Legal
Privacy Policy
Last updated: 21 October 2026 · Effective on the date Phasly is made publicly available.
Plain-English summary: Phasly is a health app, so we handle some of the most sensitive data there is. We collect only what we need to personalise your training, we keep your intimate data in a separate private space, and your data is encrypted in transit and at rest. It is never sold, never used for ads and not used to train AI models. You can export your data, and you can delete your data any time. The full detail is below.
Important. Not a medical device. Phasly is a wellbeing tool, not a regulated medical device. We do not provide medical advice or diagnosis, and we do not use cycle data for contraception decision-making. If something feels off, like heavy bleeding, severe pain or missed periods, please consult a clinician (ACOG Committee Opinion 651).
1. Who we are
Phasly LLC, a California limited liability company ("Phasly", "we", "us" or "our"), provides a cycle-aware fitness and wellbeing application that personalises training to your menstrual cycle and to how you feel each day. This Privacy Policy explains what personal information we collect, how we use and protect it, and the choices you have. It applies to our website, our mobile apps and any related services (together, the "Service").
For the purposes of data protection law, Phasly LLC is the data controller of the personal information described here. Our registered address is:
Phasly LLC
Northwest Registered Agent, Inc.
2108 N St, Ste N
Sacramento, CA 95816
United States
+1 424-540-2333
2. What we collect
Information you give us
- Account details: your name and email address, and authentication data when you sign in (including via Google or Apple sign-in, if you choose them).
- Health & cycle data (sensitive): period and bleed dates, cycle and phase information, ovulation-test results, contraception type, relevant health conditions, pregnancy/postpartum status, and your daily check-ins. energy, sleep, readiness, mood and symptoms. If you turn on body metrics, also your weight, waist and hip measurements and body fat percentage, and your weight goal.
- Intimate activity data (sensitive): if you choose to log it, sexual-activity entries and protection used. This is stored in a separate, access-controlled space and is never shown on your main calendar.
- Fitness data: workouts, exercises, goals and training history you create in the app.
- Communications: messages you send us (e.g. support emails and feedback), reports you send about Phoebe's messages, and your waitlist / early-access sign-up.
Information we collect automatically
- Device & diagnostic data: app version, device type and operating system, and diagnostic and performance data, used to keep the app working. The app contains no product analytics and no advertising SDK.
- Push token: if you allow notifications, a device token so we can deliver them to your phone.
- Crash & error reports: technical logs that help us fix bugs.
- Language & region: your phone's language and region setting (for example en-US), and your time zone for reminders. We read these from your device settings. We do not use GPS or your IP address to locate you. We use them to decide which languages and countries to support.
We do not use your health or intimate data for advertising, and we do not allow advertisers to target you based on it.
3. How we use your data
- To create and run your account and authenticate you securely.
- To generate your personalised, phase-aware and check-in-aware training plans and coaching.
- To sync your data across your devices so you don't lose it.
- To provide customer support and respond to your requests.
- To maintain, secure, debug and improve the Service, including checking the quality and safety of Phoebe's replies.
- To send you service-related and (where you've opted in) launch and product emails. You can unsubscribe at any time.
- To comply with legal obligations and enforce our Terms.
4. Legal bases & consent
Where the GDPR or similar laws apply, we rely on the following legal bases: your consent (especially for health and intimate data, which are special-category data), performance of a contract (to provide the Service you sign up for), legitimate interests (to secure and improve the Service, balanced against your rights), and legal obligation where required.
Before you enter any health information, the app asks for your explicit consent in two separate checkboxes. One covers processing your health and cycle data to personalise your plan. The other covers sending your messages and relevant cycle context to Anthropic, our AI provider, so Phoebe can reply. We record when you gave each one.
You can withdraw your consent at any time by editing or deleting the relevant data or your account. Withdrawing consent doesn't affect processing that already happened.
5. Who we share data with
We do not sell your personal information. We share it only with service providers ("processors") who help us run the app, under contracts that require them to protect it and use it only on our instructions. These currently include:
- Cloud database & authentication (e.g. Supabase), to store your account and app data securely.
- AI processing (Anthropic, PBC). Phasly's coach, Phoebe, is powered by Anthropic's Claude models. When you chat with Phoebe or use AI-generated features (workout suggestions, weekly digests, message translation, coach memory, PDF import), the content of your messages together with relevant profile and cycle context is sent to Anthropic's API to generate the response. Your intimate calendar and your email address are never sent. Anthropic acts as our data processor under contract: this data is not used to train AI models, and Anthropic's API inputs and outputs are deleted within 30 days, longer only if flagged for safety review or required by law.
- Email delivery (Resend), to send account, support and launch emails, and to forward reports you send about Phoebe's messages to our team. Those report emails contain the report category and a reference number, not your health entries or the reported message.
- PDF rendering (Cloudflare). When you export your cycle history as a PDF, the page is rendered on Cloudflare Workers. It is processed in memory to produce the file and not stored.
- Push notifications (Expo, Apple Push Notification service, Google Firebase Cloud Messaging), to deliver notifications to your device using its push token.
- Sign-in providers (Apple, Google), only if you choose to sign in with them, to confirm your identity.
