Privacy Policy — Tenderly

Effective October 26, 2026

Who we are

The app is made by Cross Trading LLC, 1209 Mountain Road Pl NE, Albuquerque, NM 87110, United States. We are responsible for your personal data (the data controller). You can reach us by email at contact@crosstrading.llc or by post at that address.

Your log lives on your device

Your cycle, symptom, food, mood, energy, sleep, medication and intimacy entries, your basal body temperature, cervical mucus and ovulation (LH) test results, and the lab results you enter (such as ferritin, iron or thyroid tests) are stored in a local database on this phone, with the details you add to them: headache start and end times, where it hurts on the body map, self-care steps such as heat or rest, your “Did it help?” answers, and your monthly check-in answers about symptoms and how much they limited you. Weight can be logged only after you turn on Track weight in More → Cycle settings & units, which is off unless you turn it on; turning it off keeps weights already logged. Your app settings are stored there too, such as which reminders, check-ins and sections are on, whether the cycle-change card is on, and whether you have finished setup and your first log. When you turn on backup, a copy of your log and your settings (except the country you chose for support lines, which stays on this phone) is encrypted on your phone with a key protected by a recovery code that the app makes and only you hold (older backups use the passphrase you chose), and only that encrypted copy is stored with our backup provider (Supabase). We cannot read it and cannot reset the code. If you choose “Email it to me”, the code is sent from your own mail app to your own address, not through our servers. Until you turn on backup, nothing from your log leaves the phone. If you use your phone’s own backup (for example iCloud Backup), the phone may include the app’s data in it, following your device settings. If your app version leaves the app’s data out of Android’s own backup and of transfers to a new phone, use the app’s encrypted backup to move your log.

Sensitive entries

The question about thoughts of self-harm is off unless you switch it on in More → Mood and safety. Your answers and your safety plan stay in your log on this phone, and in your encrypted backup if backup is on. They are never used by insights, Chat or the on-device AI. They appear in a doctor report only if you tick that section for that report and, on a phone with a passcode, unlock with Face ID, fingerprint or the passcode. What you log about alcohol, cannabis, nicotine, night shifts and travel, your reproductive history and the conditions you declare is kept the same way: on this phone, and in your encrypted backup only if you turn it on. Pain with sex, whether you note it on an intimacy entry, as a symptom or in a condition check-in, is kept the same way, and partner sharing never includes it. A condition is only ever what you say; the app never works one out from your log. Your reproductive history is in a doctor report only when you switch that section on.

Moving your history in

Someone helping you move from another app can leave a history file waiting in your account. When you sign in, your phone makes a key pair and shares only the public half with our backup provider (Supabase); the history is encrypted to that key (older imports use a one-time code instead), so the provider stores only an encrypted copy that only your phone can open. Nothing is added until you review it and confirm, it never overwrites a day you already logged unless the import says it corrects period days and you confirm that, and you can delete it from the account at any time.

Your account

You can use the app without an account: choose “Continue without an account” on the sign-in screen and everything stays on this phone. You can sign in later from More → Account & backup. An account (email, Apple or Google) is needed only for encrypted backup, partner sharing and history files left waiting for you. If you make one, Supabase stores your email address, how you sign in (email, Apple or Google) and when you signed in, so it can keep you signed in and let you reset your password. This is used only to run your account and backup, and is not linked to anything you log. If you sign in with Apple, Supabase also keeps a token from Apple for your account, used only to cancel the Sign in with Apple link when you delete the account; it is deleted with the account. Product-news emails are off unless you tick “Email me product news” when you create the account; that choice is stored with your account, and every such email has an unsubscribe link. You can delete your account and its backup at any time in More → Account & backup → Delete account and backup, even without your recovery code. Your log stays on this phone and the app keeps working without an account. Signing out stops partner sharing, and signing out or deleting the account removes the app’s keys for backup, partner sharing and imports from this phone.

