Cycella Privacy Policy

Version 1.3 · Last updated 22 October 2026

This policy explains what happens to your information when you use Cycella, a period tracker. We wrote it in plain words. If anything is unclear, write to us at the address in "Contact and complaints".

Who we are

Cycella is published by Sandeep Sharma, Bardiya, Nepal ("we"). We decide how the Cycella app and its backup server work. We serve users in Nepal, India and other countries, and we follow the privacy laws of the countries our users live in.

Cycella is a product of PixelRidge Web. Published on Google Play by Sandeep Sharma.

The short version

• You do not make an account. We never ask for your name, email, phone number or location.
• Your period, mood, symptom, note and pad logs are stored only on your phone.
• Backup and partner sharing are optional. If you turn them on, your data is locked on your phone before it leaves, and we never get the key. We cannot read it.
• There are no ads, and we add no analytics or trackers to Cycella (one Google component in the QR scanner is explained under "What we never do"). We do not sell or share your data.
• You can delete everything at any time from Me › Delete all my data.

What Cycella keeps on your phone

• Your setup answers (language, last period date, usual cycle length) and whether you are 18 or older.
• Your daily logs: flow, mood, symptoms and notes.
• Your pad count and reminder settings.
• Your app lock PIN, stored as a secure one-way hash, and your backup key, stored in your phone's secure key storage.

This data never reaches us unless you turn on backup or partner sharing. Android's own cloud backup is switched off for Cycella so this data is not copied to Google.

What reaches our server, and why

Our server runs on Vercel (Vercel Inc., a US company) in its Mumbai, India region, so data from users in Nepal is processed in India. Encrypted files are kept in Vercel's storage service. Vercel is our service provider and cannot read your encrypted data. It receives data only when you use these optional features:

Backup (18 or older). A copy of your logs and settings, encrypted on your phone with a 12-word key before upload. The server stores the encrypted file, a random box number and a scrambled (hashed) password for it. It cannot open the file. Purpose: so you can get your data back on a new phone.

Partner sharing (18 or older). Only what you switch on: your mood, your next period date, your pad stock (whether you are low, and how many pads are left) and, if you turn on "Food cravings", the days cravings are likely and whether you logged a craving today. This is encrypted on your phone with a key that only your phone and your partner's phone know. Your partner can send back "I'll bring pads", a preset note, or a short note they type themselves (up to 140 characters), encrypted the same way. Your flow, other symptoms, notes and doctor report are never shared. Purpose: so your partner can support you.

Pairing codes. When you invite a partner, you show your partner a 10-character code. The server receives only the first 6 characters, which it uses to relay the encrypted messages that let the two phones agree on a key. The last 4 characters never leave the two phones. Codes expire after 3 minutes and are deleted after pairing.

PIN key (18 or older, only with an app PIN). A random number, a secret and a PIN check value that protect the copy of your key in your Google or Apple account (see "Your key in your Google or Apple account"). It never includes your PIN or your key. Purpose: so nobody can guess your PIN from that copy.

Install number. When backup or sharing talks to the server, the app sends a random number made for this copy of the app. It is not linked to your phone, SIM or Google account. The server keeps it next to your backup or partner box only to tell you when a different phone opened your box, and deletes it with the box. For the same reason it keeps the time each box was last opened.

Network details. Like any internet service, our hosting provider sees your phone's IP address and the time of each request when backup, sharing or the PIN key talks to the server. Our code uses them only for a few minutes to limit abuse and does not log or save them. Vercel may keep short-lived service logs for security and reliability under its own policy.

Our legal reason for this processing is your consent, which you give when you turn a feature on. You can withdraw it by turning the feature off.

What we never do

• We do not use your data for advertising, and Cycella has no ads.
• We do not sell, rent or trade data.
• We do not add analytics, crash-reporting or tracking tools. One thing to know: the QR code scanner, used only when you scan a recovery or partner code, uses Google's ML Kit, which is built into the app. Google says ML Kit may send Google basic device and app details (such as phone model and app version) and performance metrics. It does not send the camera picture or the code you scan.
• We do not try to identify you or link your encrypted data to you.

