What stays on your phone, and what leaves it

Who we are

Onda is a cycle-sync companion app: it turns where you are in your cycle into a daily plan for training and food. The person responsible for your data (the “controller”, in the language of the GDPR) is:

• Anton Bondarenko, sole proprietorship (jednoosobowa działalność gospodarcza)
• ul. Chorzowska 51/53/21, 04-696 Warszawa, Poland
• NIP (tax ID): 9512542660
• onda@helloonda.com

Write to that address about anything on this page, including any of the rights described below. This policy covers the Onda app and the helloonda.com website.

The short version

Onda works out your cycle on your phone, and your records stay there: the dates you enter, your answers from setting up, your saved dates and your daily plan. But using Onda means agreeing, on its first screen, to send usage and cycle information to our analytics service, PostHog, in the EU, so we can see how Onda is used across the cycle and improve it — never for advertising. That covers the phase you are in, the day of your cycle and your cycle length with every usage event; a record each time you log a period starting or ending or change its date; the options you tap in your evening check-in; and recordings of how you use the app, in which all text and images are hidden, the details of your cycle show as plain blocks, and the screens where you answer questions are not recorded at all — though which cards and buttons a screen shows can reveal where you are in your cycle. Onda is only offered with this on: if you do not agree, you cannot use the app, and switching it off later in Profile deletes your account and everything in the app. Nothing about your cycle is sold, and no advertising company or data broker ever receives anything about it.

A few other things leave your phone. Two of them only happen if you choose them. If you turn reminders on, we send the times to remind you and the text of the reminder — and because a reminder can say which phase you are entering, that text names a phase, and its timing can show when your period is due or a phase begins. If you sign in, we store your email address and your name if Apple shares it. Beyond those, our server keeps an account for this install under a random code, with whether you have Onda Pro; crash reports are sent so we can fix the app; and our ad-measurement service, Appstack, records each install, trial start and purchase, and we keep a copy of those records in our analytics workspace — if you installed Onda from one of our ads, those are reported to Meta so it can measure that ad. None of these carries anything about your cycle beyond the reminder text and its timing. That is the whole list, and the sections below spell each one out.

What stays on your device

All of this is held in the app's own storage on your phone, and none of these records is uploaded as it stands. The analytics described in the next section do send values worked out from them — your phase, cycle day and cycle length, when you log or change a period, and your check-in options — and together, the period events and your cycle day show your period dates. The records themselves have no copy on our servers, which is also why deleting them in the app deletes them for good — we have nothing to restore them from. You can read the same list inside the app under Profile → What we store.

• The date your last period started — the one number the whole forecast is built from.
• Your last few period start dates, so the app can work out how long your cycles usually run and how much they vary.
• The days your periods ended, for how long a period usually lasts.
• Your answers from setting up: how you like to move, what you eat, and whether you use hormonal birth control. The answers stay here, but the analytics show whether your birth control pauses your cycle: while it does, no phase is sent.
• Your evening check-ins, kept on the phone for seven days and then deleted. These are only options you tapped — there is nowhere in the app to type a symptom, by design. The options you tap are also sent with analytics.
• Which suggestions you have already been shown, so you do not get the same one twice in a row.
• Any dates you have marked on your forecast: the name you gave them and the day.
• Your reminder settings.

Onda does not read Apple Health or Google Fit, and we have no plans to. You are the only source of the information it works from.

What leaves your device, and when

Reminders — only if you turn them on. To deliver a reminder at the right moment, we upload when to send it and the message itself to our server in the EU, and hand both to OneSignal, which does the delivering. Because a reminder can say something like “Follicular starts today”, the text names a phase, and a reminder about a date you marked uses the name you gave that date. Both appear on your lock screen, where anyone near your phone can read them — so choose names for your saved dates accordingly. Be aware of what a schedule implies: a reminder timed to the day your period is due, or to the first day of a phase, says when that is, so the send times themselves carry something about your cycle. The reminder upload carries nothing else: not the date you type, your cycle length, which day of your cycle you are on, your check-in answers, which suggestions you were shown, or the answers you gave when setting up. Each scheduled reminder is deleted from our server within two days of its send time, and turning reminders off in Profile deletes the whole schedule straight away.

Your account. When you first open Onda, our server creates an account for this install, on our server in the EU: a random code rather than your name or email, and whether your Onda Pro subscription is active. Your analytics are filed under that code, as described below. Signing in, with Apple or with an email address, is optional; the app works fully without it. If you do, we also store your email address, and your name if Apple shares it. Your cycle records are not stored in your account and are not uploaded when you sign in. Deleting your account in the app deletes this too.

