Family Cycle Privacy Policy

Family Cycle is a family app for understanding menstrual cycles — built so parents, especially dads, can support the people they love. That means we hold some of the most personal information a family has. This policy says exactly what we collect, exactly who can see it, and exactly what we will never do with it. It is written to be read, not skimmed past; it is short because we collect little.

The one-paragraph version

We collect the minimum the app needs: names, period dates, account emails, and — only if you choose to write one — a line saying what someone uses, for the shopping. Everything is visible only inside your own family, according to rules each person controls. We never sell data, never show ads in the app, carry no analytics or advertising code in the app, and never share health data with anyone except the service that stores it for us (Google Firebase, in the United States, under contract). You can delete anything — a log, a profile, or your whole account — from inside the app.

What we collect

For account holders (a parent, or an invited family member):

• Email address and a sign-in credential. With Sign in with Apple you can hide your real email; we only ever see what you choose to share.
• Your role in the family (parent, or a member linked to her own profile), and when you joined.
• The name you type to sign an authorization, kept with the record of your consent.

For each tracked profile (a daughter, or an adult who claims her profile):

• A first name or nickname — whatever the family enters.
• Period start and end dates, and the cycle phases we estimate from them. This is health information and we treat it that way.
• For a profile whose owner is invited to log for herself: her birth month and year, collected once at the invitation step, used only to route her to the right experience for her age.
• Optionally, one line saying what she uses — a brand and a size — so whoever does the shopping has it to hand. You choose whether to write one at all, it is never required, and you can clear it at any time. For a grown woman's profile, only she can write or clear it. It is health information and we treat it that way. It never appears in a notification, and we send it nowhere: tapping "Buy on Amazon.com" or "Buy on Walmart.com" opens a plain product search on that retailer's own site, in your own browser, with no tracking code of ours attached. We earn nothing from anything you buy.

For the family, if it has the family plan: whether the plan is on, when it renews or ends, whether it will renew, what Apple will charge when it renews, Apple's identifier for the subscription, and which account in the family started it. Never a card or any other payment detail: Apple processes the payment, and we never see it. When someone starts the plan, we email them when it started, when the free trial ends or the plan renews, what Apple will charge, and how to cancel. Before each yearly renewal, we email whoever pays for it twice, about five weeks and about three and a half weeks ahead, with the date, what Apple will charge and how to cancel. We keep a record of each email: what it said, which account it went to, and when. It holds nothing about anyone's cycle, and we keep it three years, as the proof that we told you. When someone starts the plan, we also keep a record that they agreed to its renewal: every word the offer showed them, which account agreed, Apple's identifier for the purchase, and when. It holds nothing about anyone's cycle either, and we keep it until three years after the plan ends.

For the family, if its adults use its share code: the code itself, and how many months it has earned and not yet used. On our server only, never shown in the app: when each month was earned, and, for a family that typed someone's code, which family's code it was. That last record says one family told another about Family Cycle, so we treat it as health information. Nobody in either family can read it: the family that shared is told only how many months it has, and the family that typed the code is told nothing about whose it was. If you shared your code with only one person, though, a month being added will tell you she subscribed. The record goes when either family is deleted.

Records of consent: who agreed to what, when, and which version of the words they saw. We keep these because they are the proof that the family's visibility choices were each person's own.

A record when a grown woman's profile is deleted by someone other than her: which profile and family, whose account deleted it (or that we did, for an account nobody had opened in two years), and when. It holds none of her dates and not her name. We keep it two years, so that if she asks who deleted her profile, there is an answer.

What we do not collect: location. Symptoms or notes (the app logs dates only). Contacts. Photos. Advertising identifiers. Analytics events. We do not use HealthKit. Notifications are scheduled on your own phone — reminder timing never touches our servers.

