Privacy policy

1. Who we are

FemNote is made by Neurova AI, a sole proprietorship owned by Andreas Chitos, Heideveldstraat 6, Eindhoven, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 94328900 (VAT NL005076610B08). We are the controller for the personal data in this policy: we decide why and how it is used. You can also call us on +31 619 919 544.

This policy covers the FemNote app for iPhone, the website femnote.com, the waitlist, our emails, support and the beta.

Questions about your data? Email andreas.chitos@neurova-ai.com, or use the contact form on our support page and choose the topic Privacy and my data. All our company details are in the imprint.

2. What stays on your phone

Everything you log in FemNote stays on your iPhone: check-ins, cycle and period dates, meals and meal photos, scans, your watch list, patterns, experiments and lists, and your first name if you give it. Much of this is health data. It is kept in a database on your iPhone that is encrypted with a key stored in your iPhone's Keychain. It is never stored on our servers, and we can't see it.

Your patterns are worked out on your phone. Reminders are scheduled by your phone itself, without a push service, and their text never contains health data.

We never make an iCloud copy of this data. It is only included in your iPhone backup if you turn on Include in iPhone backup in the app, and that setting is off unless you turn it on. When it is on, the encrypted database is part of the backups your iPhone makes in iCloud or on your computer. Those backups are Apple's service and your choice.

3. Apple Health

Connecting Apple Health is up to you. If you allow it, FemNote reads your sleep analysis and menstrual flow from Apple Health, and adds the periods you log in FemNote to Apple Health.

What FemNote reads from Apple Health is shown to you in the app, but it is never saved in FemNote's database and never sent anywhere. Data from Apple Health is never used for advertising, marketing or data mining, never sold and never shared with third parties.

You can change or withdraw this access at any time in your iPhone settings, under Privacy & Security, then Health.

4. What leaves your phone

Only the following leaves your phone, and only when you use the feature:

• Photos for recognition. When you take or choose a photo of a meal, your fridge or an ingredient label, it is sent over an encrypted connection to our recognition service in Frankfurt, Germany. The service passes it to an AI model (Claude, made by Anthropic) that Amazon Web Services runs for us in its EU data centres, and sends back what the model recognised. Ingredient labels are read on your phone first: then only the label text is sent, or the photo if reading fails.
• Barcodes. When you scan a barcode, your phone looks up the product directly in Open Food Facts or Open Beauty Facts.
• What you share yourself, such as the PDF report for your doctor or an export of your data. Where it goes is up to you, and we don't get a copy.
• Your account and subscription details, and app statistics and crash reports if you turn them on, as explained below.

With a photo or label text we send only a fixed instruction and an anonymous install token, which we use to limit how often recognition is used and to check Premium. We never send your watch list, check-ins, patterns, name, email address or any other ID.

Photos and label text are not stored, and their contents are not logged, by us or by Amazon Web Services. Amazon doesn't use them to train AI models and doesn't pass them to Anthropic. The only exception is Amazon's automated check for child sexual abuse material: an image it flags may be kept and reviewed by Amazon, only to check it, and reported to the authorities.

What comes back is a suggestion. You check it, and change or remove items, before anything is saved. What you save stays on your phone.

Open Food Facts and Open Beauty Facts are open databases run by Open Food Facts, an independent non-profit in France. Your phone sends them only the barcode number, without an account, ID or cookies from us. Like any website, they see your IP address, and their own privacy policy applies.

5. What our servers keep

An account is optional. If you create one, our servers (Supabase, in Frankfurt, Germany) keep only what we need for your account and plan:

• your email address, or the private relay address Apple gives you if you hide your email
• how you sign in: Apple, Google or an email code
• whether your subscription is active
• your preferred language, so our emails reach you in it

With or without an account, we also keep an anonymous install ID for your copy of the app: a random ID that we use only to limit how often recognition is used and to check Premium.

