Privacy Policy

Last updated: August 6, 2026  ·  OvaLink by Aftermath Designs Limited

OvaLink ("we", "our", "the app") is a period and cycle tracking application for iOS developed by Aftermath Designs Limited (registered in England & Wales, Co. No. 16724522). This Privacy Policy explains what personal data we collect, how we store and use it, when it may be shared, and your rights.

1. Data controller

The data controller for your personal information is Aftermath Designs Limited. You can reach us at support@aftermathdesignslimited.com for any privacy-related requests.

2. What data we collect

The table below lists every category of data OvaLink may collect and where it is stored.

Category	What it includes	Where stored
Cycle data	Period start/end dates, cycle length, period duration, predicted cycles and ovulation dates	Device only
Daily symptoms	Cramps, headache, back ache, bloating, fatigue, nausea, acne, constipation, diarrhea, breast tenderness, insomnia, food cravings	Device only
Mood	Happy, calm, irritable, sad, anxious, numb, guilt	Device only
Flow details	Bleeding intensity (spotting / light / medium / heavy / clots), colour (bright red / dark red / brown / pink)	Device only
Vaginal discharge	Clear, sticky, watery, creamy, itchy, dry	Device only
Sexual health	Activity type, libido level, physical comfort	Device only
Test results	Pregnancy test (positive/negative), ovulation test (positive/negative)	Device only
Pregnancy tracking	Pregnancy-specific symptoms, baby movements, folic acid intake, water intake	Device only
Postpartum tracking	Lochia intensity, postpartum mood, breastfeeding sessions, breast symptoms	Device only
Medication data	Medication name, dose, schedule (daily/weekly/every 2 days/every 5 days), reminder times, stock count, instructions, taken/not-taken history, birth control flag	Device only
Physical activities	HIIT, yoga, pilates, cardio, strength training, walking, swimming, cycling, meditation, dancing	Device only
Diary notes	Free-text personal health journal entries	Device only
User profile	Display name, app role (user / partner), onboarding answers (tracking goal, usual cycle length)	Device only
Partner sync data	Connected partner's name, relationship type, shared cycle phase summary	Firebase (when feature is active)
Account credentials	Email address and/or Google account identifier (only when you sign in)	Firebase Authentication

3. How we use your data

• Cycle predictions & AI analysis — Past data you enter is used entirely on-device to predict your next period, fertile window, and ovulation. No health data is sent to external servers for AI processing.
• Push notifications — Medication reminders, period prediction alerts, and hygiene timer warnings (tampon / menstrual cup) are generated on-device using your local data.
• Partner sync — If you activate this feature, a cycle phase summary is shared with your connected partner via Firebase. Symptoms, medications, notes, and detailed logs are never shared. You can disconnect at any time.
• PDF health report — On request, your health data is exported into a PDF on your device. It is not transmitted anywhere unless you choose to share the file.
• Medication database queries — When you search for a medication, the medication name is sent to the OpenFDA API to retrieve drug label information. No personal identifying information is included in these requests.
• Optional cloud backup — If you enable backup, your data is encrypted and uploaded to Firebase. This is optional and reversible.
• Subscription management — RevenueCat receives your subscription status and purchase receipt to verify entitlements. No health data is shared with RevenueCat.

4. Where your data is stored

Cloud storage is used only in the following cases:

• Firebase Authentication — Your email address or Google account identifier is held by Firebase when you create an account.
• Firebase Firestore (partner sync) — When partner sync is active, a phase summary is written to Firestore under your anonymous user ID. You can disconnect at any time; the data is removed when you do.
• Firebase Firestore (optional backup) — If you opt in, your encrypted health data snapshot is stored under your user ID for restoration purposes. This is not used for analytics or profiling.

All data in transit to Firebase is encrypted with TLS. Firebase security rules enforce that only the account owner can read or write their data.