Who can see what — the honest heart of this app

Family Cycle's whole purpose is that your family sees each other's weeks. That visibility follows rules the app enforces, not just describes:

• A parent can see every profile in the family, and can log dates for a child's profile.
• A daughter (13+) with her own sign-in sees only herself — never a sibling, never the family roster. Her own screen tells her plainly that the adults in her family — her parents, and anyone they invite as a parent — can see her dates, including any they add for her, and can get a heads-up about her week. She agrees to that before her sign-in is linked to the family, and she can stop at any time.
• An adult with her own profile decides for herself. Once she claims her profile, her family can read her week — that is the point of a shared calendar — but nobody can log, correct, or delete her entries except her, unless she alone turns on "let my family log for me." Whether her family gets reminders about her week is a second switch only she can turn on. Reminders are worked out on each family member's own phone from the calendar they can already see, so that switch decides what the app tells them, not what they can see. Nothing about an adult is shown to the family until she has claimed her profile and agreed.
• An under-13 child never uses the app. Her profile is managed entirely by her parents; a parent enters the dates on her behalf. She has no sign-in, and the app has no surface that collects anything from her.

Nobody outside your family can see any of it. Families are isolated from each other by security rules that we test against every release.

What we never do

• We never sell personal information, and never will. Under laws that define "sale" broadly (including trading data for anything of value), we still don't.
• We never show ads in the app, and never share any information — health or otherwise — with anyone for advertising or marketing. We may advertise Family Cycle itself on Google and Meta (Facebook and Instagram). When we do, we choose broad groups to show the ads to — women 25 to 54 in the United States, search words a parent might use, and the platforms' own categories for parents and married people — and the platform decides which of its users fit them, from its own information. Nothing about you or your family goes to any ad platform from us: the app and our website contain no advertising pixels, tags or code, and we never upload email addresses or any other list. If you tap one of our ads, the platform knows that under its own privacy policy. We get back only totals, such as how many people saw or tapped an ad and, from Apple, how many downloads came from each ad, and we keep them only as totals.
• We never use third-party analytics on health data. The app ships with no analytics or advertising code at all; the one thing like it is the technical information Google's libraries send about themselves, described under "Service providers".
• We never use your family's information to train AI, and the app's guidance content is human-written, never generated from your data.
• We never apply a material change to this policy retroactively. If we ever wanted to use existing data in a new way, we would ask first, separately, and take no for an answer.

Service providers

Your family's information is stored and sent electronically, and is disclosed electronically only to the people and the one service provider this policy names. One company processes data on our behalf: Google, whose Firebase services store and run the app in the United States: authentication, the Firestore database, Cloud Functions (which carry out deleting an account or a profile, leaving a family, a daughter's withdrawal from logging for herself, a parent's withdrawal of consent through the App Store, recording the family plan from what Apple tells our server, and the share code: making each family's code, recording it when another family types it, counting the months it earns, and asking Apple to add them to the plan), and App Check (which lets our servers tell a genuine copy of the app from an imitation, using a proof from Apple that carries nothing about you). They work under Google's data-processing terms, which bind Google to process the app's data only on our instructions and to protect it to the same standard we promise here, encrypted in transit and at rest. Google is not permitted to use your family's data for its own purposes.

Google's Firebase libraries, which the app uses for those services, also send Google technical information about themselves, such as the kind of device, its system version, the app's identifier and the libraries' versions. Google says it uses this only to see which versions are in use and never links it to a person or a device. It contains no health information, and we receive none of it. Google's servers log the network address each request comes from. When the app asks our server to do something, such as deleting an account, the logs also record which request it was, and our server notes the account it acted for. These logs keep the service running and safe. Our server's logs are deleted after 30 days; Google keeps its own sign-in logs for a few weeks.

The family plan is sold through the App Store. Apple processes the payment and tells our server, with its own signature, whether the plan is on and when it renews; we never see your payment details.