If you sign in with Google, we keep only your email address, not the name or photo Google shares. If you sign in with Apple and Apple shares your first name, it is stored only on your phone. Email sign-in uses a 6-digit code that works once, for 10 minutes. We never ask for a password.

Our sign-in system also keeps the technical records it needs to keep accounts secure, such as your active sessions and when, from which IP address and on which type of device you signed in.

None of this contains or is linked to your health data.

6. Payments and subscriptions

You buy and pay for subscriptions through Apple. Apple handles the payment under its own terms and privacy policy, and we never see your card details.

Our subscription service RevenueCat, Inc. (United States) checks your purchase with Apple, so the app knows whether your plan is active. RevenueCat keeps your subscription status and purchase history, such as the plan, dates, price, currency and store country, with a random anonymous ID for your copy of the app. If you create an account, that ID is linked to your account, so your plan works on a new phone. RevenueCat's software in the app also receives the technical details it needs to work, such as the app and iOS version and your language, and, like any internet service, your IP address.

Founding codes are App Store offer codes: you redeem them in the App Store, and Apple processes the purchase.

7. App statistics and crash reports

Both are off until you turn them on in the app, and you can turn them off again at any time. Neither ever includes health data.

App statistics: TelemetryDeck GmbH (Germany) receives usage signals, such as which screens are opened, with the app and iOS version and the device model. Your copy of the app is identified only by an ID that is scrambled (hashed) on your phone and again on TelemetryDeck's servers, so it can't be traced back to you. TelemetryDeck stores no IP addresses and keeps the data in the EU.

Crash reports: Sentry (Functional Software, Inc., United States) receives technical details when the app crashes, such as the error, the app and iOS version and the device model. We use Sentry's EU data region in Frankfurt, Germany, and remove personal details before a report is sent. Crash reports are deleted after at most 90 days.

8. The waitlist

When you join the waitlist we keep your email address, a scrambled (hashed) copy of it that we use to look you up, your language, your own invite code, the invite code of whoever invited you (if anyone) and your founding member price. We also keep when you signed up, when we sent your confirmation email, when you confirmed (that is when you gave your consent), whether you unsubscribed, and scrambled versions of the links in our emails.

You only join once you tap the link in our confirmation email (double opt-in). The link works for 7 days, and we send a new one at most every 10 minutes. If you don't confirm, we won't add you to the list or email you again.

After you confirm, we email you only about FemNote: about the beta, and about your personal founding code at launch. Each of these emails has an unsubscribe link, and unsubscribing takes one click.

Invites: if you join with a friend's invite link, we store their invite code with your sign-up, so they can move up the beta list. We don't tell them who you are, and we never email your friends: you share your own link if you want to.

How long we keep these details is explained in How long we keep data.

9. Support messages

When you use the contact form, we keep your name, email address, topic, message and language, the reference we give you, such as CY-1001, and a scrambled (hashed) copy of your email address that we use to limit how many messages one address can send. The message is stored on our servers and forwarded by email to our support inbox, so a person can reply. The confirmation we email you contains your reference, topic and time, but not your message.

We use these details only to answer you. Please leave out health details; if you send them anyway, we use them only to answer you.

We delete support messages after 12 months, from our servers and from our support inbox.

10. Emails

We send emails through Resend (Plus Five Five, Inc., United States), from its EU region in Ireland, with open and click tracking turned off. Our emails never contain health data.

You get sign-in codes only when you ask for one, waitlist emails only after you confirm (each with an unsubscribe link), and replies when you contact us.

11. This website

femnote.com uses no cookies, no analytics and no trackers, and loads nothing from other companies.

Our host Cloudflare, Inc. (United States) delivers the pages and protects them against attacks. To do that it processes your IP address and technical details of each request, such as the page, your browser type and the time, and keeps them in short-term logs.

The waitlist and contact forms are processed by Cloudflare and stored with Supabase, as described above. Our own logs for these forms contain only event names, never email addresses, names or messages.

