Monthly Rose Privacy Policy

Last updated: October 15, 2026　Effective: October 15, 2026

Monthly Rose ("the app", including the iPhone / Apple Watch, Android / Wear OS and HarmonyOS versions) is provided by Xiamen Yunci Digital Technology Co., Ltd. (厦门云磁数字科技有限公司) ("we"). We know how private information about your periods, pregnancy and mood is. This policy explains, as plainly as we can, what we collect, why, where it's stored, who can see it, and how you stay in control.

If you are under 14, please don't use the app. If you are between 14 and 18, please read this policy with a parent or guardian and use the app only with their consent.

1. You can use the app without an account

Logging, the calendar, predictions, reminders and syncing with your phone's health app (Health on iPhone, Health Connect on Android, HUAWEI Health on HarmonyOS — "system health" below) all work without signing in. Without an account, your records stay only on this phone and in system health if you allow it — we have no copy on our servers.

Signing in and cloud backup are optional. AI features send data only after you give separate consent.

2. What we collect

1. Account information (when you sign in)
Sign-in is provided by our shared account service, Yunci Account Center (id.iyunci.cn, operated by the same company, Xiamen Yunci Digital Technology Co., Ltd.). Our other apps use it too, so one account can sign in to several of our apps. The account center stores:

• Sign in with Apple (iPhone): the user identifier Apple provides. We don't request your name or email.
• Sign in with HUAWEI ID (HarmonyOS): the user identifier Huawei provides (OpenID / UnionID).
• Sign in with WeChat (Android, China version): the user identifier WeChat provides (OpenID / UnionID), plus the nickname and avatar WeChat shares when you authorize.
• Sign in with Google (Google Play version): the user identifier and email address Google provides.
• Phone sign-in (mainland China only): your phone number and a text-message code. The number is stored encrypted, with a salted hash for lookup; codes expire after 5 minutes and are deleted once used.
• Sign-in device details (device model, OS version, time, IP address) and a sign-in log, for account security. If you signed in to another of our apps on the same phone, this app's sign-in screen offers "Continue with the same account"; nothing happens until you tap it.
• A push token (the identifier Apple's push service, Huawei Push or Google Firebase Cloud Messaging assigns to this phone): after you sign in it is used to send notifications to this phone (for example, someone replied to your post); it is deleted when you sign out.

This app's own server keeps only the account number assigned by the account center, never your phone number or the third-party account identifiers above.

2. Health records in cloud backup (only if you sign in and separately agree to turn on backup)

• Periods and flow, symptoms, mood and feelings, weight, basal temperature, cervical mucus, LH test results, fetal movements, postpartum bleeding, sex log (only if "Show sex log" is on), and your notes;
• Medications and doses taken; pregnancy / postpartum details and checkup appointments;
• Mode, height, birth year and reminder settings.

This is sensitive personal information. We collect it only with your separate consent, and you can turn it off at any time.

Never uploaded: photos you take (including LH test strip photos — the strip is read on your phone); your voice when you use voice input (converted to text on your phone); sleep, heart rate, heart rate variability, respiratory rate, blood oxygen, wrist temperature, workouts and similar data from system health (shown and calculated on your phone only); what you say to the AI assistant (never backed up — see the next item). Your chats with Rosie are kept only while "Keep conversations" is on — see item 3.

2.5 Partner & family sharing (only if you sign in and turn it on)
You can let people you choose (up to 3) see how you are that day. When it's on, your phone creates a very small status summary and uploads it: the name you give yourself, plus the items you select — period day and days until your next period, fertile days, today's mood, pregnancy week or days since birth. Notes, symptoms, sex log, weight, photos, medications and mood check-ins are never part of it. The summary is stored encrypted on our server and can be seen only by someone who pairs through your invite link (in the app or on a web page). When you tap Stop sharing, the summary and their access credentials are deleted immediately. We don't know who the viewers are; we store only a hash of their access credential.