Our website, familycycle.app, has no cookies, analytics or trackers. The company that hosts it handles each visit, including the network address it comes from, to serve and protect the site, and we see only how many visits there were each day. We keep those counts only as totals and never try to find out who visited. If the host ever challenges a visit it suspects is automated, it may set a short-lived security cookie for that visit.

We have notified Google that we are a vendor of personal health records under the FTC's Health Breach Notification Rule, which obliges Google to tell us of any breach on its side so we can tell you.

Retention and deletion

Short version: we keep data while you use the app, and delete it when you delete it. The full schedule — every data type, how long, and why — is published at Data Retention Schedule. Nothing is retained indefinitely.

Deletion is in the app, not behind a support email:

• Any logged period can be corrected or deleted.
• A profile can be deleted, along with every log it holds, by whoever keeps the family's dates. While someone in the family signs in to a profile — a daughter with her own sign-in, or a grown woman — it stays, except that a grown woman can delete her own at any time. Once she has left the family, or before she ever joined, it can be deleted like any other, and we keep a record of who deleted it and when, with none of her dates, for two years.
• Your whole account can be deleted from account settings. That removes your sign-in (including revoking Sign in with Apple tokens) and the data associated with it, per the retention schedule. If you are the last parent, deleting your account deletes the family — the app tells you exactly what will be lost before you confirm. If the family plan is still paid up then, we keep Apple's identifier for it, and the date, for up to a year, with nothing that says whose it was, so that a family you set up again with the same Apple account can use what you've paid for.
• An account nobody has opened for two years is deleted the same way, 30 days after its notice, which we email where it chose email for important notices; opening the app keeps it. The retention schedule has the details, and the one account we keep: a family's last parent, while anyone else in the family still uses the app.

One exception, which federal law makes for every online service: if a government agency lawfully asks us to preserve a named account's records (18 U.S.C. §2703(f)), we keep a copy for up to 90 days, or 90 more if the request is renewed, even if the account is deleted meanwhile, and delete it when the hold ends. Our law-enforcement policy says what anyone must show us before we hand anything over.

Consent, and taking it back

Health information enters this app only after the person it belongs to — or, for a child, her parent — has agreed on a screen that names the data, the purpose, and exactly who will see it, and has signed, by typing her name, an authorization for Flood Stage LLC to share it with her family. Saying no is the plain option on that screen, it changes nothing, and after a no we never ask again on our own — you come back to it only if you choose to. An authorization lasts a year at most. Before it ends, the person who signed it is asked on her own screen whether to renew it; if it ends, her family stops seeing those dates until it is signed again, and nothing is deleted. A copy of every authorization you sign is in Account, to save or send. We keep a record of each answer: who decided, which words they read, the authorization signed and the name typed to sign it, and when. A parent's consent covers only a child: if a profile saved as a child's turns out to be an adult's, correcting it deletes what was entered for her and records that the parent's consent never applied to her.

Withdrawing is a first-class action, not a support ticket: an adult can stop family logging or leave; a daughter can stop logging for herself from her account screen, which leaves her dates with her parents exactly as they were before she had her own sign-in, unless she chooses to take the days she logged herself (any her parents logged stay with them); deletion (above) is always available. We keep a record of a withdrawal as we do of a consent. Withdrawal stops future collection and visibility; it doesn't undo the past by itself — pair it with deletion if that's what you want.

After a daughter under 18 says no to logging for herself, or stops, we don't ask her again for a year: for that year her family can send her a new invitation only if she has asked them for one. She can come back whenever she asks.

Children

We designed the app around a simple line: we never collect anything from a child under 13. A young daughter's profile is managed by her parents; the data about her is entered by them, seen by them, and deletable by them. She has no sign-in, and no part of the app is directed to her.