Analytics, including cycle information — a condition of using Onda. We use PostHog, hosted in the EU, to see how Onda is used across the cycle and improve it — never for advertising. On the app's first screen you are asked to agree to it: the box you tick names your cycle and usage data, PostHog and what it is for, and What exactly?, beside it, opens the full list below, session recordings included. Onda is only offered with this on, so until you tick it, you cannot use the app. Once you have agreed, PostHog receives:

• Usage events: when the app opens and closes, which screens you open, how far you get through setting up, what you tap on the subscription screen and whether a purchase goes through, how you signed in, and when you open the check-in or add a date.
• With every event: your phone model and screen size, system and app version, language, time zone, whether you are on Wi-Fi or mobile data, and whether you have Onda Pro and on which plan.
• Also with every event: the phase you are in (and, in the luteal phase, whether it is early or late), the day of your cycle, and your cycle length — exact values, not ranges. While your birth control pauses your cycle, no phase is sent, so the events show that it does.
• An event each time you log a period starting, log it ending, or change a period date. Together with your cycle day, these show your period dates.
• When you finish an evening check-in, the options you tapped. These are fixed choices; there is nowhere in the app to type anything.
• Recordings of your sessions: the screens you move through and where you tap. Every piece of text and every image is hidden in them, and the details of your cycle — your cycle day and phase, your plan cards, your energy forecast and your saved dates — are recorded as plain blocks. The rest of each screen is recorded as it looks, so which cards and buttons it shows can reveal where you are in your cycle — for example that your period is due, under way or late, that a check-in answer changed your plan, or that your birth control pauses your cycle. The screens where you answer questions — your period date, your setup answers, the check-in, a date you add, and the pickers in Profile — are not recorded at all.

All of it is filed under your Onda account's ID, a random code our server creates for this install when you first open the app. It is not your name or email, but we can match it to your account, so the analytics are linked to you rather than anonymous. The app shows it under Profile → What we store, as your Analytics ID. PostHog receives the IP address your phone connects from, as any server does; we have set it to discard the address on arrival and not to work out your location from it, so no location is stored. None of it is ever used for advertising or sent to Meta or any other advertising company. You can withdraw at any time in Profile → Share usage and cycle data. Onda is only offered with it on, so switching it off works like Delete everything: the app stops sending analytics, our server asks PostHog to delete the events and recordings filed under every ID this installation of Onda has used, and everything on your phone and your account on our server are erased. PostHog carries out deletions in a weekly batch, so its copy is gone within about a week. Reinstalling Onda starts new IDs, so for anything recorded by an earlier installation, write to us. The ad-measurement events described under “Measuring our ads” reach PostHog separately, from Appstack rather than from the app.

Crash reports. If the app crashes, a technical report goes to Sentry, hosted in Frankfurt, so we can fix it. These carry no cycle data: the app is built so that crash reports cannot contain it, Sentry's own screenshots and session recording are switched off, and the screen names in a report are generic ones like “/today”. Unlike analytics, this does not rest on your consent — fixing crashes is a legitimate interest rather than something we ask permission for, and it is only defensible because the reports carry no health information. If that ever changed, we would ask.

Links to research. Onda cites the studies behind its advice, and tapping one opens that paper in your browser. We send nothing with you when you go — but the site you land on is not ours, its own privacy policy applies there, and it will see an ordinary visit the way any website does.

Measuring our ads

We advertise Onda on Meta's apps (Facebook and Instagram). To know whether an ad worked, the app contains one attribution SDK, from Appstack. Appstack records every install of Onda, and every free-trial start and purchase, which reach it from RevenueCat, our subscription provider. It works out whether the install came from one of our ads, and only when it did does it pass those events on to Meta through Meta's server-to-server Conversions API. The one exception: when we first switch on reporting of an event type, Appstack passes on the next such event once, whether or not it came from an ad, so that Meta can confirm the setup. They go as Meta's standard events — Lead (which is how an install is reported), StartTrial and Purchase — and never custom ones, so the name of an event says nothing about you beyond that it happened.

What goes with each event: its type and time, the price and currency for a purchase, the app version, and technical details Appstack uses to match the install to the ad — your IP address, device model, operating system version and language. Your device's advertising identifier (the IDFA) is included only if you tap Allow when the app asks whether it may track you; if you do not, it is never read. Apple's own privacy-preserving ad attribution also reports installs to Meta, in aggregate and without identifying you.

