Privacy Policy
Last updated 24 October 2026.
The short version
- Your cycle, symptoms, moods, sex and intimacy logs, journal and companion progress are stored only on your device. On Android 9 and newer they are also included in your phone's own end-to-end encrypted Google backup, if you have that switched on.
- There is no account. We never receive, sell or share your logs, and there is no advertising and no tracking SDK; usage counts are sent only if you say yes (below).
- If you say yes, Twilune counts which screens and tools you use, whether you try or buy Premium, app errors and roughly how many days you have logged, under a random ID with no name, so we can make it better. Never what or when you log, your moods, notes, dates or name. Off unless you say yes; change it any time in Me → Privacy.
- A few optional features talk to our server. Each is described below, and none of them sends your logs.
Who we are
Twilune is made by João Correia in Portugal ("we"). Contact: jfpvcorreia@gmail.com. We are the controller for the limited data described in this policy.
Data stored on your device
Everything you enter is saved in your browser's or app's private storage on your device. You can export it as a backup file, import it again, or delete everything at any time from the Me tab. Deleting the app or clearing site data also deletes it from the device (see the Android backup note below). Because we never receive this data, we cannot recover it for you — please keep backups.
Android phone backup
On Android 9 and newer, if your phone backs up to Google (Android Settings → Google → Backup), the Android app's data file is part of that backup, so your history comes back after a reinstall or on a new phone. The app only allows this into a backup that is end-to-end encrypted with your phone's lock screen (so a phone without a screen lock is not backed up); we never see it, and Google cannot read it. The same file can also move directly to a new phone when you set it up with Android's phone-to-phone transfer. On Android 8 and older the app is never backed up. The app lock's hash is part of this file, which is why the lock itself does not need to be set again on the new phone. Switch phone backup off, or exclude Twilune where your phone allows it, if you would rather it stayed on this device alone. The web app is never backed up this way.
App lock
The optional app lock asks for a 4-digit PIN when the app opens or comes back after a while. Only a salted hash of the PIN is kept, on the device, and it is never part of a backup file you export. It keeps casual eyes out; it is not encryption of your data. The Android app also blocks screenshots and screen recording of itself and hides its content in the recent-apps switcher, whether or not the lock is on.
Usage counts (only if you say yes)
Off unless you say yes. At the end of setup (or once on Today, for earlier installs) Twilune asks whether it may count how the app is used; "Yes" and "No" are equal choices and neither is picked for you. Until you answer, nothing about it is stored on your phone or sent; if you say yes, counting starts with that visit (the app being opened and the setup steps you just went through). Change your answer any time in Me → Privacy → Usage counts: switching off stops sending at once and deletes anything still waiting on the phone together with the random ID, and nothing is sent to say you left.
The counts go to PostHog (PostHog Inc., EU Cloud, data stored in Frankfurt), our processor under its data processing agreement. PostHog staff may access data from the United States for support; that access is covered by the standard contractual clauses in the agreement. The events are written by our own few lines of code, not an analytics SDK: no person profiles, no screen recording, no automatic click capture, no advertising identifier, and no location (we ask PostHog not to look up where a request came from; it receives your IP address in transit, as any website does, and the project discards the IP address without storing it).
| What is sent | Why / legal basis |
|---|---|
|
The name of what happened (for example "app opened", "breathing finished", "Insights opened", "Premium screen shown", "trial started", "purchase
finished", "an error happened in saving") with a few coarse details: the app version, Android or web, free / trial / Premium, how long
ago the app was set up (in ranges such as 2–7 days), dark mode and the app's language; when the app opens, also whether anything had been logged
before this week (yes or no), so it changes once, on a Monday. No time of day is in any event, and only setup leaves your phone on
the day it happens: the rest waits on your phone and goes on a later day (by your phone's calendar), dated to its day. PostHog does see when
a batch arrives, which is a moment the app was open, not the moment anything happened. Calm tools, Siderelle messages, Insights and library
opens, sharing and errors wait a week, are dated to the week, and count once a week for each kind (so not how often or on which day); so do
app opens and the Premium screen after the first week, since a daily rhythm over months could follow a cycle. A Siderelle message counts the
same whatever it says, and the Premium screen opened from the library or from Me shows the same code.
