Privacy policy

Last revised 27 August 2026

1. Controller

The controller within the meaning of Art. 4 (7) of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) is:

Cyclink
Asmita Narang
c/o POSTFLEX PFX-706-960
Emsdettener Straße 10
48268 Greven
Germany
Email: cyclinksupport@gmail.com

Further statutory disclosures are set out in the Impressum.

2. Scope

This policy governs the processing of personal data in connection with (a) the Cyclink application for iOS (the “App”) and (b) the website cyclink.app (the “Website”).

3. Architecture of the App

The App is designed so that personal data does not reach the controller. It provides no user account, no registration and no sign-in. The controller operates no server on which user data is stored or processed, and accordingly has no access, technical or otherwise, to any entry made in the App.

All entries are stored locally on the user's device. Where iCloud synchronisation is enabled (section 5), entries are additionally mirrored into the user's own private iCloud storage, which is associated with the user's Apple Account and is not accessible to the controller.

Precisely three categories of data may leave the device, each optional and each transmitted only upon the user's own action: (a) the numeric value of a product barcode when the user scans one (section 8); (b) the search terms the user types when searching for a product by name (section 8); and (c) a city name the user types when enabling the weather feature (section 9). None of these transmissions includes any logged entry.

Data read from Apple Health does not leave the device under any circumstances, neither to the controller nor to iCloud (section 6).

4. Data recorded in the App and place of storage

The App records the entries the user chooses to make: period and flow entries; skin, symptom and other selected signal entries; training entries; products and routines; and free-text notes. These entries are stored in a local database on the device, within an App Group container shared with the Cyclink widget so that the widget can display the user's own data. Uninstalling the App removes this database.

5. iCloud synchronisation

Synchronisation is enabled by default and may be disabled at any time under Settings → Sync. It uses the private database of Apple's CloudKit service, which forms part of the user's own Apple Account: Apple stores the data, the user controls it, and it is not readable by the controller or by any other third party. Apple's processing is governed by Apple's own terms and privacy policy.

When synchronisation is disabled, entries remain solely on the device. A restart of the App is required for a change of storage location to take effect.

6. Apple Health

The App can read two categories of data from Apple Health, each subject to a separate permission granted expressly by the user and never requested at first launch: (a) logged cycle starts, so that an entry can be associated with the correct cycle day; and (b) workouts (date, duration and type), so that training days can be displayed alongside other entries.

Access is read-only. The App writes nothing to Apple Health and requests no permission to do so.

Data derived from Apple Health is never synchronised to iCloud. Imported cycle starts are kept in a separate on-device store that is excluded from synchronisation even while the synchronisation setting is enabled. Workouts are not persisted at all: they are held in memory and re-read from Apple Health on each launch, which is why disabling workouts in Settings removes them immediately.

Refusal of either permission does not restrict the remaining functions of the App.

7. Analytics

In the current release, analytics is deactivated in its entirety: no analytics identifier is configured, every event is discarded on the device, and nothing is transmitted.

Should analytics be activated in a future release, the service used will be TelemetryDeck and each transmission will be limited to an event name drawn from a fixed list (for example “app_first_open” or “paywall_viewed”). No logged state, no cycle day, no date, no product, no city, no name and no free text is ever included. The App therefore has exactly two possible configurations: analytics off, or event names only.

The App contains no advertising identifiers, no tracking technologies and no third-party advertising or analytics libraries.

8. Camera, barcode scanning and product search

Scanning a barcode to fill in a product name is optional; entering the name manually is the primary method, and the scan control is not displayed where the camera is unavailable or permission has been declined.

The camera is active only while the scanner is open and only for the purpose of reading a retail barcode. Images are neither stored nor transmitted.

When a barcode is read, the barcode number alone is looked up in Open Beauty Facts, a database operated by a non-profit organisation. The request carries no cookies, no identifiers and no account information; the App identifies itself with a single fixed string that is identical on every installation. If the lookup returns no result, the user enters the name manually.