Partner sharing

Partner sharing is off unless you turn it on in More → Partner sharing. It shares only today’s cycle phase, whether you’re on your period, when your next period may start, and period days from the last and next five weeks — never symptoms, food, mood, sex, notes, medications or your life stage. That view is encrypted on your phone with a key that exists only in the link you share, and our backup provider (Supabase) stores only the encrypted copy. Anyone with the link can see it. Stopping sharing deletes the shared copy, and the link stops working.

No tracking or analytics

The app does not use analytics, crash reporting, advertising identifiers or any third-party SDK that tracks you. It makes network requests for five things only: checking whether a newer version of the app is available when you open it, signing in, uploading or downloading your encrypted backup, downloading an encrypted history file waiting in your account, and, if you turn it on, uploading the encrypted partner-sharing copy. The update check goes to our app-update provider (Expo) and sends nothing from your log. When the app checks for updates, Expo receives the app version, your phone’s platform (iPhone or Android) and a random ID for this install, plus a short technical error message if a downloaded update failed to start. It isn’t linked to your account or anything you log. Your encrypted backup is uploaded only when you turn backup on.

Insights and AI

Patterns, forecasts and trends are worked out on your phone from your own log. On iPhones with Apple Intelligence, the app can also use Apple’s on-device model for four things: rewording patterns that passed its statistical checks and answers in Chat, turning what you type in your own words into a draft entry, suggesting foods from a meal photo you choose, and picking which part of your log answers a question in Ask. That model runs on the phone, so your data is not sent to Apple, to us or to any AI company. A meal photo is looked at on the phone and the app’s copy is deleted afterwards. All four are off unless you turn them on in More → Insights & AI, and AI-written text is labeled. The app does not use any cloud AI service. We don’t use your personal data to train AI models.

Health Connect (Android)

On Android you can choose to connect Health Connect in More → Data & privacy. It is off unless you connect it, and the app works fully without it. The app then reads, on your phone, only your steps, workout time, sleep, resting heart rate, heart rate variability, basal body temperature and period days, and saves them in your log. It never writes anything to Health Connect, never reads weight, calories or food, and sends none of this anywhere; like the rest of your log, it is in your encrypted backup only if you turn backup on. You can disconnect at any time, in the app or in Health Connect’s settings.

Apple Health (iPhone)

On iPhone, if your app version has Apple Health, you can choose to connect it in More → Data & privacy. It is off unless you connect it, and the app works fully without it; Apple Health asks for your permission when you tap Connect, never before. The app then reads, on your phone, only your periods (menstrual flow), sleep, resting heart rate, heart rate variability and basal body temperature, and saves them in your log. It never writes anything to Apple Health, never reads steps, workouts, weight, calories or food, and sends none of this anywhere; like the rest of your log, it is in your encrypted backup only if you turn backup on. Data from Apple Health is never used for advertising or marketing and is never shared or sold. You can disconnect at any time in the app, and remove the app’s access in the Health app.

Speaking instead of typing

If your app version has a microphone on Today and in “Type or say it”, you can tap it and speak instead of typing. The first tap asks for the microphone permission (and, on iPhone, speech recognition). Your voice is turned into text by your phone’s own on-device speech recognition: the app only offers the microphone on phones that can do this without the internet, so your voice is never sent to Apple, Google, us or anyone else, and no recording is kept. What you said appears as text for you to check, and nothing is saved until you tap Save. Where on-device recognition isn’t available, the microphone doesn’t appear; your keyboard’s own dictation still works and follows your keyboard’s settings.

Siri and Shortcuts (iPhone)

If your app version has them, the app adds two shortcuts with plain names, “Quick log” and “Log today”, for Siri and the Shortcuts app; their names say nothing about your health. They only open the app (to the log sheet, or to today): nothing is saved until you tap Save, App lock still asks first, and the app never receives your voice. You can also build your own personal shortcuts in the Shortcuts app; those are yours and named as you choose. Siri handles what you say under Apple’s own privacy policy.

