The less we hold, the less can go wrong

Who we are

Onda is a cycle-sync companion app: it turns where you are in your cycle into a daily plan for training and food. The person responsible for your data (the “controller”, in the language of the GDPR) is:

• Anton Bondarenko, sole proprietorship (jednoosobowa działalność gospodarcza)
• Warsaw, Poland
• NIP (tax ID): 9512542660
• onda@helloonda.com

Write to that address about anything on this page, including any of the rights described below. This policy covers the Onda app and the helloonda.com website.

The short version

Your cycle stays on your phone. The date you enter, the cycle lengths worked out from it, the phase you are in, your onboarding answers, your evening check-ins and your daily plan are stored on the device and are never uploaded. Nothing about your cycle is sold, and no advertising company or data broker receives anything at all.

Three things do leave your phone, and each one only happens if you choose it. If you turn reminders on, we send the times to remind you and the text of the reminder — and because a reminder can say which phase you are entering, that text names a phase. If you create an account, we store your email address and whether your subscription is active. If you opt in to anonymous analytics, we receive usage events that never contain cycle information. That is the whole list, and the section below spells each one out.

What stays on your device

All of this is held in the app's own storage on your phone. There is no copy of it on our servers, which is also why deleting it in the app deletes it for good — we have nothing to restore it from. You can read the same list inside the app under Profile → What we store.

• The date your last period started — the one number the whole forecast is built from.
• Your last few period start dates, so the app can work out how long your cycles usually run and how much they vary.
• The days your periods ended, for how long a period usually lasts.
• Your answers from setting up: how you like to move, what you eat, and whether you use hormonal birth control.
• Your evening check-ins, kept for seven days and then deleted. These are only options you tapped — there is nowhere in the app to type a symptom, by design.
• Which suggestions you have already been shown, so you do not get the same one twice in a row.
• Any dates you have marked on your forecast: the name you gave them and the day.
• Your reminder settings.

Onda does not read Apple Health or Google Fit, and we have no plans to. You are the only source of the information it works from.

What leaves your device, and when

Reminders — only if you turn them on. To deliver a reminder at the right moment, we upload when to send it and the message itself to our server in the EU, and hand both to OneSignal, which does the delivering. Because a reminder can say something like “Follicular starts today”, the text names a phase, and a reminder about a date you marked uses the name you gave that date. Both appear on your lock screen, where anyone near your phone can read them — so choose names for your saved dates accordingly. Be aware of what a schedule implies: a reminder timed to the first day of a phase says when that phase begins, so the send times themselves carry something about your cycle. What we never upload, as data: the date you type, your cycle length, which day of your cycle you are on, your check-in answers, which suggestions you were shown, or the answers you gave when setting up. Each scheduled reminder is deleted from our server within two days of its send time, and turning reminders off in Profile deletes the whole schedule straight away.

Your account — only if you sign in. Signing in with Apple is optional; the app works fully without it. If you do, we store your email address and whether your Onda Pro subscription is active, on our server in the EU. Your cycle data is not part of your account and is not uploaded when you sign in. Deleting your account in the app deletes this too.

Anonymous analytics — only if you opt in. We use PostHog, hosted in the EU, to see which features get used. Events are things like “opened profile”; they never contain your cycle data, your period date, a phase, or the identifier of any suggestion you were shown. This is off unless you switch it on, and you can switch it back off in Profile at any time.

Crash reports. If the app crashes, a technical report goes to Sentry, hosted in Frankfurt, so we can fix it. These carry no cycle data: the app is built so that crash reports cannot contain it, screenshots and session recording are switched off, and the screen names in a report are generic ones like “/today”. Unlike analytics, this is not behind a switch — fixing crashes is a legitimate interest rather than something we ask permission for, and it is only defensible because the reports carry no health information. If that ever changed, we would ask.

Links to research. Onda cites the studies behind its advice, and tapping one opens that paper in your browser. We send nothing with you when you go — but the site you land on is not ours, its own privacy policy applies there, and it will see an ordinary visit the way any website does.

The website and the waitlist

If you join the waitlist, your email address is stored with Resend, the service we use to send email. It is used for exactly one thing: telling you when Onda launches. It is never sold, shared, or added to any other list. Reply to any email we send and we will delete it.