Appstack also sends these events to our analytics workspace at PostHog, in the EU, so that ad results sit next to the rest of our reporting: the event and its time, the campaign and ad it came from, the country, the price and currency of a purchase, Appstack's install ID, a device identifier for this app (the IDFV), and the advertising identifier only if you allowed tracking. These come from Appstack, not from the app, and nothing in them is about your cycle.

What never goes: anything from the short version above. Not the date you enter, not your cycle length, not your phase, not your check-ins, not your answers from setting up, not which suggestions you were shown, and not your email address — hashed or otherwise. The events are sent the same way for everyone, regardless of anything about your cycle.

You can stop the identifier being shared at any time: Settings → Privacy & Security → Tracking on your iPhone, and switch Onda off. You can also write to us and ask us not to share the install and purchase events of your device. This website has no advertising pixel or advertising SDK of any kind and sends nothing to Meta.

The website, and the closed waitlist

Before launch, this site had a waitlist. It is now closed and takes no new addresses. The addresses already collected are stored with Resend, the service we use to send email, and are used for exactly one thing: a single email telling you Onda is available. After that email has been sent, the list is deleted. They are never sold, shared, or added to any other list, and if you reply to that email and ask, we will delete yours straight away.

This site uses PostHog in cookieless mode — no cookies, no cross-site tracking, nothing stored on your device, and no consent banner needed because there is nothing to consent to. Events are anonymous page views and button clicks, such as tapping the App Store badge. The site has no advertising pixel and sends nothing to Meta or any other advertising company.

Who else is involved

These are every company that receives anything, what each one gets, and where it is processed. Transfers to companies outside the EU are made under the European Commission's standard contractual clauses.

Meta is an advertising network; it receives only the three events described under “Measuring our ads”, and nothing about your cycle. None of the others is an advertising network, and none of them is a data broker. Three receive something derived from your cycle: PostHog, the analytics you agree to on the first screen; and Supabase and OneSignal, the reminder text and its send time, only if you turn reminders on. The others never do.

Our legal bases

Information about your cycle is “data concerning health” under Article 9 of the GDPR, which means we need your explicit consent before any of it leaves your phone. You give that consent on the app's first screen, before anything is sent, by ticking a box that names in plain words your cycle and usage data, who receives it and what for; What exactly?, beside it, shows the full list, session recordings included.

Be clear about one thing: that consent is a condition of using Onda. Onda is only offered with it on, so if you do not tick the box, you cannot use the app, and withdrawing it later in Profile deletes your account and everything in the app. Reading and accepting this policy is not how you give that consent, and we will never treat it as though it were. Reminders are a separate question again, asked for on their own.

• Analytics with cycle information and session recordings, and sending reminders that can name a phase — your explicit consent, Article 9(2)(a) and Article 6(1)(a).
• Your account and your subscription — necessary to provide what you asked for, Article 6(1)(b).
• The waitlist email — your consent, Article 6(1)(a).
• Measuring our ads — your consent through Apple's tracking prompt where your advertising identifier is used, Article 6(1)(a); otherwise our legitimate interest in knowing whether our advertising works, Article 6(1)(f), limited to the three events described above.
• Crash reports — our legitimate interest in a working app, Article 6(1)(f), and only while they carry no health information.

How long we keep things

• Evening check-ins: seven days, then the app deletes them automatically.
• Period dates: the last few cycles, because that is what the forecast is calculated from. Older ones are dropped as new ones arrive.
• Everything else on your phone: until you delete it, or until you delete the app.
• Reminder schedules on our server: replaced every time your forecast is recalculated, and removed once a reminder has been sent or is no longer due.
• Your account: until you delete it. Deleting is immediate and final.
• Analytics events: no longer than twelve months — or until you switch analytics off or tap Delete everything, which asks PostHog to delete them; PostHog deletes in a weekly batch, so they are gone within about a week.
• Session recordings: no longer than three months — or sooner, in the same way.
• Your waitlist email: until the one launch email has been sent, then deleted — or sooner, if you ask.
• Ad attribution data at Appstack: for as long as we use Appstack, then deleted or anonymised — or straight away when you tap Delete everything in the app. The copies Appstack sends to our PostHog workspace are kept like our other analytics events; Delete everything's request to PostHog covers what the app itself sent and may not reach these copies, so write to us and we will delete them. Meta keeps the events it receives under its own terms.
• Your subscription record at RevenueCat, with the identifiers kept there for ad measurement: for as long as we use RevenueCat — or until you tap Delete everything or delete your account in the app, which asks RevenueCat to delete it too. If that request fails, the app tells you, and we delete it when you write to us.