Reminders

Reminders are local notifications scheduled on your device. Enabling one asks for the notification permission; nothing about your reminders leaves the phone. With App lock or discreet mode on, reminders show only “Reminder” on the lock screen. “Did it help?” follow-ups are off unless you turn them on in More → Reminders. When they are on, a few hours after you log an as-needed medicine or a self-care step such as heat or rest, one notification asks “Did it help?”. It never names the medicine or step, even with App lock and discreet mode off, and the notification carries only a reference to that entry, not what you took. Turning follow-ups off cancels any not yet delivered. If you add the Android home-screen widget, or, if your app version has it, the iPhone Home Screen or Lock Screen widget, it shows your cycle day and next period; with App lock or discreet mode on it shows only “Open to see today”.

App lock

The optional app lock uses your device’s own Face ID, Touch ID, fingerprint or passcode prompt. The app never sees or stores your biometric data — it only learns whether the system prompt succeeded. On Android, if your app version supports it, while App lock or discreet mode is on, the app’s screens can’t be captured in screenshots or screen recordings.

Your data, your choice

From More → Data & privacy you can export every entry as a JSON file to keep or move elsewhere, and you can delete all data. Deleting removes the database from this device immediately and cannot be undone. If you use cloud backup, your encrypted backup is kept and this phone stops backing up until you restore it or choose to replace it; you can delete the backup itself in More → Account & backup. Uninstalling the app removes your log from the phone.

Not medical advice

Predictions and insights are estimates computed from what you log. They are for personal awareness and are not a diagnosis, contraception method or substitute for care from a doctor or nurse.

How long we keep data

Your log stays on your phone until you delete it or the app. If you have an account, we keep your account data (your email address, how and when you signed in, your product-news choice and, if you signed in with Apple, the token from Apple) until you delete the account. Your encrypted backup, your encrypted partner-sharing copy and any history files waiting in your account are kept until you delete them or the account. Our backup provider (Supabase) keeps its own backups of its servers for up to 7 days, so deleted data can remain in those until they expire; any health data in them is still the encrypted copy we can’t read.

Where your data is processed

Our backup provider (Supabase) stores your account data and the encrypted copies on servers in the United States. Our app-update provider (Expo) is a US company. If you live outside the United States, your data is transferred there; where the law requires it, these transfers are covered by the providers’ data processing terms, including Standard Contractual Clauses. When the app connects to Supabase (signing in, backup, partner sharing, history files) or checks Expo for updates, that provider receives your phone’s IP address, as any internet service does. It is used only to deliver the request and keep the service secure, is kept in the provider’s server logs under its own retention rules, and is not linked to anything you log.

Your rights

We use your personal data only to run the features you choose. For your account and encrypted backup, the legal basis is our contract with you: providing the service you asked for. Health data leaves your phone only with your explicit consent, which you give in the app first; you can withdraw it at any time by turning off backup and partner sharing or deleting your account, which doesn’t affect what was done before. Product-news emails are sent only if you chose them. Depending on where you live, including under the GDPR, the UK GDPR and US state privacy and health-data laws, you have the right to access, correct, delete and export your personal data, to restrict or object to how we use it, and to withdraw consent. You can do most of this yourself in the app: export everything from More → Data & privacy, and delete your account and backup from More → Account & backup. Because your health data is encrypted with a key only you hold, we can’t read it, so the in-app export is how you get a copy. For anything else, email contact@crosstrading.llc; we reply within 30 days and won’t treat you differently for using your rights. If you’re not happy with our answer, you can complain to a data protection authority, such as the ICO in the UK or the supervisory authority where you live in the EU, or to your state attorney general in the US.

Age

The app is for adults aged 18 and over and is not directed at children. If we learn that someone under 18 has made an account, we delete the account and its encrypted backup.

Changes and contact

If this policy changes, the new version ships with an app update and the date shown is updated. Questions: contact@crosstrading.llc.