Family Cycle — Consumer Health Data Privacy Policy

This policy covers "consumer health data" — for Family Cycle, that means menstrual-cycle information. It exists so that what we do with that data is stated in one place, plainly.

Categories of consumer health data we collect

• Period dates: the start and end dates of menstrual periods, entered by hand.
• Derived cycle information: the cycle phases, predictions, and confidence levels our software estimates from those dates. This is inferred health data and we treat it with the same care as what you typed.
• What she uses, if anyone writes it: one optional line naming a brand and a size, so whoever does the shopping has it to hand. It is never required and can be cleared at any time. On a grown woman's profile only she can write or clear it. We count this as health data rather than a shopping note, because a brand and an absorbency say something about a person's body, and we would rather over-protect it than argue about the category.
• That one family told another about Family Cycle, if a family types another's share code: a record on our server naming both families, so a month can be added to the plan of the family that shared once the other has paid. It holds no dates, but using a cycle app is itself health information, so we count it here. Nobody in either family can read it: the family that shared is told only how many months it has, and the family that typed the code is told nothing about whose it was. If a family shared its code with only one person, a month being added will tell it she subscribed. The record goes when either family is deleted.
• That a family's plan was still paid up when the family was deleted: Apple's identifier for the subscription, and the date, so a family set up again with the same Apple account can use what it already pays for. Nothing in it says whose it was, but Apple can match the identifier to an Apple account, so we count it here. It goes when a family takes the plan up, when Apple tells us the plan has ended, or a year after the deletion.
• That a grown woman's profile was deleted by someone other than her: which profile and family, whose account deleted it (or that we did, for an account nobody had opened in two years), and when. It holds none of her dates and not her name, but it says she had a profile here, so we count it here. It goes two years after the deletion.

That is the entire list. We collect no symptoms, no moods, no biometrics, no location, no browsing behavior, and nothing from any other app or device.

Sources

One source: members of your own family, by hand. A person logs her own dates; a parent logs a child's dates on her behalf; an adult may allow her family to log for her. Nothing arrives from third parties, sensors, or other apps. The one record that comes from another family is a share code's: when a family types yours, the record linking the two comes from them. The record of a plan still paid up when its family was deleted comes from what Apple tells our server, and the record of a woman's profile deleted by someone else from our server, as it deletes it.

Purposes

We collect and use consumer health data for exactly one purpose: showing your own family where each person is in her cycle and how to be supportive about it — the dashboard, the calendar, the plain-language forecast, and optional reminders scheduled on your own phone. The record a share code makes has one use of its own: adding a month to the plan of the family that shared, and taking it back if the payment that earned it is refunded. The record of a paid-up plan has one too: letting a family set up again with the same Apple account use the plan. So does the record of a deleted profile: telling her, if she asks, who deleted it and when. We do not use any of it for advertising, marketing, analytics, research, AI training, or anything else.

Sharing, and the affiliates and third parties involved

We do not share consumer health data with third parties, with two narrow, necessary exceptions:

1. Our processor. Google LLC stores the app's data (Firebase Authentication and Cloud Firestore, United States region), and its Cloud Functions carry out deleting an account or a profile, leaving a family, a daughter's withdrawal from logging for herself, a parent's withdrawal of consent through the App Store, recording the family plan from what Apple tells our server, and the share code: making each family's code, recording it when another family types it, counting the months it earns, and asking Apple to add them to the plan. It does all of this under data-processing terms that bind it to act only on our instructions. Google is a service provider here, not a recipient free to use the data.
2. Your own family, which is the product working as intended: the people in your family account can see what the visibility rules — described below and enforced by the app — allow them to see. We treat this as the service you asked for, and we still put it in front of you at consent time, because you should never have to deduce who can see your health data.

The "Buy on Amazon.com" and "Buy on Walmart.com" buttons are not a third exception, and here is exactly what they do. If someone has written a line saying what she uses, her profile offers a button for each retailer. Tapping one opens a plain product search on that retailer's own site, in your own browser, carrying that line as the search term and nothing else. We do not send it; your browser fetches the page, the same as if you had typed the words yourself. There is no tracking code, no affiliate tag and no referral identifier of ours in those links, we receive nothing back about what you searched or bought, and we earn no commission on any of it — not from Amazon, not from Walmart, not from anyone. We chose it that way deliberately: a referral fee would mean handing a retailer the fact that a cycle-app user is shopping, in exchange for money, and we are not willing to do that for any price. The buttons say "Buy" because that is honestly where they take you, not because we have any stake in what happens next.

