Privacy policy

Last updated 8 August 2026

The short version

There is no account, no sign-in and no server of ours. Nothing you log is sent to us, because there is no “us” for it to be sent to. There's no one on the other end who could read your data, even if they wanted to.

Everything you log is stored on your iPhone. If you leave iCloud sync on, it is also mirrored into your own private iCloud, which belongs to your Apple Account and not to us.

Exactly three things ever leave your phone, all optional and all only when you use them: a product barcode when you scan one, the words you type when you search for a product by name, and a city name when you turn on weather tips. None of them carries anything you logged.

Anything read from Apple Health never leaves your phone at all: not to us, and not to iCloud.

What you log, and where it is kept

Periods and flow, symptoms, skin and whichever other signals you picked, your shelf and your routines, your cabinet, and anything you wrote down in your own words.

All of it lives in a database on this iPhone, shared with the Cyclink widget so the widget can draw your own thread. Deleting the app removes it.

iCloud sync

Sync is on by default and you can turn it off in Settings → Sync. It uses CloudKit's private database, which sits inside your own Apple Account: Apple stores it, you control it, and it is not readable by us or by anyone else.

Turned off, your data stays on this device only. (The app needs a restart to change which store it opens.)

Apple Health

Cyclink can read two things from Apple Health, each behind its own separate permission that you grant, and never at launch: your logged cycle starts, so a skin log can be attached to the right cycle day; and your workouts (the date, the length and the type) so you can see whether sweaty days show up in your skin.

It is read-only. Cyclink never writes anything back to Health, and never asks for permission to.

Health data is never synced to iCloud. Imported cycle starts are kept in a separate on-device database that never mirrors to iCloud, even while your sync toggle is on. Workouts are not saved anywhere at all. They are held in memory and re-read from Health each time you open the app, which is why turning workouts off in Settings makes them disappear immediately.

Saying no to either permission is a supported answer. The app carries on; you just don't see that part.

Analytics

Today, analytics are switched off entirely in the shipping app: no analytics identifier is configured, so every event is discarded on the device and nothing is sent anywhere.

If they are ever switched on, the service will be TelemetryDeck and the payload will be an event name from a fixed list (things like “app_first_open” or “paywall_viewed”) and nothing else. No skin state, no zone, no cycle day, no date, no product, no city, no name, and no word of anything you typed. Those are the only two shapes this app has: off, or names only.

There are no advertising identifiers, no trackers, no advertising SDKs, and no third-party analytics library bundled in the app.

The camera, barcode scanning, and searching by name

Scanning a barcode to fill in a product's name is optional. Typing the product in is the first-class way to add one, and the scan button isn't even shown if the camera isn't available or you've declined it.

The camera is used only while the scanner is open, only to read a retail barcode, and images are never stored or sent anywhere.

When a barcode is read, the barcode number alone is looked up on Open Beauty Facts, a nonprofit open database. That request carries no cookies, no cache, no identifier and no account. The app identifies itself with one fixed string that is byte-identical on every install. Nothing about you or your logs goes with it. If the lookup finds nothing, you type the name in and the app moves on.

You can also search Open Beauty Facts by name instead of scanning. Tapping the search button beside the name field sends the words you typed there, once per tap, never as you type. Unlike a barcode, that IS the words you wrote, but it is only ever a product name you're looking for, never anything about you, your logs, your cycle or your identity. The same fixed app identifier is sent and nothing else. If nothing matches, you keep typing and add it yourself.

Weather tips

Weather tips are off unless you turn them on, and turning them on means typing a city.

Cyclink never asks for your location and never uses location services. The city name you typed is sent to Apple to turn into coordinates, which are stored on this device, and those coordinates are sent to Apple Weather to read today's conditions. Your logs, your cycle and your shelf never go with them.

Turning the feature off, or deleting your data, clears the city and the coordinates.

Your name

If you give the app your first name it is stored on this phone only, outside the synced data, so it never reaches iCloud. It appears in the app's own quiet moments and nowhere else: never on your lock screen, never in a widget, never in your export, and never in the doctor-visit report.

You can change it or remove it in Settings, and removal is immediate and total.

Notifications

Every notification is scheduled by your iPhone, on your iPhone. There are no push notifications and no notification server, so nothing about your cycle or your skin is ever transmitted in order to remind you of anything.

They are off until you switch them on, each family separately, and the lock-screen wording never names a skin state, a cycle day, a count, or your name.

Subscriptions and payment

Subscriptions are sold through Apple's App Store using StoreKit. Apple handles the purchase; Cyclink never sees, receives or stores your payment details, and there is no purchase receipt sent to any server of ours.

Whether you are subscribed is checked on your device against Apple's records, which is also what the Restore button re-reads.

Your data is yours

Export: Insights → Doctor-visit report → “Export everything”. It writes a plain-text file of everything you have logged (periods, every signal, flow and symptoms, your cabinet, your notes) and it is free whether or not you subscribe. The subscription pays for the formatted doctor-visit report, never for access to your own records.

Delete: Settings → Your data → “Delete everything”. It permanently removes everything you have logged from this device, including the separately-stored cycle starts imported from Health, and your name. If sync is on, the deletion propagates to your iCloud too.

Both are in the app, take a couple of taps, and need no request to anyone.

Children

Cyclink is not directed at children, and it collects nothing from anyone. There is no account and no profile to collect it into.

Changes to this policy

If what the app does changes, this screen changes with it in the same update, and the date at the top moves. There is no version of this policy that describes something the app doesn't do.

Questions

The support contact on Cyclink's App Store page reaches the developer directly. There is no data-access request to file, because there is nothing held anywhere for us to hand over.

This website

cyclink.app is served by GitHub Pages, which logs technical request data such as IP addresses for security and operations; see GitHub's privacy statement for details. The site itself sets no cookies and runs no analytics or trackers.

If you join the Android waitlist, your email address is processed by Tally (the form provider) for one purpose: a single announcement when the Android app ships. After that announcement the list is deleted. You can have your address removed earlier at any time by writing to REPLACE_ME_SUPPORT_EMAIL.