ovarything
What we do and do not know about you
The short version, then the whole thing. Last updated 2026-09-06.
Everything about your body stays on this phone, unless you switch on a backup only you hold the key to.
We collect nothing at all right now. No crash reports, no usage counts, no analytics of any kind.
Signing in is optional and holds only an email address. Your backup is encrypted so we cannot read it.
Never collected
None of this reaches us. Not anonymised, not aggregated, not behind a setting you could switch on by accident.
Period start and end dates
The core of the promise. No exception, no opt-in.
Cycle length, predictions, and everything the model learns about you
The model is yours and lives on your phone.
Symptoms, moods, energy, pain, skin, hair
All of it describes a body.
Sex, contraception, and anything logged in sexual health
Including UTIs, thrush and BV, which never leave the phone and never appear in Orbit or partner mode.
Pregnancy, loss, and fertility intentions
The most sensitive data in the app and the most dangerous to hold.
Wrist temperature and anything imported from Apple Health or Health Connect
Imported health data is still health data.
Bloodwork and lab results
Medical records by any definition.
Notes, photos, and anything you typed
We cannot know what is in them, so we do not take them.
Your contacts, and who you are connected to in Orbit
The social graph of a period app is itself sensitive.
Location
No GPS, no IP lookup. Moon, stars and tides use a city you type, and it stays on this phone. A tide lookup asks NOAA what the water is doing at a public harbour you chose. A question about a place, not about you.
Collected
Nothing.
No crash reports, no counts of which screens you open, no timings, no analytics of any kind. There is no code in the app that sends us anything, so there is nothing to switch off. If that ever changes it will be listed here, item by item, and it will never include anything about your body.
Only if you sign in
An account is optional. The app is complete without one, and nothing about your body is attached to it.
An email address
So a backup can be restored on a new phone, and so two people can be connected to each other later. Optional, and nothing about a body is attached to it. There is no password and no Google or Apple sign-in, so the account is one address and nothing else. Use a forwarding address and what we hold is a relay you can switch off at any time.
An encrypted backup, if you turn one on
So a lost phone is not a lost record, and so a new phone can start where the old one stopped. Encrypted on the phone with a key we do not have, using XChaCha20-Poly1305. The server holds a blob it cannot read, and we cannot read it either. The only key is a recovery code you write down: lose that and the backup cannot be opened by anybody, including us.
The date and size of each backup
So the account page can tell you whether a backup exists and how recent it is, and so a restore can pick the right one. A timestamp, a byte count and whatever you called the phone it came from. Not the contents: those are ciphertext and stay that way. Nobody here, including whoever is looking at the staff dashboard, has a key that opens them.
That two accounts are connected, and roughly when something was sent
A message has to reach a person, and reaching a person means knowing which one. The contents are encrypted and we cannot read them. This is the envelope, not the letter. It is the one place the promise is narrower than the slogan, which is why it is written here rather than left to be discovered.
How the backup works
Your phone encrypts everything before it goes anywhere, using XChaCha20-Poly1305 under a 256-bit key generated on the device and held in the keychain. The server stores ciphertext and cannot read it. The only thing that can decrypt it is a recovery code shown to you once, which we never see. Lose that code and the backup cannot be opened by anybody, including us. That is the cost of the promise being true.
Taking it with you, and deleting it
Every screen of your data can be exported to a plain JSON file you keep and can read in any text editor, and imported back on any phone. Deleting your account deletes the account and every encrypted backup. Deleting the app's data on your phone is separate, on its own screen, and offers to save you a copy first.
Children
ovarything is not directed at children under 13 and we do not knowingly hold information about them. There is nothing to hold: nothing about anybody's body reaches us at any age.
Getting in touch
Questions about any of this go to hello@ovarything.com.