Privacy Policy

Last updated: June 2025

  1. Who We Are

    Data Controller:
    David Kanis
    Theresienstr. 81F
    80333 Munich
    Germany
    Email: [email protected]

    At this time, no Data Protection Officer (DPO) has been appointed, as this is not legally required under Article 37 GDPR.

  2. What Data We Collect
    • Account Information
      • First name
      • Email address
      • Password (securely hashed by Firebase Authentication)
    • Health and Cycle Data
      Entered voluntarily by you:
      • Basal body temperature
      • Cervical mucus type and sensation
      • Cervix position
      • Symptoms (e.g., pain, mood, skin condition)
      • Protected/unprotected intercourse (toggle)
      • Free text notes
    • Device & Technical Data
      • Device type, operating system, and app version
      • Unique Firebase Authentication ID (UID)
      • Firebase Analytics usage data (if enabled)
      • Firebase may temporarily process IP addresses for technical and security reasons; we do not store IP addresses ourselves
  3. Legal Basis for Processing

    Your personal data is processed under the EU General Data Protection Regulation (EU GDPR) and, for users located in the United Kingdom, under the UK GDPR and the Data Protection Act 2018.
    The specific legal bases are:

    • Provision of the App and core fertility tracking – Article 6(1)(b) EU / UK GDPR (contract performance)

    • Processing of health data – Article 9(2)(a) EU / UK GDPR (explicit consent)

    • Product improvement and statistical analysis (using anonymized or aggregated data) – Article 6(1)(f) EU / UK GDPR (legitimate interests; we have performed a balancing test confirming that our interests do not override your rights and freedoms)

    • Security, compliance, and legal obligations – Article 6(1)(c) EU / UK GDPR (legal obligation) and Article 6(1)(f) EU / UK GDPR (legitimate interests)

    Where the processing of health data is concerned, we rely exclusively on your explicit consent. You may withdraw that consent at any time without affecting the lawfulness of processing already carried out.

  4. How We Collect Your Consent

    We collect explicit consent for processing your health-related data via a clearly presented, unchecked checkbox during registration. You must confirm that you:

    Consent is timestamped and associated with your user account (UID) in our records.

    • Have read and agreed to this Privacy Policy and the Terms of Use
    • Consent to the processing of health data under GDPR Article 9(2)(a)
  5. How Your Data Is Used

    Your personal and health data is used exclusively to:

    • Evaluate fertility windows using the Sensiplan method
    • Display your cycle and symptoms within the App
    • Help improve the app via anonymized usage patterns
    • Respond to support inquiries or system issues
    • Send newsletters or promotional notifications if you have explicitly opted in

    We do not use your data for advertising or automated profiling.
    You can withdraw your consent to receive newsletters or promotional notifications at any time by adjusting your in-app settings.

  6. Data Storage and Security

    We use Google Firebase (Firestore, Authentication, Analytics) with EU-based servers to store and process data.

    • All data is encrypted in transit using TLS and at rest with AES-256 encryption.
    • Passwords are stored securely using industry-standard bcrypt hashing.
    • Your health data is stored separately from your account and is linked only via your UID, which adds a layer of pseudonymization.
    • We have a Data Processing Agreement with Firebase in accordance with Art. 28 GDPR.
    • Firebase's parent company, Google, implements Standard Contractual Clauses (SCCs) to safeguard any incidental international data access.
    • Although our data is primarily stored on servers located in the European Union certain limited data may be accessed from outside the EEA (for example, for technical support by Google LLC in the United States).
      Such transfers are protected by the European Commission’s Standard Contractual Clauses (SCCs) under Article 46 GDPR, which provide adequate safeguards for personal data transferred to third countries.
      Where possible, we further minimize exposure by pseudonymizing data and limiting access strictly to what is necessary for maintenance and security.
  7. Data Retention and Deletion

    You may delete your account and all associated data at any time using the in-app deletion feature.

    When an account is deleted:

    This retention is based on our legitimate interests (Art. 6(1)(f) GDPR) and complies with GDPR-recognized anonymization practices.

    • All personally identifiable information (PII) — including name, email, and any account-linked identifiers — is irrevocably removed.
    • All remaining cycle data is permanently anonymized, meaning it cannot be traced back to any individual.
    • We retain such anonymized data exclusively for statistical and analytical purposes to improve the app.
  8. Your Data Protection Rights

    As a data subject under GDPR, you have the following rights:

    We will respond to all requests within 30 days as required by law.

    • Right of access: Learn what personal data we hold about you
    • Right to rectification: Correct incorrect or incomplete data
    • Right to erasure: Delete your personal data (“right to be forgotten”)
    • Right to restrict processing: Temporarily limit how your data is used
    • Right to data portability: Obtain your data in a structured, machine-readable format
    • Right to object: Object to processing based on our legitimate interests
    • Right to withdraw consent: You may withdraw consent at any time by emailing us at: [email protected]
  9. Data Portability & Export

    If you would like to receive a copy of your data in a structured, commonly used, and machine-readable format, please contact us via email at [email protected].
    This process is manual at this time.

  10. Data Sharing and Processors

    We do not sell or rent your data to third parties.

    We rely on trusted external providers as data processors, including:

    • Google Firebase (Firestore, Authentication, Analytics)

    These providers act under GDPR-compliant agreements, including Standard Contractual Clauses and data processing agreements (DPAs).

  11. Age Restriction and Children’s Data

    Signals of You is intended only for individuals aged 18 or older.

    By registering, you confirm that:

    We do not knowingly collect data from users under 18. If we become aware of such use, we will delete the data immediately.

    • You are at least 18 years old
    • You agree to the Terms of Use and this Privacy Policy
  12. Future Features (e.g., Donations)

    While a donation feature may be introduced in the future, no payment or billing data is currently collected. If donations are activated, they will be processed through a third-party provider, and this policy will be updated accordingly.

  13. Changes to This Policy

    We may update this Privacy Policy to reflect changes in legal requirements or how we operate the App.
    If changes are significant, we will notify users via the app or email. The current version is always available within the App.

  14. Contact Information

    For questions or privacy-related concerns, contact:
    David Kanis
    Email: [email protected]

    You also have the right to lodge a complaint with a supervisory authority. In Germany, contact:

    Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
    Promenade 27, 91522 Ansbach
    https://www.lda.bayern.de/

    For users in the United Kingdom, this Privacy Policy also applies under the UK GDPR and the Data Protection Act 2018.
    You have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/