At 13, a daughter may be invited by a parent to log for herself. Her birth month and year are asked when she brings in her invitation, before she signs in, on a screen that suggests no answer. Under 13, the invitation cannot proceed, no sign-in is made, and nothing about her is kept; her phone remembers only that the invitation was refused, and until when, so it can't be retried there with a different answer. If she signed in first, that sign-in is closed. If she is 13 or older she reads exactly what her parents will see before anything is linked, and saying no is the plain option. When she turns 18, her profile converts to the adult model: her data becomes hers to control. Once she agrees, her family can see her week on the shared calendar, but can't log for her or get reminders about her unless she turns those on.

Where the law requires it, the app also asks the App Store. In the states that require apps to check age through the app store — Texas today, and Utah, Louisiana, Alabama and California in 2027 — the app asks the App Store whether the person setting up a family or accepting an invitation is an adult, a teen or a child. It uses that answer once, on the phone, to decide whether they can go on, and keeps none of it: it is never sent to us or stored. Someone under 18 can't set up a family or join as a parent; someone under 13 can't use the app at all; a daughter's invitation weighs the App Store's answer with the one she gives, and the younger of the two decides. Everywhere else, nothing is asked.

In those states a parent can also withdraw consent through the App Store. So that we can honour it, when a daughter of 13 to 17 joins there we keep the App Store's identifier for her download — a number Apple assigns, and nothing else about her — in a record only our server reads. If her parent withdraws consent, Apple tells us, the app stops opening on her phone, her sign-in leaves the family, her dates stay with her parents as they were before she had her own sign-in, and her sign-in is deleted. The identifier goes with her account. And if a version of the app makes a significant change, a parent in those states is asked to approve it before she uses it.

Your rights

We grant the same rights to everyone, in every state, because building fifty versions of respect is how companies end up respecting no one:

• Access: see the data held about you or the children you're responsible for. The app itself shows all of it, and Account → Download a copy of your data gives you a file of everything it keeps that you can see, with the list of who it is shared with; or ask us.
• Deletion: as above, in-app, including our processor's copies and backups per the retention schedule.
• Withdrawal of consent: as above.
• Correction: fix any date in the app, or ask us to.
• A real reply: ask from inside the app, or email privacy@familycycle.app from the address you sign in with, and we'll answer within 45 days, free, in plain words. A deletion is carried out within 30 days, and consent you withdraw by email stops within 15. If a request needs longer than 45 days, we'll tell you so, and why, within those 45, and answer within 45 more. If we can't confirm a request is yours, we'll tell you what we need. If we refuse something, we'll say why, and you can appeal by replying; appeals are answered within 45 days by taking a second, documented look. If you're unsatisfied after that, you can contact your state Attorney General — Washington: www.atg.wa.gov/file-complaint; Nevada: ag.nv.gov/Complaints/CSU_Complaints___FAQ/; Connecticut: portal.ct.gov/ag/common/complaint-form-landing-page.

The person a profile describes is who holds its rights. A parent exercises them for an under-13 child. A teen or adult exercises her own.

If something goes wrong

If health information is ever acquired or disclosed without authorization — whether by a security failure or by our own mistake — we will tell the affected people directly and without unreasonable delay (at most 60 days), tell the FTC as the law requires, and say plainly what happened, what data was involved, who got it, and what we are doing about it. When you first sign in, the app asks whether notices like this may reach you by email — your primary contact — and you can change that any time in Account.

Tracking

We do not track you, on the app or anywhere else. There is no advertising identifier use, no cross-site or cross-app tracking, and nothing for a "Do Not Track" or Global Privacy Control signal to turn off — the answer is already no.

Changes

We'll post changes here with a new effective date. Material changes get in-app notice before they take effect, and any change that would use already-collected data in a new way requires your fresh, separate consent first. In the states whose app-store laws require it, a change that needs a parent's approval applies to a daughter only once her parent has approved it in the App Store. We keep every earlier version of this policy, and we'll send you any of them if you ask.

Contact

Email privacy@familycycle.app about your privacy and your rights, and support@familycycle.app about anything else.

Flood Stage LLC, Illinois, USA