Privacy Policy
Effective date: · Version: 2026-10
LunaPCOS (the "App") helps people living with PCOS (polycystic ovary syndrome, now also called PMOS) track their cycles, symptoms and daily habits. This policy explains which personal data we process when you use the App and the LunaPCOS website, why, and how.
The data controller is LunaPCOS ("we"). For the detailed notice under Turkish law, see the KVKK Privacy Notice.
1. Summary
- We process your health data only with your explicit consent, and only to provide the service to you.
- The App shows no ads. We don't sell your data or share it with anyone for advertising or marketing.
- You can withdraw your consent or delete your account from within the App at any time.
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Account | First and last name, email address, profile photo, sign-in method (email, Apple or Google) | You / sign-in provider |
| Profile | Date of birth, language, time zone | You / your device |
| Health data (special category) | Period start and end dates, cycle and period lengths, whether your cycle is regular, flow, symptoms, diagnoses (e.g. PCOS, insulin resistance), whether you take medication for PCOS and its name, height and weight with their history, daily check-ins (mood, energy, stress, sleep, appetite, bloating, pain, notes), water intake, health goals | You |
| Preferences | Reminder and notification settings, favourite recipes, saved articles, appearance (light/dark mode) | You |
| Consent records | When you gave explicit consent and to which version of the notice | The App |
| Technical | Device push token, app version, error reports | Your device |
Values such as body mass index (BMI) are calculated from the height and weight you enter; no extra data is collected for them.
3. Purposes
- To create your account, sign you in securely and sync your data across your devices.
- To show your cycle calendar, period and ovulation predictions, and nutrition and movement tips for each cycle phase. If your cycle is irregular, predictions are not shown.
- To store and show your height and weight history.
- To schedule the reminders you ask for (period, ovulation, water, daily tips).
- To keep the App secure and find and fix errors.
- To meet our legal obligations.
No decision with legal effects on you is made solely by automated means.
4. Legal bases
- Account, preference and technical data: performance of our contract with you, legal obligations and our legitimate interests (KVKK art. 5/2-c, ç, f; GDPR art. 6(1)(b), (c), (f)).
- Health data: your explicit consent only (KVKK art. 6; GDPR art. 9(2)(a)).
You can withdraw your consent at any time in the App under Profile › Legal › Withdraw consent, or by writing to us. Until you consent again, health features are unavailable. Withdrawal doesn't affect processing carried out before it.
5. Service providers and transfers
We share your data only as far as needed to run the service, with these providers:
| Provider | Purpose | Data |
|---|---|---|
| Clerk, Inc. (USA) | Sign-in and session management | Name, email, profile photo, sign-in method, session data |
| Hetzner Online GmbH (Almanya) | Servers and database | All App data |
| Functional Software, Inc. – Sentry (USA) | Error tracking | Error logs and device details; sending personal data is turned off |
| Apple and Google | Sign in with Apple/Google, notification delivery | Data needed for sign-in, push token |
Reminders are scheduled locally on your device; their content isn't sent to our servers.
Transfers to providers abroad are made with the safeguards required by KVKK art. 9 and applicable law (such as standard contractual clauses). We disclose data to public authorities only when legally required, and only as far as required.
6. Retention and deletion
- We keep your data while your account is open.
- When you delete your account under Profile › Delete Account Permanently, your sign-in account (Clerk) is deleted, your account is closed, access to your data ends, and the App's data on your device is cleared.
- Records of a closed account are marked as deleted in our systems; they are not used for any purpose and don't appear in the App. You can ask for them to be erased permanently by writing to [email protected]; we complete such requests within 30 days.
- Statutory retention obligations remain unaffected.
7. Security
- Data is encrypted in transit (HTTPS/TLS).
- Session keys on your device are stored in the operating system's secure storage (iOS Keychain / Android Keystore).
- Access to servers and the admin panel is limited to authorised people.
No system is entirely risk-free. If a data breach occurs, we will notify you and the competent authority as the law requires.
8. Your rights
Under KVKK art. 11 and the GDPR you have the right to access your data, have it corrected, erased or transferred, object to processing and withdraw your consent. Send requests to [email protected]. See the KVKK Privacy Notice for details. If you are in the EU/EEA or UK, you may also complain to your local data protection authority.
9. Website
- The website uses no cookies and contains no advertising or analytics tools.
- Your language choice is stored in your browser (localStorage) and isn't sent to us.
- For security and operation, the server may keep standard access logs, such as IP address and browser details, for a short time.
10. Children
The App isn't designed for people under 16. If we learn that we hold data of someone under 16, we will delete it.
11. Changes
We'll announce material changes to this policy in the App. If a change affects how health data is processed, we'll ask for your consent again.
12. Contact
LunaPCOS
Ankara, Turkey
Email: [email protected]