Privacy Policy
The short version. Everything you log – symptoms, hot flashes, cycles, medications, doses, notes, lab values – is written to a private database on your iPhone and stays there. There is no account and no Calla server, so there is nowhere for it to be uploaded to. What does leave the phone is listed below, in full: anonymous product analytics with no health values in it, crash reports, and your subscription status.
1. Who we are
Calla is made by an independent developer, [LEGAL NAME, COUNTRY – fill in before publishing], who is the data controller for the limited processing described here. You can reach us at support@callatracker.app.
2. What Calla stores, and where
Your entries are stored in an app-private database on the device itself, plus a small settings store for preferences such as reminder times and units. Both are protected by iOS app sandboxing and by your device passcode or biometric lock. You can add a Face ID lock to Calla itself in Settings.
We cannot read any of it. Not because we promise not to, but because it is never sent to us – there is no account system, no login, no email address collected, and no backend service that receives your entries.
3. What leaves your iPhone
| Goes to | What | Your control |
|---|---|---|
| PostHog (product analytics) | Anonymous events: which screens were used and how many entries were saved. Never any health value. | Off in Settings → Privacy |
| Sentry (crash reports) | Crash stack traces, app version, device model and iOS version. | Off in Settings → Privacy |
| Apple and RevenueCat (purchases) | Subscription status, product identifier and a random app user id. | Required for subscriptions |
| Your own iCloud Drive | A backup file in your personal Apple account, under Apple's encryption. We have no access to it. | Off by default until you turn it on |
| Apple Health, on device | Symptoms you choose to write, and cycle or sleep data you choose to import. | Off until you grant permission |
4. Analytics, in detail
Product analytics tell us whether a feature is used and where people get stuck. They are built so that a health value cannot travel in them even by accident: the event schema allows only actions and counts, and a second check strips any property whose name looks like health data before anything is sent.
The complete set of events is, for example:
- the app was opened; an onboarding step was viewed, skipped or completed;
- the paywall was shown or dismissed; a trial started; a purchase completed;
- an entry was saved – with its kind (daily log, hot flash, cycle, medication intake, lab, tag) and where it came from (app, widget, Siri), but never what was in it;
- a report was generated, with the number of days it covered and how many sections;
- a backup was created or restored; a reminder was scheduled or acted on;
- a permission prompt was answered; a setting was changed, by key name only;
- an error screen was shown, with the kind of error.
Property names such as severity, dose, medication name, symptom, flow, note, lab value, birth year and email address are blocked outright. The identifier attached to these events is a random UUID generated on first launch and kept on the device. It is not your Apple ID, not the advertising identifier and not the vendor identifier, and it is not linked to your name, your email or your entries.
Calla does not track you across other apps or websites, shows no ads, and never presents the App Tracking Transparency prompt, because there is nothing to track.
5. Crash reports
When the app crashes we receive a stack trace so it can be fixed. Personally identifiable information is disabled in the crash reporter, and every report is filtered before it is sent so that user content cannot ride along in a message or a breadcrumb.
6. Subscriptions
Purchases are processed by Apple. We never see your payment details – Apple tells us only whether a subscription is active. RevenueCat handles the receipt validation on our behalf and identifies the purchase with a random installation identifier, not with anything about you. Their processing is covered by RevenueCat's privacy policy and Apple's.
7. iCloud backup
Backup is optional and off until you enable it. When on, Calla writes a single backup file into the Calla folder of your iCloud Drive, inside your own Apple account. It travels between your devices under Apple's encryption, and we have no access to your iCloud account. You can delete the file yourself from the Files app at any time.
Data imported from Apple Health is deliberately excluded from that file. Health data you brought in from Apple Health stays where Apple keeps it and is never copied into a backup or an export by us.
8. Apple Health
Apple Health is entirely optional and works in both directions only with your explicit permission, granted per data type in Apple's own dialogue. With permission, Calla can write the symptoms you log – hot flashes, night sweats, mood changes, sleep changes, headache, fatigue, bloating, breast pain, vaginal dryness, memory lapses – and read your menstrual flow and sleep so you do not have to enter them twice. This exchange happens on the device. Health data never passes through us, and you can revoke access at any time in the Health app.
9. Exports and the doctor report
You can export everything as JSON or CSV, and generate a PDF report, at any time. Export is never blocked by a paywall or by an expired trial – your data belongs to you whether or not you pay us. Once you share a file, where it goes is up to you and to whichever app you send it through; at that point this policy no longer governs it.
10. What we never do
- Sell, rent or trade your data. There is no data to sell.
- Share anything with advertisers, data brokers, employers or insurers.
- Show advertising, or profile you for it.
- Require an account, an email address or a phone number.
- Put a health value into an analytics event or a crash report.
11. Your rights
If you are in the European Economic Area, the United Kingdom, Switzerland, California or another region with comparable law, you have rights of access, correction, deletion, portability and objection over personal data a company holds about you.
In practice these are already in your hands: your entries are on your device, so access and portability are the export button, and deletion is deleting an entry, clearing your data in Settings, or removing the app. For the little that leaves the phone – analytics and crash reports – you can switch it off in Settings → Privacy, and you can ask us to delete what has already been received by writing to support@callatracker.app; give us the installation identifier shown in Settings → About so we can find it, since we have no other way to identify you. We answer within 30 days.
Our legal basis for analytics and crash reporting is legitimate interests – keeping the app working and knowing which features are worth building – which is proportionate here because the data carries no health values and is tied only to a random identifier that says nothing about who you are. You can object at any time, and the switch in Settings → Privacy is that objection: no reason needed, no feature withheld. For processing a purchase, the basis is performance of our contract with you.
12. Children
Calla is intended for adults and is not directed at children. We do not knowingly collect data from anyone under 16.
13. Retention
Your entries stay on your device until you delete them. Analytics events and crash reports are kept by our processors for as long as they are useful for fixing problems and no longer than 12 months, then deleted automatically.
14. Changes to this policy
If this policy changes in a way that affects what leaves your phone, the date at the top will change and the app will tell you before the change takes effect. Earlier versions are available on request.
15. Contact
Questions, requests or corrections: support@callatracker.app. A person reads every message.