5. Third-party services

OvaLink uses the following third-party services, each governed by its own privacy policy:

• Firebase Authentication, Firestore & Cloud Messaging (Google) — Account management, optional backup, partner sync, push notifications. firebase.google.com/support/privacy
• Firebase Cloud Functions (Google) — AI-assisted health analysis features (premium only). Only the data required for a specific request is processed; it is not retained. firebase.google.com/support/privacy
• Google Sign-In — Optional sign-in method. Only your Google account identifier and email are received. policies.google.com/privacy
• RevenueCat — Subscription and in-app purchase management. Receives purchase receipts and subscription status only. revenuecat.com/privacy
• OpenFDA API (US FDA) — Drug label and interaction lookups. Only the medication name is sent; no personal data is transmitted. open.fda.gov/about/privacy
• Apple App Store — App distribution and payment processing. Apple handles all payment card data. apple.com/legal/privacy

We do not use advertising SDKs, tracking pixels, or analytics platforms that profile users.

6. Data sharing

We do not sell, rent, or share your personal health data. Your information may only be shared in the following limited circumstances:

• Service providers listed above — Firebase, RevenueCat, and OpenFDA receive only the minimum data required to operate their respective services.
• Partner sync (your choice) — If you generate a pairing code and connect with another person, a cycle phase summary is shared with that person. You can disconnect at any time from Settings.
• PDF export (your choice) — Your health report is only shared if you actively send the file to a recipient (e.g. a doctor).
• Legal obligations — We may disclose data if required by a valid court order or applicable law. We will notify you where legally permitted.

7. Push notifications

OvaLink may send the following notifications, all of which are generated on-device from your local data:

• Medication reminders
• Period prediction alerts
• Tampon / menstrual cup timer warnings
• Low medication stock alerts
• Partner cycle phase notifications (when partner sync is active)

You can disable notifications at any time in iOS Settings → OvaLink. Notification content is not sent to our servers.

8. In-app purchases and subscriptions

OvaLink offers weekly, monthly, annual, and commitment premium subscriptions. All payments are processed by Apple through the App Store. We never receive your payment card details.

RevenueCat manages subscription status and entitlement verification. RevenueCat receives your App Store receipt and subscription identifier — no health data is ever shared with RevenueCat. You can manage or cancel your subscription at any time in iOS Settings → Apple ID → Subscriptions.

9. Data retention and deletion

• Local data is removed immediately when you delete the app from your device.
• Cloud backup data is deleted when you use the Delete Account option in Settings. Deletion is permanent and takes effect within 30 days.
• Partner sync data stored in Firestore is removed when you disconnect the partner link or delete your account.
• Firebase account credentials are deleted when you delete your account via the app.

To delete all your data: go to Settings → Delete Account. This removes your Firebase account, all cloud backups, and any partner sync documents.

10. Children's privacy

OvaLink is not intended for users under the age of 17. We do not knowingly collect personal data from children under 17. If you believe a child has used OvaLink and entered health data, please contact us at support@aftermathdesignslimited.com and we will delete it promptly.

11. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request that we limit how we use your data
• Portability — export your data as JSON or PDF from within the app
• Objection — object to processing where we rely on legitimate interests
• Withdraw consent — you can disconnect partner sync, disable backup, or delete your account at any time

For data requests, contact us at support@aftermathdesignslimited.com. We will respond within 30 days. If you are in the UK or EU and are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) or your local supervisory authority.

12. Security

We take the security of your health data seriously:

• All data in transit to Firebase is encrypted with TLS 1.2+.
• Firebase Firestore security rules ensure only authenticated account owners can access their own data.
• Optional cloud backup data is encrypted before upload.
• Partner sync transmits only a cycle phase label — never raw logs, symptoms, or medication data.
• We do not store encryption keys server-side.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you within the app on next launch. Continued use of OvaLink after a policy update constitutes acceptance of the revised terms.

14. Contact us

For privacy questions, data requests, or complaints:

Aftermath Designs Limited
Email: support@aftermathdesignslimited.com
Registered in England & Wales, Co. No. 16724522