This site uses PostHog in cookieless mode — no cookies, no cross-site tracking, nothing stored on your device, and no consent banner needed because there is nothing to consent to. Events are anonymous page views and button clicks, and your email address is never included in them.

Who else is involved

These are every company that receives anything, what each one gets, and where it is processed. Transfers to companies outside the EU are made under the European Commission's standard contractual clauses.

None of these is an advertising network or a data broker. Only Supabase and OneSignal receive anything derived from your cycle, and only the reminder text and its send time — described above, and only if you turn reminders on. The others never do.

Our legal bases

Information about your cycle is “data concerning health” under Article 9 of the GDPR, which means we need your explicit consent to do anything with it. You give that consent on its own screen in the app, in plain words, before anything happens — and you can withdraw it just as easily.

Reading and accepting this policy is not how you give consent, and we will never treat it as though it were. Consent has to be a separate, deliberate act, and each thing is asked for separately: reminders are one question, analytics another.

• Your cycle data, and sending reminders that can name a phase — your explicit consent, Article 9(2)(a) and Article 6(1)(a).
• Your account and your subscription — necessary to provide what you asked for, Article 6(1)(b).
• Anonymous analytics, and the waitlist email — your consent, Article 6(1)(a).
• Crash reports — our legitimate interest in a working app, Article 6(1)(f), and only while they carry no health information.

How long we keep things

• Evening check-ins: seven days, then the app deletes them automatically.
• Period dates: the last few cycles, because that is what the forecast is calculated from. Older ones are dropped as new ones arrive.
• Everything else on your phone: until you delete it, or until you delete the app.
• Reminder schedules on our server: replaced every time your forecast is recalculated, and removed once a reminder has been sent or is no longer due.
• Your account: until you delete it. Deleting is immediate and final.
• Analytics events: no longer than twelve months.
• Your waitlist email: until you ask us to remove it, or until the launch email has been sent and the list is closed.

Your choices, and your rights

Everything on your phone can be erased from inside the app: Profile → Delete everything. It takes effect straight away, there is no grace period and no undo, and if you have an account it deletes that from our server at the same time. You can also turn reminders off, turn analytics off, or sign out without deleting anything — each is a separate switch in Profile.

Under the GDPR you have the right to ask for a copy of the personal data we hold, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw any consent you have given. For most of it the app is faster than we are, because we do not hold it. Write to the address at the top of this page for the rest.

If you think we have got something wrong, you can complain to your data protection authority. You do not have to come to us first, though we would rather you did.

Children

Onda is intended for people aged 16 and over, and by using it you confirm you are. That is our own condition, set because consent is what makes our use of cycle data lawful and the age at which someone can give that consent alone is 16 in Poland and across much of the EU. It is not the App Store's age rating, which measures whether content is suitable rather than who can consent. We do not knowingly collect anything from anyone younger, and if we learn that we have, we delete it.

If you are in California

We do not sell your personal information and we do not share it for cross-context behavioural advertising — not for money, not for anything else, and there is no opt-out to configure because there is nothing to opt out of. We do not use your health information for advertising or marketing at all.

The categories we collect are described above: identifiers (an email address, if you give us one), commercial information (whether you subscribe), internet activity (anonymous usage events, if you opt in), and health information, which stays on your device. You have the right to know what we hold, to have it deleted, to have it corrected, and not to be treated differently for exercising any of those rights.

If you are in Washington, Nevada or Connecticut

These states have their own rules about consumer health data. Because those rules ask for a separate notice, we have written one rather than burying it here.

Read the Consumer Health Data Privacy Notice

What we never do

Each of these is a decision built into the app, not a promise we are asking you to take on trust:

• No advertising SDKs and no data brokers. None, anywhere in the app or the site.
• We never sell your data, and we never share it with anyone for marketing.
• No session recording or screen replay. A recording of the Today screen would be a video of your health data.
• No AI processing of your cycle data. Nothing about your cycle is sent to a language model, and the app writes nothing at runtime — every explanation ships with the app and has a cited source behind it.
• No importing from Apple Health or Google Fit. You are the only source of what Onda knows.
• No health facts in the name of an analytics event, or anywhere else in one.

Changes, and how to reach us

If we change how any of this works, we will update this page and say so in the app rather than change it quietly. If a change means we need your consent for something new, we will ask for it — a changed policy is not consent.

Questions, requests, or anything that looks wrong: write to the address at the top of this page.