We have no affiliates. We do not sell consumer health data and never will — under Washington law a sale would require your separate, signed authorization, and we will never ask for one.

Who in a family can see what

• A parent sees every profile in the family and can log for a child.
• A daughter (13+) with her own sign-in sees only her own data, and is told plainly that the adults in her family — her parents, and anyone they invite as a parent — see it too, and can get a heads-up about her week; she agrees to that before her sign-in exists.
• An adult's data is visible to the family only after she claims her profile and agrees; only she can write it unless she alone enables shared logging, and the family gets reminders about her week only if she alone turns that on. Reminders are worked out on each family member's phone from what they can already see, so that switch decides what the app tells them, not what they can see.
• An under-13 child's profile is parent-managed; she never uses the app.

Consent

Consumer health data enters the app only after a separate opt-in consent — not buried in terms of service — that names the data, the purpose, and exactly who will see it. The person the data describes gives that consent herself if she is 13 or older; a parent or legal guardian gives it for a younger child. Sharing it with her family also takes a signed authorization: the screen names Flood Stage LLC as the one sharing, what it shares, with whom and for what, ends it within a year, and is signed by typing a name. For a profile under 18 it is her parent's or legal guardian's that lets her family see her dates. Before an authorization ends its signer is asked to renew it; if it ends, her family stops seeing her dates until someone signs again, and nothing is deleted. A copy of each is in Account. Declining is the prominent option on the screens a person answers for herself, and weighs exactly the same as agreeing on the one a parent or guardian answers for a child; either way it changes nothing else about your account, and a no is never re-asked on our initiative. An adult's profile set up by someone in her family holds no health data at all until she joins and enters her own. If a profile saved as a child's turns out to be an adult's, correcting it deletes whatever was entered for her, and we keep a record that her parent's consent never applied to her.

Your rights

Anyone whose consumer health data we hold — including a person whose data was entered by someone else in her family — can:

• Ask what we hold about her, and receive a copy, including the list of anyone it was shared with (see above: Google, and the family members the visibility rules allowed). From inside the app, Account → Download a copy of your data makes that copy at once; or ask us.
• Withdraw consent for collection or for family visibility, from inside the app, at any time. A daughter who stops logging for herself may take the days she logged with her; any her parents logged stay with them, as her family's calendar. Her stopping is recorded, as her consent was, and for a year she is asked again only if she asks.
• Correct her data: fix any date in the app, or ask us to.
• Delete her data: individual entries, a whole profile, or an account, from inside the app. Deletion reaches our processor and its backups on the timeline published in Data Retention Schedule — we act within 30 days, and backup copies age out within 6 months at the outside.

Requests made outside the app — email privacy@familycycle.app from the address you sign in with — are answered within 45 days, free. A deletion is carried out within 30 days, and consent withdrawn by email stops within 15. If a request needs longer than 45 days, we will tell you so, and why, within those 45, and answer within 45 more. If we can't confirm a request is yours, we will tell you what we need. If we refuse a request, we will say why, and you can appeal by replying; appeals get a documented second review within 45 days. If the appeal leaves you unsatisfied, you may contact your state Attorney General — Washington: www.atg.wa.gov/file-complaint; Nevada: ag.nv.gov/Complaints/CSU_Complaints___FAQ/; Connecticut: portal.ct.gov/ag/common/complaint-form-landing-page.

The rights above belong to the person the data describes. A parent exercises them on behalf of a child under 13.

Security

Consumer health data is protected by per-family isolation rules enforced by our database and tested against every release, encryption in transit and at rest, and access restricted to the app's own functioning. Our written security program governs administrative access; no third-party analytics or advertising code exists in the app to leak anything, and the technical information Google's libraries send about themselves holds no health data.

Geofencing

We collect no location data, and we do not and will not operate any geofence — around health care facilities or anywhere else.

Changes and contact

Changes are posted here with a new effective date; material changes get in-app notice, and no change uses previously collected health data in a new way without fresh consent.

privacy@familycycle.app

Flood Stage LLC, Illinois, USA