Ten dokument jest na razie dostępny tylko po angielsku.

PMOSly — Privacy Policy

Last updated: 22 October 2026

This Privacy Policy explains what personal data PMOSly ("PMOSly", "the app", "we", "us") collects, why, how it is protected, and the rights you have over it.

PMOSly is a self-tracking app for PMOS (formerly PCOS) — polycystic ovary syndrome — for iOS and Android. It helps you track your menstrual cycle, symptoms, lab results, medications and supplements, and — optionally — fertility signals. We built it privacy-first and local-first: your health data lives on your device, and anything that leaves your device for backup is end-to-end encrypted so that we cannot read it.

Because PMOSly handles reproductive and menstrual health data — among the most sensitive information there is — we hold ourselves to a higher standard than a typical app, and we explain exactly how below.

Quick summary (the plain-English version)

The full detail is below. This summary is for convenience and is not a substitute for the rest of the policy.

1. Who is responsible for your data (the controller)

The data controller for PMOSly is:

Limit Waste Sp. z o.o. ul. Grzybowska 87, 00-844 Warszawa, Poland (EU) KRS: 0000803658 · NIP: 5272905462 · REGON: 384349430 Contact: hello@pmosly.com Data Protection Officer: not appointed — not mandatory for a controller of this size under GDPR Art. 37; re-assessed as the app grows.

If you have any question about this policy or your data, contact us at hello@pmosly.com.

2. The data we process, and why

2.1 Health data (special category data)

When you use PMOSly you can record information about your PMOS/PCOS and general health, such as:

2.1a Apple Health and Health Connect (optional, read-only, free)

If you choose to connect Apple Health (iOS) or Health Connect (Android), PMOSly asks the operating system for permission to read:

PMOSly uses this only to show it to you, as plain values, in the Weight & activity hub, below what you logged yourself (steps for the last 7 days, workouts and nights for the last 14 days). It draws no conclusions from it and does not combine it with your other entries.

Because this data never leaves your device and is not stored by us, we do not process it as a controller; the same transparency approach as in Section 2.1 applies.

2.2 Reproductive and fertility data (optional, extra-sensitive)

If you choose to turn on the optional fertility / trying-to-conceive (TTC) features, you can also record reproductive data such as basal body temperature (BBT), ovulation-test (OPK) results, cervical mucus and intercourse. This data is especially sensitive. We treat it as "extra-private": it is only recorded if you enable these features, it is protected by the same end-to-end encryption as the rest of your data, and the app lets you protect access with a PIN or biometric lock. We do not use it to profile you, we do not share it, and — because of encryption — we cannot read it.

All of the above (Sections 2.1 and 2.2) is health data, and menstrual/reproductive data is a special category of personal data under Article 9 GDPR. We treat it accordingly: it is encrypted on your device (see Section 4) and, where it is backed up, our servers hold only ciphertext they cannot read.

Where this data lives: primarily in a local database on your device. It is sent to our servers only if you turn on backup/sync, and only in encrypted form.

2.3 Account data

If you create an account (optional, only needed for backup/sync), we process:

2.4 Subscription data

PMOSly is freemium. If you subscribe, your purchase is processed by Apple or Google through their app stores — we never receive or store your card or payment details. Through our subscription provider (RevenueCat) we receive your entitlement status (e.g. whether you have an active trial or subscription, the product, and renewal/expiry dates) so the app can unlock premium features. This is linked to a subscription identifier, not to your health data.

2.5 Sync metadata (please read — honest disclosure)

Even though the content of your health records is encrypted and unreadable to us, the act of syncing exposes a small amount of metadata to our server for each encrypted record:

This means our server can see that an encrypted record of a certain type exists and when you add, change or delete records — i.e. the cadence of your activity — but not what the record says. We consider this a deliberate, disclosed trade-off of offering encrypted sync. We bind each encrypted blob cryptographically to its record identity so a record cannot be silently swapped, and we keep each app in a separate EU database to avoid combining signals across conditions. We do not use this metadata to profile you or for advertising.

2.6 Product analytics (optional, pseudonymous, opt-in)

To understand how the app is used and to improve it, we may collect pseudonymous, first-party product analytics — for example onboarding steps completed (which step, never your answers), that the app was opened, paywall views and where they were opened from, subscription events, and a change of app language. These analytics:

Withdrawing consent stops analytics and deletes the local identifier, and so does Delete all data. A later opt-in creates a new identifier. Deleting the local identifier does not automatically delete events already stored on our servers; you can contact us about exercising your data-protection rights.

Unlike a typical hosted analytics service, we run our own self-hosted instance of OpenPanel on infrastructure we control within the EU (a data centre in Germany): your usage events are processed and stored on our own servers in the EU and are not shared with any third-party analytics company. Retention is short; pseudonymous events can be grouped by installation to calculate aggregate statistics.