2.6 The Circle (community)
You can browse the Circle without signing in. Posting and commenting require signing in and agreeing to the Circle Guidelines. When you post, we collect and show to other users: the nickname and avatar you choose, the text of your posts and comments, any photos you attach, and a stage tag (such as "29 weeks pregnant") only if you tick it. Your phone number, Apple account and cycle records are never shown and never uploaded with a post. Location and other metadata are removed from photos once on your phone and again on our server.
To keep the community safe, what you post is checked automatically: the text is sent to a large language model service we engage to judge whether it breaks the rules, without information identifying you; we also review content and handle reports by hand, and a small number of posts are reviewed by a person before they appear. We also keep your likes, reports and blocks so those features work. Regulations in mainland China require a verified phone number before posting in the Chinese-language Circle; other users can't see it.
Votes on the daily question are anonymous: the server only adds up the count for each option. To prevent double voting we keep a hash derived from your account or anonymous ID, deleted after two days.

3. When you use AI features (only after separate consent)

• A de-identified statistical summary: cycle and period lengths, current phase, symptoms by phase, average mood and sleep, age range (e.g. "25–29", never your birth date), pregnancy or postpartum week, and similar statistics. It contains no dates, no note text and nothing that identifies you;
• The text you type in Ask (used only to generate that one answer; not kept);
• The text you type in Talk and the AI's replies: if "Keep conversations" is on (it is by default; turn it off under "Rosie's memory" on the Talk page), the conversation is stored encrypted on our server so you can reread it and continue it under "Earlier conversations". It is deleted automatically after 30 days without activity; you can delete any conversation or all of them at any time, and turning "Keep conversations" off deletes what's stored immediately. With it off, your text is used only to generate that one answer and is not kept. Exception: when you express a crisis signal in Talk (such as intent to harm yourself), that conversation is stored encrypted for 180 days regardless of the "Keep conversations" setting, linked to your account (or anonymous install ID), solely so that our staff can reach out and offer help if necessary; it is not used for any other purpose. You can see it under "Earlier conversations", and it is deleted with your account;
• A sentence you say to the AI assistant that your phone couldn't understand on its own (the assistant tries on your phone first; anything it understands is never sent, and nothing else — such as your medication list — is attached);
• When you use free messages in Talk or the AI assistant, or the free tries of AI insights (Ask, cycle reports and alert explanations, 10 in total), a randomly generated anonymous ID (used only to count free uses, unrelated to your identity; our server stores only its hash; once you sign in, uses are counted per account and deleted with your account); when you're not signed in, a device attestation from the system is also sent (App Attest on iPhone, the Device Security service on HarmonyOS, Play Integrity in the Google Play version — it proves the app is genuine and running on a real device, with no identity information), so free uses can't be claimed again by changing the ID; our server likewise stores only its hash;
• When you call Rosie: what you say is turned into text on your phone and then sent just like typed Talk messages (your voice itself is never uploaded); Rosie's answer is read aloud by a speech synthesis service we engage, which receives only the text to be spoken, without your account, phone number or install ID.
• If "Rosie remembers you" is on (it is by default; you can turn it off on the Talk page): a short note (how you like to be called, your situation, where the last conversation left off) is sent along with each conversation for the AI to refer to, and updated by the AI after a conversation. One copy is kept on your phone and one encrypted copy on our server (so you get it back on a new phone); it is deleted automatically after a year without updates. You can view, edit or clear it at any time — clearing also deletes the server copy. The note is not part of cloud backup.

Apart from the Talk conversations and the note described above, our server processes this only to generate an answer and doesn't keep the summary or your Ask messages. Conversations and the note belong to your account; when you're not signed in they belong to your anonymous install ID, and are merged into your account once you sign in.

4. Subscription information
When you buy Plus, we receive the transaction information your purchase channel provides (transaction ID, product, expiry, renewal and refund status) to confirm your subscription: Apple in-app purchase on iPhone, HUAWEI In-App Purchases on HarmonyOS, Google Play Billing in the Google Play version, and WeChat Pay (ordered through our account center) in the Android China version. We never see your bank card or other payment details.

