Privacy Policy

1. Who We Are

Iyadu Cycle is an independent iOS application that helps Muslim women understand and track their full menstrual cycle in the context of their faith. The app covers period and symptom tracking, prayer and fasting eligibility, Ramadan missed fast management, makeup fast scheduling, and Umrah travel planning.

Data Controller: Fartun Ahmed, individual developer of Iyadu Cycle.
Contact: iyadu.cycle@gmail.com
Jurisdiction: United States

For the purposes of the General Data Protection Regulation (GDPR), Fartun Ahmed is the data controller responsible for the limited personal data held on our servers, specifically your email address used for authentication. All health-related data is stored solely on your device and is not subject to our control.

2. The Short Version

3. What Data We Collect and Why

Data stored only on your device (we never see this):

• Period start and end dates
• Flow level and cycle symptoms
• Missed fast records and makeup fast schedules
• Spotting entries
• Cycle length and period length settings
• App preferences including dark mode and notification settings

Data stored on our secure servers (Supabase):

• Your email address, used solely for account authentication and password recovery
• A boolean flag indicating whether you have completed onboarding
• Your account creation timestamp

Note on data migration: If you used an earlier version of Iyadu Cycle, your health data may have been temporarily stored in our Supabase database as part of the original architecture. When you open the current version of the app for the first time, this data is automatically transferred to your device and removed from our servers. After migration completes, no health data remains on our servers.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your personal data on the following legal bases as defined under the General Data Protection Regulation:

• Contract performance (Article 6(1)(b) GDPR): We process your email address because it is necessary to provide you with the service you have requested, specifically account creation, authentication, and password recovery.
• Legitimate interests (Article 6(1)(f) GDPR): We retain a record of onboarding completion to ensure the app functions correctly for returning users.

We do not process any special category data (including health data) on our servers. All health-related data is processed exclusively on your device and is never transmitted to us.

5. How We Use Your Data

We use your email address solely to:

• Authenticate you when you sign in
• Send a one-time verification code if you request a password reset
• Verify your account during initial sign-up

We do not use your data to send marketing communications, build advertising profiles, conduct behavioural tracking, or train machine learning models. We operate no advertising partnerships and use no analytics SDKs.

6. Umrah Planner

The Umrah Planner feature uses your cycle data stored on your device to predict whether you are likely to be in a state of tahara during your intended travel dates. This prediction is calculated entirely on your device using your local period history. No cycle data, travel dates, or predictions are transmitted to our servers or any third party. The Umrah Planner is provided for informational and planning purposes only and does not constitute medical or religious advice.

7. Local Notifications

If you enable makeup fast reminders, Iyadu Cycle schedules local notifications entirely on your device. No data is transmitted to our servers in connection with notification scheduling. You may disable notifications at any time through your iPhone Settings.

8. Sign in with Apple

You may authenticate using Sign in with Apple. When you do so, Apple shares your email address or a private relay address of your choosing with us. We store this address solely for authentication purposes as described in Section 3. Apple's data practices are governed by Apple's Privacy Policy.

9. Data Sharing and Disclosure

The sole third-party service we use is Supabase for authentication infrastructure, which is subject to Supabase's Privacy Policy. Supabase receives only your email address and the authentication tokens necessary to verify your identity.

We may disclose your personal data if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.

10. Data Security

Your health data is stored in your device's local storage, protected by your device's native security including Face ID, Touch ID, and your device passcode. Authentication session tokens are stored in your device's encrypted Keychain.

All communication between the app and our authentication servers is encrypted using TLS. We implement industry-standard security measures to protect the limited personal data we hold on our servers.

No method of electronic storage or transmission is 100% secure. While we use commercially reasonable means to protect your data, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

11. Children's Privacy

Iyadu Cycle is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If you are a parent or guardian and believe your child has created an account with us, please contact us at iyadu.cycle@gmail.com and we will delete their account and email address from our servers promptly. Please note that all health data entered in the app is stored only on the device and must be removed by deleting the app from that device.

12. Your Rights

All users:

• Access: All health data is visible directly within the app at all times.
• Correction: You may edit or delete any entry directly within the app.
• Deletion: Go to Settings, then Delete Account within the app. This permanently removes all health data from your device and deletes your account and email from our servers immediately. No request to us is necessary.

California residents (CCPA/CPRA):

• Right to know: You have the right to know what personal data we collect. We collect your email address and onboarding completion status only, as described in Section 3. Passwords are never stored by us — they are managed exclusively by our authentication provider, Supabase, in hashed form.
• Right to delete: You may delete your account and all associated data via Settings in the app.
• Right to opt out of sale: We do not sell your personal data. There is nothing to opt out of.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

EEA and UK residents (GDPR/UK GDPR):

• Right of access: The only personal data we hold about you is your email address and onboarding completion status. You may request confirmation of this by contacting us.
• Right to rectification: If your email address is incorrect, the safest course is to delete your account and create a new one. We do not update email addresses as this would create a security risk.
• Right to erasure: You may delete your account directly within the app via Settings. No request to us is necessary. This immediately and permanently removes your email and account data from our servers.
• Right to restrict processing: We use your email address solely for authentication. If you no longer wish for us to process it, you may delete your account via Settings in the app, which immediately removes your email from our servers.
• Right to data portability: We hold only your email address on our servers. All health data lives on your device and is accessible to you directly within the app at all times.
• Right to object: We use your email address only to provide the authentication service you signed up for. If you object to this processing, you may delete your account via Settings in the app, which immediately stops all processing of your data.
• Right to lodge a complaint: You have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us at iyadu.cycle@gmail.com. We will make reasonable efforts to respond to your inquiry in a timely manner. Note that most actions, including account deletion, can be completed instantly and independently through the app without needing to contact us.

13. Data Retention

Health data is retained on your device for as long as the app is installed. Deleting the app permanently removes all local health data.

Your email address and account data are retained on our servers for as long as your account remains active. Deleting your account via Settings permanently removes your email and all associated account data from our servers immediately and irreversibly.

We do not retain personal data beyond what is necessary to provide the service.

14. International Data Transfers

Iyadu Cycle is operated from the United States. Our authentication infrastructure is provided by Supabase, which may process data in the United States or other jurisdictions. If you are located in the European Economic Area, your email address may be transferred to and processed in countries outside the EEA, including the United States.

Where such transfers occur, they are subject to appropriate safeguards including Supabase's compliance with applicable data transfer mechanisms. By using the app, you consent to this transfer.

15. Governing Law and Limitation of Liability

This Privacy Policy is governed by the laws of the United States. To the fullest extent permitted by applicable law, Fartun Ahmed, the individual developer of Iyadu Cycle, shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the app or any breach of this policy.

Our total liability to you for any claims arising under this Privacy Policy shall not exceed the amount you have paid us in the twelve months preceding the claim. As Iyadu Cycle is currently offered free of charge, this amount is zero.

16. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. The effective date at the top of this page reflects when the policy was last updated. We recommend checking this page periodically for any changes.

By downloading, installing, or continuing to use Iyadu Cycle, you acknowledge that you have read and agree to this Privacy Policy. Your continued use of the app after any changes to this policy constitutes your acceptance of the updated terms. If you do not agree to this policy or any updates to it, you should discontinue use of the app and delete your account.