Privacy policy

In short: your cycle logs stay in your browser on your device. We run no database and never receive your logs. Some optional features (AI assistant, encrypted sync, email reminders) send data to services you choose or configure, and only when you use them.

1. Who we are

AuraCycle AI Pro is made by Bedanga Sharma, developer. Contact: contact@example.com. This policy covers the website at https://auracycle-ai-pro.pages.dev and the tracker at /app/.

2. What stays on your device

• Your logs and settings: period dates, symptoms, mood, notes, sleep, water, profile details and preferences. They are saved in your browser's local storage (keys such as auracycle_db_v4), so they never reach our servers.
• A device signing key: when you issue a clinical summary, the app creates a signing key pair and keeps the private key in local storage (auracycle_sig_v1). It signs reports so that anyone can check them later. Clearing site data deletes this key. Reports you already issued still verify with the public key in their own link.
• Backup folder handle: if you link a folder for backups, the browser keeps a reference to it in IndexedDB. The backup files stay in the folder you chose.
• Settings cookies: a few small ac_* cookies keep backup and settings values. See the cookie policy.

3. Optional features that send data out

Each of these is used only when you turn it on or use it. Nothing is sent in the background.

• AI assistant. By default the assistant uses a free third-party AI service, so your messages are sent to that service while you are online. If you choose another provider and enter your own API key, your messages go to that provider under its own terms. Photos you attach are sent with your message to that provider. The assistant is turned off for accounts under 18.
• Encrypted sync. Nothing is sent until you press Sync or Restore in Settings. Your data is encrypted in your browser with your passphrase, which is never saved. The relay receives a hashed namespace and the encrypted text, so it cannot read your entries. The app uses a public default relay unless you enter your own address. The relay also sees connection details such as your IP address.
• Email reminders. If you enter your own EmailJS keys, reminder emails are sent through EmailJS. If you install the Google Apps Script generator, the script runs in your own Google account. We do not receive these emails or keys.
• Google button. The "Continue with Google" button is currently a local preview. It does not connect to Google and sends nothing to Google.
• Clinical summary and verification. The verification page checks a report entirely in your browser. The verification link carries a report ID, a key ID, the signature and the public key in its address fragment. Browsers do not send that fragment to our server.

4. Services that load in your browser

The website and the app load fonts from Google Fonts, styling from the Tailwind CDN, and libraries from jsDelivr, unpkg and cdnjs (for example Lucide icons, the PDF and QR code tools, and the sync library). Your browser contacts these providers when a page loads, so they can see your IP address and standard request details. We do not add analytics or tracking scripts.

5. Advertising

There is no advertising on the website or in the app today. The site contains empty advertising spaces. They stay hidden unless an advertising partner is added. If we add advertising, it will load only after you accept the choice in the cookie banner, and we will update this policy and the cookie policy before it starts.

6. Hosting and logs

The website is hosted on Cloudflare Pages. Cloudflare may process standard request logs, including IP addresses and browser details, to deliver and protect the site, under its own privacy policy. Requests can be processed in several countries.

7. Children and teenagers

The app includes a protective mode for accounts of people under 18. In that mode cloud sync, email reminders, the AI assistant, and sending photos or clinical reports to a provider are turned off. We do not knowingly collect personal information from children, because we do not collect personal data on our servers at all.

8. How long data is kept

Data on your device stays there until you delete it in the app (Clear data), clear your browser's storage, or uninstall the browser site data. Data sent to a sync relay, an AI provider or an email service is kept under that provider's own retention rules.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete or move personal data, to withdraw consent, and to complain to a regulator. These include rights under the EU GDPR and India's Digital Personal Data Protection Act, 2023. Because most data is on your device, you can exercise most rights directly in the app. For anything else, email us at contact@example.com. We will respond within the time required by law.

10. Security

Sync data is encrypted in your browser before it leaves the device, and passphrases and API keys are left out of exported backups. No system is perfectly secure, so please keep your device locked and use the PIN lock if you share the device.

11. Changes

We may update this policy. The date at the top shows the latest version. Significant changes will be shown on the site before they take effect.