5. For security and cost control
Request counts, AI usage (in tokens) and a salted hash of your IP address, used to prevent abuse and control costs. We don't store raw IP addresses.

6. Crash diagnostics (you can turn this off in Me → Settings → Privacy)
When the app crashes or hangs for a long time, the system creates a diagnostic report (Apple MetricKit on iPhone; the system error callback on Android and HarmonyOS). We send only the crash location (the code call stack), app version, OS version and device model to our server to fix the problem. It contains none of your records, your account, phone number, install ID or anything that could identify you, and is deleted after 90 days.

7. Anonymous prediction accuracy stats (you can turn this off in Me → Settings → Privacy)
How accurate your next-period prediction is gets worked out on your phone: each time a new period starts, your phone compares the predicted day with the actual day and shows the result under Health → Cycle. While this setting is on (it is on by default), your phone sends only the following to our server so we can improve the prediction algorithm: the algorithm version, how many cycles the prediction used (in bands), whether your cycles are regular, how many days the prediction was off, whether the actual day fell within the predicted range, and your age band (only if you've entered your birthday: under 25 / 25–34 / 35–44 / 45+). It contains no dates, none of your records, your account, phone number, install ID or anything that could identify you, and is deleted after 400 days. Once you turn it off nothing more is sent, and results from while it was off are never sent later.

8. Usage statistics after you sign in
When you're signed in, our account center records the app version, build number and install channel you use, your phone model and system version, language and time zone, and whether notifications are on; plus daily usage counts — how often and at what times you open the app, how often you view the membership page, taps on purchase and cancelled purchases, running into members-only features, which features you use (for example pelvic floor training, ovulation strip reading, the doctor summary or data export), which Circle sections you browse, and how often you share. Only counts, feature names and section names are recorded — none of your records or health data (periods, symptoms, mood, weight, notes and Talk conversations are never sent for this). We use this to understand which versions are in use, decide whether to remind you to update, improve the product, and decide when to show you membership or renewal reminders; it is never used to set individual prices. Usage is shared among the apps we run ourselves (for example which of our apps you use and whether you've paid), never with third parties. Nothing is recorded while you're signed out.

9. Processed only on your phone — we never receive it
App lock uses the system's face / fingerprint / passcode check, so we never get your face, fingerprint or other biometric data; answers to the postpartum mood check-in aren't kept, and its scores and your pelvic floor training log stay on this phone only — never in cloud backup, never sent to the AI; files from "Export all data" stay on your phone and go wherever you choose; what's shown on the Dynamic Island, Live View, ongoing notification, widgets / service cards and your watch is generated locally on the phone and reaches the watch over Bluetooth, never through our servers.

We do not use any third-party advertising, analytics or tracking SDKs (the usage statistics in item 8 are handled by our own account center, not a third party), we don't show personalized ads, and we never sell your information. The Android and HarmonyOS versions include a few platform SDKs for sign-in, payments and push notifications — see section 5 and the Third-party Information Sharing List.

3. Where it's stored and how it's protected

• Location: servers in mainland China (Beijing). If you use the app outside mainland China and turn on cloud backup or AI features, your information is transferred to and processed in mainland China. In the Google Play version, Sign in with Google, Google Play Billing and Firebase Cloud Messaging are handled by Google, so the related account identifier, transaction information and push token may be processed outside mainland China.
• In transit: always HTTPS.
• At rest: backed-up records, settings, and Talk conversations and the note are encrypted by our servers with AES-256-GCM before being written to the database, so the database holds only ciphertext. Phone numbers in the account center are encrypted the same way; sign-in credentials are stored only as hashes.
• Who can decrypt: the decryption key is used only inside our backend service. We decrypt only when needed to provide the service to you — for example restoring your data on a new phone, exporting it at your request, or investigating an issue you report.
• Access control: the database is closed to the outside; only our backend can read or write it through controlled interfaces.

No system is perfectly secure. If a personal information security incident occurs, we will notify you promptly and report it to the authorities as required by law.

