NolaCycle Privacy Policy

Updated: October 13, 2026

Controller

Christian Hermann & Martina Hermann GbR, An Rainen 3, 72525 Münsingen, Germany. Contact: support@nolacycle.de.

What the app processes

NolaCycle may contain sensitive cycle and symptom data. By default, that data is stored locally and encrypted on your device. Optional end-to-end encrypted cloud backup stores encrypted ciphertext only; the recovery phrase remains your secret.

Depending on use, processing may include settings, progress, entitlement status, support messages, optional account identifiers, store purchase verification and technical diagnostics needed to operate, support or restore the app.

Optional account and encrypted cloud backup

For the optional cloud backup you sign in with an account. The backup is end-to-end encrypted: our servers store only encrypted ciphertext plus a technical version identifier; the recovery phrase remains your secret and never leaves your device. Without the phrase, neither we nor anyone else can read the contents. You can delete the account and the cloud backup at any time in the app (“Delete account” under Backup & device transfer or in the settings); this removes the encrypted data stored on our servers.

Not a medical device

NolaCycle is not a medical device and does not replace medical advice, diagnosis or contraception. Predictions are statistical estimates for orientation.

Anonymous usage and purchase statistics

To find out where a purchase fails or sign-in causes problems, and to improve the app, it sends a few fixed events as anonymous counters to our Cloudflare-hosted backend: technical purchase and sign-in steps (purchase screen opened, price loaded, purchase started, cancelled, failed or restored, failed sign-in), from which fixed place the purchase screen was opened, tapped or bought through, the rough start time, whether the intro was started, skipped or completed, whether reminders were turned on, off or opened, whether a backup succeeded or failed, and whether a review prompt was possible. Each report contains only the event name, fixed categories, platform, app version, app language and the rough install source (store, test or development), which is determined on the device without a device or installation ID. Each category is reported at most once per day. No cycle data, symptoms, notes, temperatures or dates, no sign-in, account or device identifier, no advertising ID and no free text are sent. With a purchase we also store which purchase page it came from (a fixed category such as start page, settings, introduction or locked content) so that purchases per page are not miscounted; it is deleted together with the purchase data. If you are already signed in (even anonymously), the app sends that session proof for authentication; our backend uses it only for short-term rate limiting and to match a purchase report to a verified purchase of the same sign-in, and stores neither identifier nor session with the report. We delete individual reports after seven days and aggregated daily counters after 120 days at most. The legal basis is Art. 6(1)(f) GDPR (finding errors and purchase problems, improving the app); because the reports contain no identifier, we cannot attribute them to a person. You can object under Art. 21 GDPR by email to support@nolacycle.de. If a report fails, the app is not affected.

Ads and tracking

The app does not show third-party advertising, does not build advertising profiles, includes no tracking SDKs or advertising IDs and does not sell data. The only measurement in the app is the anonymous daily counters described under “Anonymous usage and purchase statistics”.

Service providers

We use service providers for app distribution, purchases, hosting, authentication, storage and support, in particular Apple, Google Play, Google/Firebase and Cloudflare. Where providers act on our behalf, data processing agreements under Art. 28 GDPR are in place. Store purchases are regularly processed by Apple or Google as independent controllers.

International transfers

Some service providers may process personal data outside the EU/EEA. Where there is no adequacy decision, transfers rely on appropriate safeguards, in particular EU Standard Contractual Clauses, or on applicable statutory exceptions.

Purchases

Purchases are handled through the Apple App Store or Google Play. A store receipt is checked to unlock purchases.

Security

Personal data is transmitted only over encrypted connections. Local app data is stored in the protected app storage of your device.

Retention and deletion

Local data remains on your device until you delete it or remove the app. Optional account and cloud data is stored until account deletion or your deletion request. Purchase and billing records are kept where statutory retention duties apply.

Information about deleting app data and accounts is available at nolacycle.de/data-deletion/.

Your rights

Subject to the statutory requirements, you have the rights under Art. 15–21 GDPR, including access, rectification, erasure, restriction, data portability and objection. You may also lodge a complaint with a data protection supervisory authority; the authority responsible for our registered office is the LfDI Baden-Württemberg. For privacy requests, contact us at: support@nolacycle.de.