How long we keep data

• Data on your phone stays until you delete it or uninstall the app.
• An encrypted backup stays on the server until you turn off backup, change your key or delete all your data. If you uninstall the app first, the encrypted backup stays on the server until you restore it on a phone and turn backup off there.
• A partner box is deleted when either of you stops sharing.
• Pairing codes stop working after 3 minutes and are deleted after pairing or after 3 wrong tries. Expired codes left on the server are cleared later.
• A PIN key is deleted when you change or turn off your PIN, after 10 wrong PIN tries, or when you delete all your data.

Your choices and rights

Under India's Digital Personal Data Protection Act 2023, Nepal's Individual Privacy Act 2018 and similar laws, you can:

• See your data: it is all on your phone, in the app. Me › Backup › Save a copy exports it.
• Correct it: edit any day in the Calendar.
• Delete it: Me › Delete all my data removes everything from your phone and deletes your backup and partner boxes and your PIN key from our server. Me › Backup › Turn off backup deletes only the server copy.
• Withdraw consent: turn off backup or partner sharing at any time.
• Nominate someone: you can name a person to use these rights if you die or cannot act, by writing to us.
• Complain: write to us first (see below). In India you may also complain to the Data Protection Board of India.

Because we hold no account or contact details, we cannot identify you from a request by email alone. For most requests, the controls in the app are the fastest way.

This website (cycella.com)

• The website sets no cookies and uses no analytics, ads or tracking tools, so there is no cookie banner.
• Fonts and every other file are served from cycella.com itself. Your browser does not contact Google or any other third party when you read the site.
• The period calculators run in your browser. The dates you type are not sent to us or stored.
• Our hosting provider, Vercel, sees your IP address and the page you request, and may keep short-lived logs for security and reliability under its own policy. We do not use these logs to identify or track visitors.
• If you email us, we use your email address only to reply (or, if you ask, to tell you when Cycella launches), and delete it when you ask.

The website remembers your theme, calculator language and article votes on your device only. They are never sent to us.

Children

Cycella is for anyone who has periods, including teenagers. If you are under 18, Cycella works fully on your phone, but backup and partner sharing are turned off, so nothing about you is sent to our server. Our server receives no data from anyone who says they are under 18.

Security

Backup and partner data are encrypted on your phone with modern encryption (currently XChaCha20-Poly1305) before they are sent. Our server never receives the keys. Partner data is end-to-end encrypted between the two paired phones. For backup, a copy of your key is also kept in your Google or Apple account, as explained below. You can protect the app with a PIN or fingerprint. No system is perfectly secure. If we learn of a security incident that affects you, we will tell you in the app and report it to the authorities as the law requires.

Your key in your Google or Apple account

Cycella saves a copy of your backup key in your Google account (Android Block Store) or iCloud Keychain (iPhone), so a new phone signed in to the same account can open your backup. This copy goes to Google or Apple, not to us, and is kept under their policies.

If you set an app PIN, the copy is locked with your PIN and also needs a secret held on our server, so someone who gets into your Google or Apple account cannot simply try every PIN. Our server gives this secret only to a phone that proves it knows your PIN, and deletes it for good after 10 wrong PIN tries. After that the copy cannot be opened, but your 12 words or QR code still work. The server stores only a random number, the secret and a PIN check value. It never receives your PIN or your key. If our server cannot be reached when you set your PIN, no copy is kept in your account until it can be. Without an app PIN, anyone who gets into your Google or Apple account could open your backup, so we suggest setting a PIN.

If you are under 18 and set an app PIN, no copy is kept in your account, because it would need our server. Changing or turning off your PIN deletes the old server secret. Me › Delete all my data removes the copy and the server secret.

Your 12-word key

Your backup can only be opened with your 12 words or QR code. We do not have a copy. If you lose every copy of your key and your phone, we cannot recover your data.

Health information

Cycella shows estimates, including predicted periods and fertile days. They are not medical advice and not a method of birth control. See our Terms of Use.

Changes

If we change this policy, we will update the version and date above and show a notice in the app before the change applies to you.

Contact and complaints

Grievance Officer and privacy officer: Sandeep Sharma

Email: info@pixelridgeweb.com

We reply within 30 days.