (optional), Internet (exclusively for photo transfer under section 3). Photos are selected through the system photo picker or the camera, without access to your whole gallery.
Access, rectification, erasure, restriction, data portability, withdrawal of consent and complaint to a supervisory authority. Because local data exists only on your device, you exercise these rights for local data directly in the app. For shared photos contact info@barsukai.com and state your pseudonym (shown under Profile → Privacy & data) or use the in-app revocation.
Changes to this policy are published in the app and at this location.