Privacy Policy

Harmonie ("we", "us") is the data controller for the personal data described in this policy. You can reach us about anything in this policy at privacy@harmonie-app.co.uk.

• Account data: your email address, an encrypted (hashed) password, an optional display name, and the timestamps at which you accepted the terms, consented to data processing and confirmed you read this policy.
• Health data you enter: period start and end dates, blood flow, basal body temperature readings (including any you mark as outliers), cervical mucus observations, symptoms, mood and free-text notes. Under Article 9 GDPR this is special category health data.
• Preferences: app settings such as average cycle length, luteal length and temperature unit.
• Technical data: data needed to run the service securely, such as your session token and standard server logs (for example IP address and request time) generated by our hosting providers.

We do not use advertising trackers, we do not sell data, and we do not carry out profiling or automated decision-making that produces legal or similarly significant effects.

• Health data you enter — to show your calendar, charts, cycle history and pattern summaries. Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), given at sign-up and withdrawable at any time.
• Account and login data — to create your account, authenticate you and send password-reset emails. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Security and service logs — to keep the service available and prevent abuse. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
• Legal compliance — where we must keep or disclose information by law. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

We do not sell or rent personal data. We use a small number of processors who act only on our instructions:

• Supabase — database, authentication and transactional emails (such as password resets).
• Amazon Web Services (AWS) — underlying cloud infrastructure hosting the database, located in the Stockholm region (eu-north-1) within the EEA.
• Lovable — application hosting, build and deployment platform.

Your data is stored in the EEA. Where any processor transfers data outside the UK/EEA, that transfer relies on Standard Contractual Clauses or an equivalent safeguard. We may also disclose data where we are legally required to do so.

We keep your account and health data for as long as your account exists. When you use "Clear all data" or "Delete account" in Settings, the corresponding records are permanently deleted from the active database immediately; encrypted backups holding earlier copies are rotated out within our provider's standard backup window (up to 30 days). Server security logs are kept for a short period for troubleshooting and abuse prevention.

All traffic is encrypted in transit with TLS, and data at rest is encrypted by our hosting infrastructure. Passwords are stored only as salted hashes. Row-level security in the database means your entries can only be read or changed by your own authenticated account. No system is completely secure, so please use a strong, unique password.

Under the UK GDPR and EU GDPR you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing carried out before withdrawal.

You can exercise most of these rights yourself in Settings: export your cycle history to Excel or PDF, clear all data, or delete your account entirely. For anything else, email us at privacy@harmonie-app.co.uk. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk).

Harmonie is not intended for children under 16. If you believe a child has created an account, contact us and we will delete it.

We may update this policy from time to time. For material changes we will notify you in the app and, where required, ask for your consent again.

Questions, requests or complaints about privacy: privacy@harmonie-app.co.uk.