12. The beta

The iPhone beta runs on Apple's TestFlight, and Apple's TestFlight terms and privacy policy apply. When the beta opens, we email you an invitation. If we invite you through TestFlight itself, we give Apple your email address so it can send the invitation.

Through TestFlight, Apple gives us technical information about how the beta works for you, such as your device model and iOS version, crash reports and how often you open the app, plus any feedback and screenshots you send us. We use this only to fix problems and improve FemNote. Your health data stays on your phone during the beta too.

13. Who receives data

These service providers (processors) handle personal data for us. Our contracts with them let them use it only to provide their service to us, and require them to protect it at least as well as this policy promises:

• Supabase Pte. Ltd. (Singapore): accounts, subscription status, anonymous install IDs, the waitlist, support messages and our recognition service. Servers in Frankfurt, Germany.
• Amazon Web Services EMEA SARL (Luxembourg): the AI model that recognises photos and label text, in AWS data centres in the EU, without keeping them.
• RevenueCat, Inc. (United States): subscription status and purchase history, stored in the United States.
• Plus Five Five, Inc. (Resend, United States): our emails, sent from Ireland.
• Cloudflare, Inc. (United States): hosting, delivery and security of this website and its forms, and forwarding email sent to our femnote.com addresses.
• TelemetryDeck GmbH (Germany) and Functional Software, Inc. (Sentry, United States, EU data region): app statistics and crash reports, only if you turn them on.
• The provider of the inbox where we read and answer your emails and support messages.

Some companies receive data as independent controllers, under their own privacy policies: Apple (the App Store, payments, Sign in with Apple, Apple Health, iCloud and TestFlight), Google (if you sign in with Google) and Open Food Facts (barcode lookups).

We disclose data to others only if the law requires it, for example a court order. We hold no health data on our servers, so there is none we could hand over.

If FemNote or our company is ever taken over, the data on our servers would go to the new owner, who must respect this policy. We would tell you beforehand.

14. Data outside the EU

We keep data in the EU where we can: our servers are in Frankfurt, our emails are sent from Ireland and recognition runs in AWS data centres in the EU.

Several of our providers are companies outside the EU, in the United States and, for Supabase, Singapore. RevenueCat stores data in the United States. Cloudflare serves this website from the data centre nearest to you, which can be outside the EU. Where personal data goes to, or can be accessed from, a country without an EU adequacy decision, we rely on the EU-US Data Privacy Framework for companies certified under it, and otherwise on the EU Standard Contractual Clauses. For personal data from the UK we use the UK Extension to the Data Privacy Framework or the UK Addendum to those clauses.

You can ask us for a copy of these safeguards.

15. Why we may use your data

The GDPR and the UK GDPR require a legal reason for each use of personal data. Ours are:

• Health data in the app, including what you allow from Apple Health: your explicit consent, which you give in the app before you start (articles 6(1)(a) and 9(2)(a)).
• Photos and label text sent for recognition: your explicit consent, because a photo of what you eat can say something about your health (articles 6(1)(a) and 9(2)(a)).
• Your account, subscription and sign-in codes: to provide the app and plan you asked for, under our contract with you (article 6(1)(b)).
• The anonymous install ID and limits on recognition: our legitimate interest in preventing abuse and keeping recognition affordable, and our contract with you for Premium (articles 6(1)(f) and 6(1)(b)).
• Waitlist emails: your consent (article 6(1)(a)). Keeping a record of that consent: our legal obligation to be able to show it (article 6(1)(c)).
• Invite codes: our legitimate interest in running the invite programme you joined (article 6(1)(f)).
• Support messages: our legitimate interest in answering you, or our contract with you when your question is about your subscription (articles 6(1)(f) and 6(1)(b)).
• App statistics and crash reports: your consent (article 6(1)(a)).
• This website, its security logs and security cookie: our legitimate interest in a secure, working website (article 6(1)(f)).
• The beta: our agreement with you as a tester, and our legitimate interest in fixing problems (articles 6(1)(b) and 6(1)(f)).
• Answering requests about your rights, keeping a record of them, and disclosures the law requires: our legal obligations (article 6(1)(c)).

