Privacy policy

The short version

Boring Period Tracker keeps your data on your phone. We don’t collect it, we can’t see it, and there’s no account to sign up for. If you turn on sync, your data is encrypted on your phone before it leaves, and the sync server can’t read it.

The app

What it stores on your phone

Everything you log: period days, flow, pain, symptoms and notes, plus your settings. If you add a name or date of birth to the doctor report, those are stored on that phone only and never synced.

The app’s database is excluded from iCloud and Google device backups, because Apple and Google can read those backups. To keep a copy, turn on sync or export a backup file. Where you keep that file is up to you.

What it doesn’t do

The app contains no analytics, no advertising and no crash-reporting tools. With sync turned off, it makes no network requests at all.

If you’ve allowed your phone to share crash reports with app developers, Apple or Google may pass anonymous crash reports on to us. That’s a setting on your phone, not in the app.

The doctor report

The report is made on your phone. The PDF is written to temporary storage, handed to your phone’s share sheet, and deleted once sharing finishes. Who you send it to is your decision.

Apple Health and Health Connect

The app can import your period history from Apple Health (on iPhone) or Health Connect (on Android). It asks for access only when you choose to import, and only to read. It reads menstrual flow, spotting and a short list of symptoms, once. It never writes anything back, and there’s no ongoing connection.

App lock and the camera

App lock uses Face ID, your fingerprint or your passcode through your phone’s own system. The app never sees your face or fingerprint.

The camera is used only to scan a sync QR code. Permission is requested the first time you scan, and nothing is recorded.

Sync (optional)

Sync is off until you turn it on. When you do, the app creates a random sync key on your phone. No email, name or phone number is involved, so the sync server doesn’t know who you are.

Your data is encrypted on your phone with a key derived from your sync key. That key never leaves your devices. The server stores one encrypted file per sync account and can’t decrypt it.

The sync server stores:

• a hash of an access token derived from your sync key, so it can recognize your devices
• when the sync account was created
• your encrypted data, its size, and when it was last updated

It doesn’t store IP addresses, device details, browser or app information, or when you last connected. Its logs record only the kind of request, the result and how long it took, not which account made it. To slow down abuse, IP addresses are held briefly in memory when sync accounts are created, and are never written to disk.

If someone broke into the server, they would learn how many sync accounts exist, when each was created, and how big and how recently updated each encrypted file is. They would not get any health data or anyone’s identity.

The server runs on Railway. Railway’s edge network, which passes traffic to the server, may keep its own connection logs, including IP addresses. Those logs are covered by Railway’s privacy policy, not this one.

Deleting your data

• Everything on a phone: Settings → Data → Delete all data. If sync is on, the synced copy is deleted from the server first.
• Only the synced copy: Settings → Sync → Delete synced data. The encrypted file and the sync account are removed from the server. Your phones keep their data and stop syncing.
• Uninstalling the app deletes its data from that phone.

If you’ve lost your sync key and every device that had it, the synced copy can’t be linked to you, by you or by us. It stays encrypted and unreadable.

This website

• No analytics, no cookies and no third-party requests. Everything, including the fonts, comes from this domain or your own device.
• If you pick a color at the bottom of the page, the choice is saved in your browser’s local storage, under bpt-color. It never leaves your browser. Going back to Gray removes it.
• The playground runs the real app with made-up data, entirely in your browser. Nothing you do there is saved or sent anywhere.
• The web server keeps no access logs. Railway’s edge network may keep its own connection logs, as above.

Children

Neither the app nor this website is aimed at children. We don’t collect data from anyone, children included.

Changes

If this policy changes, the new version will be posted here with a new effective date. We can’t tell you directly, because we don’t know who you are.

Contact

Questions about this policy go to kailee.hamre@gmail.com.