Last updated 7 September 2026
You are about to tell an app when you bleed, how you sleep, when you have sex and how you feel. We think you should know exactly where that goes before you type a word of it.
So this policy is written to be read, not to be survived. It says what stays on your phone, what leaves it, and who else touches it. Where the answer is less private than you might hope, we say so plainly rather than let you assume otherwise.
The short version. Almost everything stays on your phone, encrypted. Three things leave it: messages you send to the AI assistant, your location if you ask Ovaa to find a pharmacy, and an anonymous identifier for this copy of the app. We never sell your data, never show ads, and use no analytics or tracking SDKs at all.
Everything you log lives on your device, encrypted with AES-GCM under a key held in the iOS Keychain: your period dates, flow, pain, moods, symptoms, discharge, sleep, energy, appetite, activity, water, medications, intimacy notes, journal entries and tags. So do your profile and settings — an optional display name, cycle averages, goals, birth control method and condition tags.
Tracking, the calendar, insights and predictions all run on the device. They work with no account and no internet connection at all.
When you send the assistant a message, that message and a short cycle summary go to our servers so it can be answered. There is no way to answer you without sending it, and we would rather say that than imply otherwise.
We do not store your conversation transcripts. What we keep is a short summary of your preferences, so the assistant does not ask you the same thing twice.
The cycle summary is deliberately thin: current cycle day, phase estimate, recent symptoms and moods, your goal and condition tags. It never includes your name, your exact dates, or anything you wrote in your journal.
If you never open the assistant, none of this happens.
If you ask Ovaa to find a nearby pharmacy or clinic, your coordinates go to our servers, which query a mapping service on your behalf. Your location is never sent straight to that third party, and we do not store it afterwards.
On first launch Ovaa registers an identifier for this copy of the app so we can count installs and help you if something breaks. It is derived from an identifier Apple gives us for our own apps, and we cache it in the Keychain so it survives deleting and reinstalling. That makes it more persistent than the system default, which is why we declare it on our App Store privacy label rather than quietly rely on it.
It is not an account and it is tied to nothing about you — not your name, not your email, not one byte of your health data. Separately, the app holds a random identifier for its own requests, which is erased when you delete the app.
Only the AI assistant asks you to sign in. Everything else in Ovaa works signed out, permanently.
When you sign in, Apple may hand us your name and email address. We receive them and throw them away without storing either. What we keep is a one-way pseudonym derived from Apple's opaque account identifier — a number that identifies your account to us and nothing else. We chose it this way deliberately: a name in this database would be the difference between a stolen file being a pile of numbers and being a list of named women with their menstrual and mental-health history attached.
Ovaa only ever reads from Apple Health. It never writes, changes or deletes anything there, and it asks only for the categories you tick.
Imports are worked out on your device. You see a preview before anything is copied, your own entries always win over imported ones, and you can undo an import — which removes only values you have not since edited, and never touches Apple Health itself.
Imported values are kept out of the assistant, partner sharing and anything else remote unless you separately opt in. Health source names, bundle identifiers and sample IDs never leave your device, even then. If you turn on body-sensor trends, what leaves is how far a reading has drifted from your own recent average — never the readings themselves.
Cycle data you sync to the assistant, the derived trends and past forecasts stay against your pseudonym until you delete your account, at which point they are erased. Conversation transcripts are never stored. Location is used to answer your request and then discarded. The install identifier persists until you ask us to remove it.
If you would like a copy of what we hold, or want it deleted and cannot use the in-app controls, email us and we will do it.
Ovaa is not intended for children under 13, and we do not knowingly collect information from them. Many people start tracking their cycle as teenagers; if you are under 18, please use Ovaa with a parent or guardian who knows you have it.
If we change how any of this works, we will update this page and change the date at the top. If a change makes a real difference to what leaves your phone, we will tell you in the app rather than hope you re-read this.
Questions, or anything here that does not match what you see in the app: support@ovaa.health. We would rather hear it than have you wonder.