4. How long we keep it

• Cloud backup: nothing new is uploaded after you turn backup off; what's already uploaded is kept until you delete your account, at which point we delete your account and all backup data immediately.
• AI summaries and Ask messages: not kept.
• Talk conversations: deleted automatically after 30 days without activity; you can delete them at any time; deleted when you delete your account.
• Talk conversations containing crisis expressions: deleted automatically after 180 days; deleted when you delete your account.
• The "Rosie remembers you" note: deleted automatically after a year without updates; you can clear it at any time; deleted when you delete your account.
• Text-message codes: expire after 5 minutes and are deleted once used; sign-in credentials expire after 2 hours and can be renewed automatically for up to 90 days, and are revoked when you sign out; push tokens are deleted when you sign out.
• Usage and abuse-prevention counters: kept for up to 13 months, then deleted automatically.
• Crash diagnostics: deleted after 90 days.
• Anonymous prediction accuracy stats: deleted after 400 days.
• Usage statistics after sign-in: daily counts are deleted after 180 days; app version and device information are kept with your account and deleted when you delete your account.
• Circle posts, comments and photos: kept until you delete them or delete your account. Deleted content disappears immediately; the backup record required by regulation is erased after 60 days. Deleting your account deletes them too.
• Where laws require otherwise, we follow the law.

5. Service providers

To provide the service, we engage service providers of the following kinds, bound by confidentiality and security obligations:

• Cloud hosting (servers and database);
• Text messaging (sending sign-in codes);
• Language model services (generating answers from the de-identified summary and your messages, after your consent; requests are relayed through our account center, which strips your account details, records usage only and keeps no content);
• Phone and app store platforms, depending on your version: Apple (Sign in with Apple, in-app purchases, push notifications); Huawei (HUAWEI ID sign-in, in-app payments, Push Kit, reading and writing HUAWEI Health data); Tencent (WeChat sign-in and WeChat Pay, Android China version); Google (Sign in with Google, Google Play Billing, Firebase Cloud Messaging, Google Play version).

The names of these providers, their purposes and the information they process are listed in the Third-Party Sharing List: https://cycleai.iyunci.cn/legal/third-parties

Apart from the above and where required by law, we don't share your personal information with anyone.

6. Your rights

• Access and export: view your records in the app any time; Me → Settings → Export all data exports everything (a CSV and a JSON file), and Health → Doctor summary creates a one-page PDF.
• Correction: edit records in the app; changes sync to your backup.
• Deletion: delete any day in the app; Me → Settings → Delete all data also removes the records in your cloud backup.
• Withdraw consent: withdraw AI consent or turn off crash diagnostics and anonymous prediction accuracy stats in Me → Settings → Privacy, and turn off cloud backup in Me → Account, at any time. Withdrawal doesn't affect processing that took place before.
• Turn off personalization: if you don't want us to use your usage to decide which reminders to show you, contact us as described in section 8 to turn it off (an in-app switch will come in a later version); after that, usage is only used for statistics that don't target you individually.
• Delete your account: Me → Account → Delete account. You can delete only this app's cloud data and unlink it (keeping the account for our other apps), or delete the whole account, which immediately and permanently removes the account and your cloud data in all of our apps. If you used Sign in with Apple, deleting the whole account also asks Apple to revoke the sign-in authorization; HUAWEI ID, WeChat and Google authorizations can be removed in those accounts' settings.
• System health data is managed by you in your health app (Health on iPhone, Health Connect, HUAWEI Health); we don't delete it for you.

Depending on where you live (for example the EU/UK under the GDPR, or California), you may have additional rights, including the right to object and to complain to your local data protection authority. We reply to requests within 15 business days.

7. Changes to this policy

When something important changes (for example we collect a new type of information or change where it's stored), we'll tell you clearly in the app and ask for your consent again where needed.

8. Contact us

Operator: Xiamen Yunci Digital Technology Co., Ltd. (厦门云磁数字科技有限公司)
Address: Building C04, Phase III, Xiamen Software Park, Xiamen, Fujian, China
Privacy contact: jubao@iyunci.cn