Cycle Vault — Privacy Policy

Who we are

Cycle Vault is published by Daniel Petrica / Grozav.dev (“we”, “us”). Contact for privacy questions: [email protected]. Website: danielpetrica.com.

What the app does with your data

We collect nothing. Cycle Vault has no account system and no server. Your entries are stored encrypted on your device and are not transmitted to us or anyone else.

• Entries you type — dates, flow, symptoms, mood, temperature, LH test, cervical mucus and notes. Encrypted at rest with XChaCha20-Poly1305 under a key derived from your passphrase (Argon2id) and, optionally, wrapped by a hardware-protected key in the Android Keystore for biometric unlock.
• Keyring material — the wrapped vault key and KDF parameters, stored on the device. Neither the passphrase nor the unwrapped key is ever stored.
• App preferences — e.g. auto-lock delay.

Network access

The release build does not request the Android INTERNET permission, so the app has no way to send data anywhere by itself. There are no analytics, advertising, crash-reporting or attribution SDKs, no web view browsing, and no connection to Google Fit, Health Connect or any other app or service.

Exports — the only ways data leaves the app

Data leaves the app only when you choose to export it. There are two export paths:

• Encrypted backup — saved through the Android system file picker and protected by a backup passphrase you choose. We have no access to it.
• Plain-text visit summary — a summary of cycles and symptoms for a clinic visit, which you explicitly confirm before saving through the system file picker. This file is not encrypted. Treat it like a printed medical note and delete it when you no longer need it. Nothing is written unless you confirm.

Aside from these user-initiated exports, nothing is transmitted off the device.

Android system backup

Cloud backup and device-to-device transfer are disabled for all Cycle Vault data (allowBackup=false plus explicit dataExtractionRules exclusions).

Permissions

The release manifest requests only USE_BIOMETRIC, and the permission is only used if you enable biometric unlock. The app does not request internet, camera, microphone, location, contacts, storage or health-data permissions.

Sensitive health data

Cycle, fertility and symptom data is sensitive health information. It is stored encrypted on your device and is never transmitted to us or to third parties. We do not know whether you are using the app, and we cannot access, sell or share your entries. The app has no account, no advertising and no analytics.

Children

Cycle Vault is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from children.

Deleting your data

“Settings → Delete all data” destroys the vault key, the keyring and every encrypted entry on the device. This is irreversible. Uninstalling the app removes all app-private data.

Not medical advice

Cycle Vault is not a medical device, not a contraceptive and not a diagnosis. Forecasts are estimates with uncertainty. Consult a qualified clinician for medical decisions.

Data safety summary

Changes

If this policy changes, the updated version will be published at this URL with a new “last updated” date.