Anonymous counters (no persistent identifier). Separately from the opt-in analytics above, the app counts a few product events whether or not analytics are on: that the analytics question was shown, and whether it was accepted, declined or dismissed. Each count is sent to our backend (Supabase, EU region) with only the event name, a random session number that is created fresh every time the app starts (it is not saved on your phone and never reused in a later session), a sequence number within that session, the platform (iOS/Android), the app version, the app language, and two coarse ranges (roughly how long ago the app was installed, and on roughly how many days it has been used). It carries no health data and no account, device or advertising identifier, and it is sent with the app's public key rather than your sign-in, so it is not linked to your account. The stored count does not contain your IP address; as with any internet request, Supabase's technical request logs record the IP address and approximate location of the request for a limited retention period.

Premium news counters. We also count views of the Premium news screen and the first choice to close it or see the Premium offer, whether or not product analytics are enabled. Unlike the counters described above, each request contains only a fixed event name identifying the release announcement, the action and whether Premium was already available when the screen opened. No session number, sequence, platform, version, language or usage ranges accompany these counts. They use the same public-key transport and contain no health content, account or device identifier. They measure totals rather than individual journeys or completed purchases. The stored count has a server timestamp; the separate technical request logging described above still applies.

2.7 Crash and diagnostic data

To keep the app working and fix bugs, we run a self-hosted crash/error reporter (GlitchTip, which speaks the Sentry protocol) on infrastructure we control in the EU. This runs by default because a broken app can't be a safe health tool — our legal basis is legitimate interest (Section 3), not consent — but you can object to it at any time in More → Privacy & security → Error diagnostics, which stops it immediately. A crash/error report carries only the type of error, a short technical cause from a fixed list (for example "host lookup" or "timeout"), the technical stack trace, the app version, the operating system and the app language. The error message itself, screen names, logs, tags and any other attached data are removed on your device before sending, so a report cannot contain what you logged. No persistent device identifier is attached.

We also offer an in-app feedback tool (Wiredash). It is not active unless you open it from More → Privacy & security → "Report a problem" — it is loaded only when you tap that row, so nothing is collected or sent until you choose to write and submit feedback. Feedback is likewise scrubbed of health data.

2.8 Our website (pmosly.app / pmosly.com)

Our marketing website may use privacy-friendly, first-party analytics to understand aggregate traffic (for example page views and country-level, not street-level, location). We use Vercel Analytics and, where enabled, a self-hosted OpenPanel instance; these are configured to avoid cross-site advertising cookies. The website does not show ads or use third-party ad trackers. Any strictly necessary cookies are used only to make the site work. The website does not collect your health data.

2.9 Files you create and share: data export and doctor report

Data export. In More → Privacy & security → Export my data you can export everything you have logged: one CSV file per entry type, plus your medications, medication intakes and profile settings, packed into a single ZIP file. The file is built on your device (it works offline) and handed to your phone's share sheet, so you decide where it goes (for example Files, email, or a cloud drive). Before each export the app asks whether to include your fertility observations and intercourse entries; they are left out unless you choose to include them for that export. The export never passes through our servers, and we never receive a copy. The file is not encrypted: once you share it, it is handled by the app or service you chose and under that provider's terms. A copy of the file stays in the app's temporary storage on your phone until your phone clears that storage or you delete the app.

Doctor report. The PDF doctor report is likewise built on your device from the period you pick and shared only through your phone's share sheet. It lists values you logged, including basal body temperature and cervical-mucus observations if you logged them; intercourse entries are included only if you switch that on for that report. We do not receive the report. As with the export, a copy of the PDF stays in the app's temporary storage on your phone until your phone clears it or you delete the app.

2.10 Anything sensitive we want to do later requires your explicit opt-in

Any feature that would need our servers to read your data (for example optional server-side AI narration) is off unless you explicitly turn it on, and would run only on a minimized, de-identified, temporary slice of data. We will never do this silently, and this policy will be updated before any such feature ships.

3. Legal bases (GDPR)

What we process Legal basis
Providing the core app and storing/syncing your encrypted data Performance of a contract (Art. 6(1)(b)) — our Terms with you
Processing your health, menstrual, reproductive and fertility data (special category) Your explicit consent (Art. 9(2)(a)), given during onboarding; you can withdraw it at any time
Managing your account and authentication Performance of a contract (Art. 6(1)(b))
Subscriptions and entitlements Performance of a contract (Art. 6(1)(b))
Anonymous first-party analytics (opt-in) Your consent (Art. 6(1)(a)); you can withdraw it at any time
Crash/error diagnostics (on by default, self-hosted in the EU) Legitimate interest (Art. 6(1)(f)) — keeping the app working and safe; you can object at any time in More → Privacy & security
Complying with legal obligations Legal obligation (Art. 6(1)(c))

We apply data minimization: we collect only what we need, and we keep health content unreadable to us by design.