Our legitimate interests are preventing abuse and fraud, keeping our services secure and working, answering your questions, running the invite programme fairly, improving FemNote with beta feedback, and defending legal claims. You can object to these uses, see Your rights.

You can withdraw consent at any time. For health data in the app, use Delete my account and data in the app (under You, then Privacy and data), or delete the app. For recognition, stop sending photos: nothing from earlier requests is kept. Turn off app statistics and crash reports in the app, and unsubscribe from waitlist emails with the link in any of them. Withdrawing doesn't affect what was done before.

Do you have to give us data? No. You can use FemNote without an account and without photo recognition. You need an email address to create an account, join the waitlist or get an answer from us, and an Apple ID to buy Premium. Without them, only those features won't work.

16. Where your data comes from

Most data comes from you. Some comes from others:

• Apple or Google, when you sign in with them: your email address, or the relay address Apple gives you, and from Apple your first name, which stays on your phone.
• Apple, through RevenueCat: your subscription status and purchase history.
• Apple Health, on your phone, if you allow it.
• Other people on the waitlist: if someone joins with your invite link, we store your invite code with their sign-up.
• Apple's TestFlight, if you join the beta.

17. No selling, no ads and no automated decisions

We don't sell personal data and we don't share it for advertising. FemNote has no ads and no ad trackers, and doesn't track you across other companies' apps or websites. We earn from subscriptions.

We don't make decisions about you by automated means that have legal or similarly significant effects. Your patterns are calculated on your phone, for you alone: they show what often comes before a symptom in your own log, and are not a diagnosis. Recognition results are suggestions that you confirm.

18. How long we keep data, and deleting it

How long we keep it:

• What you log in the app: on your phone, until you delete it or the app. We never have a copy.
• Your account and its sign-in records: until you delete your account.
• Subscription status and purchase history at RevenueCat: until you delete your account and data. Apple keeps its own purchase records under its own policy.
• The anonymous install ID: until you use Delete my account and data. If you only delete the app, the ID stays on our server, unused.
• The waitlist: a confirmed address stays until you unsubscribe or ask us to delete it. Sign-ups that are never confirmed are deleted 30 days after the last confirmation email, and unsubscribed addresses 30 days after unsubscribing or after the last confirmation email, whichever is later. An automatic job does this every night.
• Support messages: deleted after 12 months, on our servers by an automatic nightly job, and from our support inbox.
• Photos and text sent for recognition: not kept.
• Sent emails: our email provider keeps a copy for a limited time, to deliver them and deal with bounces.
• Crash reports: at most 90 days. App statistics are kept only in a form that is not linked to you.
• Technical logs at Cloudflare and Supabase: a short time, for security.
• Beta feedback: as long as we need it to fix the problem.

Delete my account and data, in the app under You, then Privacy and data, removes your account, all server data tied to you, the encryption key, your photos and everything stored on your phone. If you signed in with Apple, we also revoke that sign-in.

We can't reach copies inside older iPhone backups that were made while Include in iPhone backup was on. You can delete those backups in your iPhone settings or on your computer. Deleting the app or your account doesn't cancel your subscription: cancel it in your Apple subscriptions.

Without an account, deleting the app removes your FemNote data from your phone. To remove your waitlist or support details sooner, unsubscribe or contact us.

19. Your rights

Under the GDPR and the UK GDPR you have the right to:

• see the data we have about you and get a copy (access)
• have it corrected (rectification)
• have it deleted (erasure)
• have its use limited while a question is sorted out (restriction)
• get it in a common, machine-readable format, or have it sent to another company (portability)
• object to uses based on our legitimate interest (objection)
• withdraw your consent at any time, without affecting what was done before

Your right to object: you can object at any time to the uses based on our legitimate interests, listed in Why we may use your data. We then stop, unless we have compelling legitimate grounds that outweigh your interests, or need the data to establish or defend a legal claim.

