Privacy Policy

Red Alert: Cycle Tracker is developed and published by Aurora Flow.

For data protection purposes, we are the data controller for the limited information described in this policy. You can contact us at any time at redalertcycle@gmail.com.

Red Alert is designed for someone tracking a partner's menstrual cycle. That means you may be entering information about another person's health.

We have no way to verify consent, and we do not monitor how the app is used. The responsibility is yours. Red Alert works best as something you and your partner both know about — a shared reference, not a secret one.

If someone has entered your information into this app without your agreement, you can contact us at the address in section 1 and we will help however we can — though please note that because the data lives on that person's device rather than on our servers, our ability to act is limited.

We do not ask for your name, your phone number, your address, your contacts, your photos, or your location. The app requests no location permission.

Everything you enter is stored in a database and a settings file inside the app's private storage area on your device. On Android, other apps cannot read this area.

We do not operate servers that store your cycle information. There is no Red Alert account, and nothing you enter is synchronised to us.

This also means: if you uninstall the app or reset your device without a backup, your data is gone permanently and we cannot recover it.

Backup is a Premium feature and is disabled by default. If you turn it on:

• The app packages your database and settings into a single file.
• That file is encrypted on your device using AES-256 in GCM mode, with a key derived from your Google account address.
• Only the encrypted file is uploaded, into a folder named RedAlertBackups in your own Google Drive.
• The unencrypted copy is deleted from your device immediately after encryption.

The file never passes through our systems and we hold no copy of it and no key to it. Restoring a backup requires signing in with the same Google account that created it.

Once in your Drive, the file is also governed by Google's Privacy Policy. You can delete it yourself at any time from Google Drive, and you can disable backup in the app's Settings.

Red Alert's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the drive.file scope, which grants access solely to files this app itself creates — not to the rest of your Drive.

The app includes Google Analytics for Firebase, which helps us see where the app crashes, which features get used, and roughly where our users are, so we can fix problems and decide what to build.

What is sent: app version, device model, operating system version, coarse region or country, general interaction events such as opening a screen, crash and error reports, and a randomly generated app instance identifier.

What is never sent: cycle dates, phase information, daily logs, notes, intimacy records, profile names, or anything else you type into the app.

Firebase data is processed by Google. See Firebase's privacy documentation and Google's Privacy Policy. Our legal basis for this processing is our legitimate interest in maintaining and improving the app.

Premium is an optional annual subscription sold through Google Play Billing. Google processes the payment and tells the app only whether an active subscription exists.

We never receive or store your payment card, billing address, or Google account password. Subscriptions renew and can be cancelled through your Google Play account settings. Payment information is governed by Google Payments' privacy notice.

• Notifications — to send you a heads-up the day before a phase change. Optional; the app works without it.
• Internet — used only for Drive backup, analytics, and verifying your subscription. Never for sending your cycle data anywhere.
• Google account access — requested only if you enable Drive backup, and limited to files this app creates.

We do not sell your information. We do not share it with advertisers, data brokers, insurers, employers, or any similar party. We do not build profiles about you and there is no advertising in the app.

The only third parties involved are the infrastructure providers named above — Google Firebase, Google Play, and Google Drive — each acting in the narrow role described in this policy.

We may disclose information if legally compelled to do so. In practice we hold almost nothing about you, so there is very little that could be disclosed.

Data you enter stays on your device until you delete it. To remove it:

• A single day: open that day in the app and choose Clear this day.
• A profile: delete the profile in Settings.
• Everything on the device: uninstall the app, or clear its storage in your Android settings.
• Your backups: delete the RedAlertBackups folder from your Google Drive.
• Analytics: email us at the address in section 1 and we will request deletion of the analytics records associated with your app instance identifier.

Analytics records are retained by Google for a limited period and then deleted automatically. Because we hold no account for you, there is nothing else on our side to delete.

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, to data portability, and to withdraw consent.

For most of what Red Alert handles, you exercise these rights directly: the data is on your device, so you can view, change, export via backup, and delete it yourself without asking us. For analytics records, contact us at redalertcycle@gmail.com and we will respond within 30 days.

We do not sell or share personal information as those terms are defined under California law, and we do not process it for cross-context behavioural advertising. We do not discriminate against anyone for exercising their rights.

If you are in the European Economic Area or the United Kingdom, you may lodge a complaint with your local supervisory authority. If you are in Brazil, you may contact the ANPD.

Red Alert is not directed at children and is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has used the app in a way that involves us holding their information, contact us and we will delete it.

Your data sits in the app's private storage, protected by Android's app sandbox. Backups are encrypted before upload. Network connections use TLS.

The most significant risk to your data is physical access to your unlocked phone. We recommend using a screen lock. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Google processes analytics data and Drive storage on infrastructure that may be located outside your country, including in the United States. Google applies safeguards for such transfers, including Standard Contractual Clauses where required. See Google's privacy documentation, linked above, for details.

Do not rely on this app for contraception, conception planning, or any health decision. Consult a qualified healthcare professional for medical advice.

We may update this policy as the app changes. The effective date at the top of this page always reflects the current version. For changes that meaningfully affect how your information is handled, we will notify you in the app before the change takes effect.