4. How your data is protected: end-to-end encryption (zero-knowledge)

This is the most important part of how PMOSly works, so we explain it plainly.

The trade-off you must understand (data-loss risk)

Because only you control the key, nobody else — including us — can reset it. If you lose access to all of your devices AND lose your recovery code, your encrypted backup cannot be recovered. We will not be able to restore it for you. This is the unavoidable cost of true zero-knowledge encryption, and we want you to know it clearly:

Save your recovery code somewhere safe. If you lose all your devices and your recovery code, your backed-up data is permanently unrecoverable.

Data that is only on your device (no account/backup) follows the same logic: if you lose or wipe the device with no backup, that local data is gone.

Other safeguards: reminders are delivered as local notifications and push notifications never contain health content; access to our infrastructure is restricted and logged; we keep each app in a separate EU project.

No method of storage or transmission is 100% secure, but zero-knowledge encryption means that even a breach of our servers would expose only unreadable ciphertext, not your health content.

5. Who we share data with (processors and recipients)

We do not sell your personal data, and we do not share it with advertisers. We never share your menstrual, reproductive or fertility data with anyone. We use a small number of service providers ("processors") who act on our instructions:

Provider Purpose What they can access
Supabase (EU region) Account authentication, encrypted backup/sync storage, and the anonymous counters in Section 2.6 Your email (auth) and encrypted, unreadable health blobs + the sync metadata in Section 2.5; for the anonymous counters, the event and coarse context described in Section 2.6 and, in technical request logs, the request's IP address
RevenueCat Subscription/entitlement management Subscription/entitlement status tied to a subscription identifier — no health data
Apple App Store / Google Play Processing your subscription payment Your payment details (handled entirely by them; we never see your card data)
Our own self-hosted analytics (OpenPanel) — hosted in the EU (Germany) on infrastructure we control First-party product analytics (opt-in, off by default) First-party usage events on infrastructure we control — no health content, no ad identifiers, no third-party analytics company involved
Our own self-hosted crash reporter (GlitchTip) — EU infrastructure we control Crash / error diagnostics (on by default, legitimate interest; you can object) Scrubbed error + stack trace — no health content, no persistent device identifier
Wiredash In-app feedback (loaded only when you open it) Feedback you choose to send, technical metadata — no health content
Vercel / OpenPanel (website) Website hosting and privacy-friendly website analytics Aggregate website traffic data — no app health data

We may also disclose data if legally required (e.g. a valid court order) — but for your health content this would only ever be unreadable ciphertext, because we do not hold your key. We consider the protection of reproductive-health data especially important and will resist any overbroad or unlawful request to the extent the law allows.

Apple and Google process your purchases under their own privacy policies; please review them.

6. International data transfers

Your account data and encrypted backups are hosted in the European Union (Supabase EU region), and our self-hosted product analytics (OpenPanel) and crash reporter (GlitchTip) run on EU infrastructure — so your usage and diagnostic data stay in the EU and are not sent to a third-party analytics or crash-reporting company abroad. We design PMOSly so that no health data is transferred or stored outside the EU/EEA.

Some providers (for example app-store billing, or a non-EU tool if we use one) may process limited data outside the EEA. Where that happens, the transfer is protected by an appropriate safeguard such as the EU Standard Contractual Clauses or an adequacy mechanism (e.g. the EU–US Data Privacy Framework). If our processor list changes in a way that affects transfers, we will update this policy. (Confirm the final processor list with your lawyer.)

7. How long we keep your data

When you delete your account, we delete your account data and encrypted backups from our active systems within a reasonable period, except where we must keep limited records to meet a legal obligation (e.g. proof of a transaction). See our account deletion page for step-by-step instructions.

8. Your rights

Under the GDPR you have the right to:

How to exercise them:

Note: because of zero-knowledge encryption, an "access/export" request is fulfilled on your device, where your data is readable. We cannot export your health content from our servers because we cannot decrypt it.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO), or the authority in your EU country of residence.

9. Children

PMOSly is not intended for children. You must be at least 16 years old to use the app and to create an account, consistent with Poland's GDPR Art. 8 digital-consent age. We do not knowingly collect data from anyone under that age; if we learn that we have, we will delete it.

10. Changes to this policy

We may update this policy as the app evolves or the law changes. We will update the "Last updated" date and, for material changes (especially anything affecting your health data or a new processing purpose), we will notify you in the app and, where required, ask for renewed consent before the change takes effect.

11. Contact

Questions, requests, or complaints: Limit Waste Sp. z o.o. — hello@pmosly.com — ul. Grzybowska 87, 00-844 Warszawa, Poland (EU)