The user may also search Open Beauty Facts by product name. In that case the search terms typed by the user are transmitted, once per request initiated by the user and never while typing, together with the same fixed application identifier and nothing further. The transmission concerns only the product being searched for and contains no information about the user, the user's entries or the user's identity.

9. Weather feature

The weather feature is deactivated by default; activating it requires the manual entry of a city name. The App does not request the user's location and does not use location services.

The city name entered is transmitted to Apple for conversion into geographic coordinates; the coordinates are stored on the device and transmitted to the Apple Weather service to retrieve current conditions. No entries, cycle data or product data accompany these requests.

Deactivating the feature, or deleting one's data (section 13), removes both the city name and the coordinates.

10. First name

Where the user provides a first name, it is stored exclusively on the device, outside the synchronised data set, and therefore never reaches iCloud. It appears only within the App itself: never on the lock screen, in a widget, in an export or in the report. It may be changed or removed at any time in Settings; removal takes immediate and complete effect.

11. Notifications

All notifications are scheduled locally by the operating system on the user's device. The App uses no push notifications and no notification server; no data is transmitted for the purpose of delivering a reminder.

Notifications are deactivated until the user enables them, each category separately. Notification text never contains a logged state, a cycle day, a count or the user's name.

12. Purchases

Subscriptions are concluded through Apple's App Store using StoreKit. Apple processes the payment; the controller neither receives nor stores payment data, and no purchase receipt is transmitted to any server of the controller. Subscription status is verified on the device against Apple's records, which is also the mechanism of the Restore function.

13. Export and erasure

Export: Insights → Doctor-visit report → “Export everything” produces a plain-text file of all entries (periods, every signal, flow and symptom entries, products, notes). The export is available free of charge irrespective of any subscription; the subscription concerns the formatted report only, never access to the user's own records.

Erasure: Settings → Your data → “Delete everything” permanently removes all entries from the device, including cycle starts imported from Apple Health and the stored first name. Where synchronisation is enabled, the erasure propagates to the user's iCloud storage.

Both functions operate entirely within the App and require no request to the controller or to any third party.

14. Children

The App is not directed at children. It collects no data from any person; there is no account and no profile into which data could be collected.

15. Rights of the data subject

Data subjects have the rights set out in Art. 15 to 21 GDPR (access, rectification, erasure, restriction of processing, data portability and objection) and the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.

With respect to entries made in the App, the controller holds no personal data and is technically unable to produce, rectify or erase copies of it; access, portability and erasure are exercised directly through the functions of the App described in section 13. With respect to the waitlist described in section 16, requests may be addressed to cyclinksupport@gmail.com.

16. The Website

The Website is hosted by GitHub Pages, a service of GitHub, Inc. GitHub records technical request data, including IP addresses, for the purposes of security and operation; details are set out in GitHub's privacy statement. The legal basis is Art. 6 (1) (f) GDPR, the legitimate interest in the secure and reliable provision of the Website. The Website itself sets no cookies and uses no analytics or tracking services.

Where the user joins the Android waitlist, the email address entered is processed by Tally (the form provider) on the basis of consent pursuant to Art. 6 (1) (a) GDPR, for a single purpose: one announcement when the Android application is released. The list is deleted after that announcement. Consent may be withdrawn at any time with effect for the future by writing to cyclinksupport@gmail.com.

17. Note for users in the United States

The controller does not sell personal information and does not share personal information for cross-context behavioural advertising within the meaning of the California Consumer Privacy Act (CCPA/CPRA). No consumer health data within the meaning of comparable state laws, including the Washington My Health My Data Act, is transmitted to the controller: entries of that kind remain on the user's device and, where synchronisation is enabled, in the user's own iCloud storage, as described in sections 3 to 6.

18. Amendments

This policy is amended whenever the functionality it describes changes, in the same update; the date above indicates the current revision. At no time does a version of this policy describe conduct in which the App does not engage.

19. Contact

Enquiries concerning this policy may be directed to cyclinksupport@gmail.com or to the support contact stated on the App's App Store page.