Your choices, and your rights

Everything on your phone can be erased from inside the app: Profile → Delete everything. On your phone it takes effect straight away, with no waiting period and no undo, and it deletes your account from our server at the same time. The app stops sending analytics first; our server then asks PostHog to delete the events and recordings filed under every ID this installation of Onda has used, which PostHog does in a weekly batch, so they are gone within about a week. Reinstalling Onda starts new IDs, so for anything recorded by an earlier installation, write to us. Delete everything also asks Appstack and RevenueCat to delete what they hold about you, and the app tells you if PostHog, Appstack or RevenueCat could not be reached. Switching off Profile → Share usage and cycle data does all of the same, because Onda is only offered with it on. You can turn reminders off, or sign out, without deleting anything.

Under the GDPR you have the right to ask for a copy of the personal data we hold, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw any consent you have given. Your records on your phone you can see and delete in the app. For what we hold — your account, any reminder schedule, and the analytics at PostHog — write to the address at the top of this page, from your account's email address or, if you have not signed in, with the Analytics ID shown under Profile → What we store, so we can find it.

If you think we have got something wrong, you can complain to your data protection authority. You do not have to come to us first, though we would rather you did.

Children

Onda is intended for people aged 16 and over, and by using it you confirm you are. That is our own condition, set because consent is what makes our use of cycle data lawful and the age at which someone can give that consent alone is 16 in Poland and across much of the EU. It is not the App Store's age rating, which measures whether content is suitable rather than who can consent. We do not knowingly collect anything from anyone younger, and if we learn that we have, we delete it.

If you are in California

We do not sell your personal information. We do share a limited amount of it for advertising, in the sense California law uses: if you installed Onda from one of our ads, the install, a trial start and a purchase, with device identifiers, go to Meta to measure that ad, as described under “Measuring our ads”. You can opt out of this sharing: turn off tracking for Onda in your iPhone's Settings → Privacy & Security → Tracking, or email the address at the top of this page and we will stop sending events for your device. This website sends nothing to Meta, so a Global Privacy Control signal is honoured by default there. We never use your health information for advertising or marketing.

The categories we collect are described above: identifiers (your account's ID; your email address, and your name if Apple shares it, if you sign in; the IP address your phone connects from; and device and advertising identifiers used to measure our ads), commercial information (whether you subscribe and on which plan, and a trial start or purchase reported for ad measurement), internet activity (usage events, the device details sent with them, and session recordings with all text and images hidden), and health information (the phase, cycle day, cycle length, period events and check-in options sent with analytics, with your consent, and, if you turn reminders on, reminder text that can name a phase and send times that can show when your period is due or a phase begins; everything else stays on your device). You have the right to know what we hold, to have it deleted, to have it corrected, and not to be treated differently for exercising any of those rights.

If you are in Washington, Nevada or Connecticut

These states have their own rules about consumer health data. Because those rules ask for a separate notice, we have written one rather than burying it here.

Read the Consumer Health Data Privacy Notice

What we never do

Each of these is a decision built into the app, not a promise we are asking you to take on trust:

• No advertising SDK or pixel on this website, and no data brokers anywhere. The app contains one attribution SDK, Appstack, described under “Measuring our ads”, and it never receives cycle data.
• We never sell your data, and we never share anything about your cycle with anyone for advertising or marketing.
• No readable text in screen recordings. Session recordings hide every piece of text and every image, block out the details of your cycle, and do not record the screens where you answer questions at all — so no date, phase name or answer can be read in them. Which cards and buttons a screen shows can still hint at where you are in your cycle, and recordings are stored alongside events that carry your phase and cycle day.
• No AI processing of your cycle data. Nothing about your cycle is sent to a language model, and the app writes nothing at runtime — every explanation ships with the app and has a cited source behind it.
• No importing from Apple Health or Google Fit. You are the only source of what Onda knows.
• No free text in analytics. The cycle information we send is the fixed set listed above — values and options you tapped — never anything you typed.

Changes, and how to reach us

If we change how any of this works, we will update this page and say so in the app rather than change it quietly. If a change means we need your consent for something new, we will ask for it — a changed policy is not consent.

Questions, requests, or anything that looks wrong: write to the address at the top of this page.