The full list: app opened, setup steps and setup finished, calm tool started and finished, a Siderelle message sent,
Insights or a library section opened, a share card, partner link or invite sent, reminders switched on (with how many kinds, never counting the fertile-window one) or
off, a backup written or restored, the app lock set or removed, the Premium screen, trial, purchase, restore or a failed purchase, and errors.
Also, per event: which setup step was reached, which calm tool ran and how long it ran (in ranges), whether a Siderelle message went online and whether the daily limit was reached, whether Insights was locked, which library section opened, where the Premium screen or trial was opened from, which Premium product a step was about, the kind of a failed purchase, whether a backup or restore worked, and the kind and place of an app error.
These counts are pseudonymous: a random ID made on your phone links one phone's counts so we can see return
visits; it is never linked to your name, account, Google or advertising ID, it is replaced every 13 months, and switching off or Delete all my
data deletes it. While counts are on, Me → Privacy shows it so you can send it to us.
Never counted, because they could say something about your health or sex life: your cycle or phase, the "Period started" button and period edits, saving a day's log or a mood check-in (so not when you log either), how many cycles you have logged or how many patterns Insights found, the cramp-ease breath, the SOS screen and crisis lines, and the intimacy library. Never sent: names, notes, journal or chat text, symptoms, flow, moods, dates you logged, your PIN, licence key or purchase token, backups, partner links. |
Why: to see where setup loses people, whether people come back after a day and a week, which tools get finished, how many try and buy Premium, and how often the app hits an error. Legal basis: your consent (GDPR Art. 6(1)(a); because using a period tracker can itself say something about health, we also treat it as your explicit consent under Art. 9(2)(a); and Portuguese law on storing information on your phone, Lei 41/2004 art. 5), given with "Yes" and withdrawn with the switch in Me → Privacy. |
How long, and your rights: PostHog keeps events for 7 years, the fixed period of our PostHog plan, and then deletes them. We will review this by October 2027 and update this page if it changes. The random ID is never shown to us with your name, so we cannot find "your" events by name or email (GDPR Art. 11(2)). To see or erase the counts already sent, copy your usage ID in Me → Privacy (while counts are on) and email it to jfpvcorreia@gmail.com: we send you its events, or delete them at PostHog, within 30 days. Switching off or Delete all my data deletes the ID on your phone, so nothing sent afterwards can be joined to what came before; if you delete the ID without sending it to us first, the counts already sent stay at PostHog for the period above, joined to nothing we can find.
Optional features that use our server
| Feature | What is sent | Why / legal basis |
|---|---|---|
| Siderelle AI chat (if enabled) | Your chat messages (last 12) and a minimal cycle context: current phase, cycle day, days until your next period, and whether it is late. Processed by our AI provider (Anthropic) to generate a reply. We do not store the conversation. A hashed IP address is kept for up to 2 days for rate limiting. | Your explicit consent, asked in the app before your first online message and changeable in Me (GDPR Art. 6(1)(a) and Art. 9(2)(a)). Without it, Siderelle answers on your device. Messages that mention self-harm or suicide, and the replies to them, are handled on your device and removed from anything sent. |
| Premium licence check | The licence key you paste. Forwarded to our payment provider to confirm it is valid. | Performance of contract (Art. 6(1)(b)). |
| Keep them updated (live partner link) | An encrypted copy of the fields you chose (with your phase; it includes your forecast phases until your next period is due, or a week ahead, and nothing after the due day), which we cannot read; when it was last updated; a hash of a random token; and, if your partner turns on notifications, their browser's push address and the timing of phase-change notices (which can show when a period starts). Kept until you turn it off or delete all your data, or 45 days after your last update. Hosted by Cloudflare, our processor under its Data Processing Addendum (transfers to the US under the EU-US Data Privacy Framework and standard contractual clauses); notices are delivered by your partner's browser push service (Google, Apple, Mozilla or Microsoft), which may be outside the EU, under their standard contractual clauses. | Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)), given by turning on Keep them updated and withdrawn by turning it off. For your partner's push address: their consent, given by turning on notifications and withdrawn with Stop notifications. |
Payments
Purchases on the web are processed by Lemon Squeezy, acting as merchant of record; they receive your payment and billing details under their own privacy policy. In-app purchases in store versions are processed by Google Play or the App Store. In the Android app, RevenueCat (our subscription service provider) receives a random app user ID each time the Android app starts, so it can confirm whether this phone has an active Premium plan, and the purchase receipt if you buy or restore; never your name or health data. To have that anonymous purchase record deleted, email us with the date of purchase. Payments are never linked to your health data, which we don't have.