Most of this you can do yourself in the app, under You, then Privacy and data: export your data, delete everything, or turn statistics off. Because your health data is only on your phone, we can't look it up, correct it or delete it for you; the app does that.

For anything else, email andreas.chitos@neurova-ai.com or use the contact form. It's free. We answer within one month; if a request is complex we may need two more months, and we'll tell you why. We may ask you to confirm the request from the email address we have, so we know it's you.

If you are unhappy with how we handle your data, you can complain to us first: we confirm we received your complaint within 30 days and tell you what we did about it. You can also complain to a data protection authority: the Autoriteit Persoonsgegevens in the Netherlands, the Information Commissioner's Office (ICO) in the UK, or the authority in the EU country where you live or work.

20. Age

FemNote is for adults aged 18 and over. We don't knowingly collect data from anyone younger. If you think someone under 18 has given us their details, contact us and we will delete them.

21. Security

We protect your data with:

• encryption on your phone: the database is encrypted with a key kept in your iPhone's Keychain
• encrypted connections (TLS) for everything the app and this website send
• servers in the EU that only our own backend can read, not the public
• scrambled (hashed) email addresses and links for lookups, so addresses don't show up in web addresses or logs
• logs without content: no photos, messages, names or email addresses
• collecting as little as we can

Please protect your iPhone with a passcode, because your FemNote data is on it. If a data breach ever puts your rights at risk, we will report it to the data protection authority, and tell you too if the risk is high, as the law requires.

22. Cookies and tracking

This website sets no cookies and stores nothing in your browser. The only exception: if Cloudflare's security check ever has to challenge a visitor, it sets a strictly necessary cookie (cf_clearance) to remember that the check was passed. This needs no consent, and we don't use it for anything else.

The app uses no cookies, no advertising identifiers and no tracking, so it never asks for permission to track you.

23. If you live in the United States

This section adds to the policy above for people in US states with privacy laws, such as California, Colorado, Connecticut, Virginia, Texas and Oregon.

What we collect: identifiers (your email address, the anonymous install ID and the IP addresses our providers process), commercial information (your subscription status and purchase history), internet activity (technical website logs, and app statistics and crash reports if you turn them on) and sensitive information (the health data you log, which stays on your phone, and photos you send for recognition, which are not kept). The sections above explain where each comes from, why we use it, who receives it and how long we keep it.

We don't sell your personal information or share it for cross-context behavioral advertising, and we don't use it for targeted advertising or for profiling with legal or similarly significant effects. We haven't done so in the past 12 months, and we don't sell or share data of anyone under 16.

We use sensitive information only with your consent and only to give you the features you ask for, not to infer things about you.

Your rights: to know and access what we hold, correct it, delete it, get a portable copy, and opt out of selling, sharing, targeted advertising and profiling. There is nothing to opt out of, because we do none of these, and that is also why a Global Privacy Control signal changes nothing. We will never treat you differently, charge you more or give you less for using your rights.

To make a request, email andreas.chitos@neurova-ai.com or use the contact form. We check it's you by confirming the request with the email address we have. Someone you authorise can also make a request for you; we may ask for proof that you gave permission. We answer within 45 days, or tell you why we need up to 45 more.

If we decline your request, you can appeal: reply to our answer, or email andreas.chitos@neurova-ai.com with the subject Appeal. We answer appeals within 45 days and explain our decision. If you disagree with it, you can contact your state attorney general.

In Washington, Nevada or Connecticut? Our Consumer Health Data Privacy Policy explains how we handle consumer health data under your state's laws.

California: we don't disclose personal information to others for their own direct marketing.

24. Changes

If we change this policy, we tell you in the app before the change takes effect, and ask for your consent again if a change needs it. The date at the top shows the current version.