- Error & crash monitoring (Sentry), to detect and fix technical problems. Crash reports contain device and diagnostic data, not your health entries.
- Subscription management (RevenueCat), to manage subscription status and entitlements across devices. RevenueCat receives purchase and subscription-status information, never your health data.
- App stores & payment processors (e.g. Apple App Store, Google Play), to handle subscriptions and billing. We do not receive or store your full card details.
- Website analytics & advertising measurement (Google Analytics, Meta, TikTok), on phasly.app only, with cookie consent, and never connected to your in-app health data.
We may also disclose data if required by law, to protect our rights or users' safety, or in connection with a merger or acquisition (in which case we'll notify you).
5a. Consumer Health Data Privacy Policy
This section is our consumer health data privacy policy under the Washington My Health My Data Act, Nevada SB 370 and similar state laws, and it sets the special rules we hold ourselves to. Your cycle, symptom, body measurement, pregnancy, contraception and intimate data are special-category health data. On top of everything above, these rules apply specifically to them:
- Where it lives. In our cloud database (Supabase), protected by row-level security so only your authenticated account can read your rows, encrypted in transit (HTTPS/TLS) and encrypted at rest (AES-256).
- Only with your consent. We collect and process health data only after you tick the consent boxes in the app. You can withdraw it by deleting the data or your account.
- Who ever sees it. Only these processors can touch health entries: Supabase (storage), Anthropic (generating Phoebe's replies, weekly digests, translations and PDF import) and Cloudflare (rendering the cycle-history PDF you choose to export, processed in memory and not stored). Authorized Phasly staff may review conversations with Phoebe, only to check the quality and safety of her replies. No analytics tool, no advertiser and no crash reporter receives your health entries.
- Apple Health. If you connect Apple Health, Phasly reads, with your permission, menstrual flow, spotting, ovulation tests, cervical mucus, contraception, pregnancy tests and sexual activity, and may write the workouts you complete. Data you import is stored in your Phasly account (Supabase) and may be used as cycle context for Phoebe's replies through Anthropic, as described above. Sexual-activity data is never sent to Phoebe. HealthKit data is used only for the app's features, is never used for advertising or marketing, is never sold and is not stored in iCloud, in line with Apple's HealthKit rules.
- Never for ads. Never sold. We do not use health data for advertising, do not sell it, and do not "share" it for cross-context behavioural advertising as defined by the CCPA/CPRA.
- Not for contraception. Phasly's predictions and fertile-window estimates are informational. We do not offer or market them as a contraceptive method.
- How to delete it. Delete individual entries in the app anytime, or delete everything at once in Profile Settings → Delete account. Deletion removes your cycle history, day logs, workouts and coach memory from our database. No longer have the app? Use the account deletion request form, no install and no login needed.
6. How we protect your data
We use industry-standard safeguards, including encryption in transit (HTTPS/TLS) and at rest (AES-256), access controls and database row-level security so each user can only reach their own data, and secure storage of authentication tokens on your device. No system is perfectly secure, but we work hard to protect your information and to limit who can access it internally.
7. How long we keep it
We keep your personal data for as long as your account is active or as needed to provide the Service. If you delete specific entries, they are removed from your account. If you delete your account, your data is removed from our live database immediately. Encrypted database backups roll off on our provider's schedule. Our processors keep limited records, such as email logs, crash reports and purchase records, for their own retention periods. We keep limited records only where the law requires it.
8. Your rights & choices
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and get a copy (data portability / export).
- Correct inaccurate data.
- Delete your data and your account.
- Restrict or object to certain processing, and withdraw consent.
- Lodge a complaint with your local data-protection authority.
You can exercise most of these rights directly in the app (Profile Settings → Delete account removes everything), through the deletion request form if you no longer have the app installed, or by emailing us at privacy@phasly.app. We won't discriminate against you for exercising your rights.
California (CCPA/CPRA). California residents have the right to know what personal information we collect and how it's used, to access and correct it, to delete it, and to opt out of "sale" or "sharing" of personal information. Phasly does not sell your personal information and does not share it for cross-context behavioural advertising. To exercise these rights, use the in-app controls or email privacy@phasly.app. we will verify and respond within the statutory window.
EU/EEA and UK (GDPR). The rights above (access, rectification, erasure, restriction, objection, portability, withdrawal of consent) apply in full, and you may lodge a complaint with your supervisory authority. Health and intimate data are processed on the basis of your explicit consent.
9. Children
Phasly is not directed to children. You must be at least 18 years old to use the Service. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has provided us data, contact us and we will delete it.
10. International transfers
Your data may be processed in countries other than your own, including where our service providers operate. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) to protect your data when it is transferred internationally.
11. Changes to this policy
We may update this Privacy Policy as the Service evolves. If we make material changes, we'll update the "Last updated" date and, where appropriate, notify you in the app or by email. Continued use of the Service after changes take effect means you accept the updated policy.
Questions, requests or concerns about your privacy? Email us at privacy@phasly.app. We read every message.
Or write to the data controller:
Phasly LLC
Northwest Registered Agent, Inc.
2108 N St, Ste N
Sacramento, CA 95816
United States
+1 424-540-2333