Reminders
Reminders are optional and scheduled on your phone by the app itself; nothing is sent to us or to a push service. The text on your lock screen never mentions your cycle, body or health, and you see the exact words in the app before you turn them on.
Sharing you start
Story cards and partner links are created on your device. A partner link contains only the fields you choose (your name, phase and cycle day, next period date, today's mood, today's symptoms, and what would help) inside the link itself; anyone with the link can read them. We do not store these links, but the link stays in the chat app you send it through and in the browser history of whoever opens it.
If you turn on Keep them updated, the app encrypts the fields you chose on your phone (AES-256-GCM) and sends the encrypted copy to our server (Cloudflare, EU and worldwide edge) so the link can show the latest. The key is only in the link you send and on your phone: we cannot read your phase, dates, mood or symptoms. Your sex log and notes are never shared. We keep the encrypted copy, a hash of a random token that proves it is yours, and, if your partner asks for notifications, their browser's push address. What the server does see: when your link is updated (which happens when you open Twilune), and, only while your partner has notifications on, when an update is marked as a new phase, which shows the date your phase changes, including when a period starts. Like any website, Cloudflare also sees the IP addresses of your phone and your partner's browser when they connect; we use a hashed IP only for daily abuse limits, kept 2 days. Notifications carry no content: they say "There's an update for you". They are delivered by the push service of your partner's browser (Google, Apple, Mozilla or Microsoft, which may be outside the EU), so that service also learns when a notification is sent; your partner chooses whether to turn them on. The link (and its key) stays in the browser history of whoever opens it. Turning sharing off, or "Delete all my data", deletes all of it at once (if you are offline, the app retries); if you uninstall the app it is deleted 45 days after your last update. If Android restores the app from a backup onto a new phone, that phone keeps updating the same link until you turn sharing off. A backup file you export holds what is needed to delete the link (never its key), so a phone restored from it deletes the old link; if you lose your phone, email us the link and we delete it.
Children
Twilune is for people aged 16 and over. Intimacy content and sexual-activity logging are hidden for users under 18.
Not medical advice, not contraception
Twilune is a wellbeing tool, not a medical device. Predictions are estimates and must not be used to prevent pregnancy.
Your rights
Under the GDPR you can access, correct, delete, restrict or port data we hold about you, object to processing, and withdraw consent at any time (usage counts have their switch in Me → Privacy, which works at once). As we hold none of your logs (a live partner link holds only an encrypted copy we cannot read, and turning it off deletes it), most requests are fulfilled in the app itself. For anything else, email jfpvcorreia@gmail.com. You can complain to the Portuguese data protection authority (CNPD, cnpd.pt) or your local authority.
Delete your Twilune data
Twilune has no accounts, so almost everything is deleted on your phone:
- In Twilune, open Me → Delete all my data and confirm. This erases your cycle and mood logs, symptoms, journal, Siderelle chats, Lumi and settings from the device straight away. Uninstalling the app does the same, except that a copy may remain in your phone's Google backup until that backup is refreshed or turned off. Backup files you exported yourself stay wherever you saved them.
- If you bought Premium in the Android app, RevenueCat keeps an anonymous purchase record (a random app user ID and the Google Play receipt). Email jfpvcorreia@gmail.com with the subject "Delete my Twilune data" and the date of purchase, and we delete that record within 30 days. Google Play keeps its own order records under Google's privacy policy.
- Usage counts (if you said yes) waiting on the phone are deleted with everything else, including the random ID they use; nothing is sent when you delete. To stop them without deleting, switch off Me → Privacy → Usage counts. Counts already sent stay at PostHog (see How long, above) unless you first copy your usage ID from Me → Privacy and email it to us: we then delete them within 30 days.
- We hold nothing else about you. A hashed IP address used for rate limiting (only if you use online Siderelle chat) is deleted automatically within 2 days.
Changes
We will update this page and the date above if anything changes, and highlight material changes in the app.