Privacy Policy

Ferrabelle is made by Chris Ayers, an independent developer in Washington State, United States ("Ferrabelle," "we," "us"). This policy explains what happens to your information when you use the Ferrabelle Android app, the older Ferrabelle web app at ferrabelle.app, and this website.

Because Ferrabelle handles reproductive and other health information, we also publish a separate Consumer Health Data Privacy Policy under Washington's My Health My Data Act. If the two ever conflict for consumer health data, that policy controls.

1. The Ferrabelle Android app

What the app stores, and where

Everything you enter or import is stored in the app's private storage on your phone. That includes your periods and flow, symptoms and day logs, cycle predictions, temperatures, heart rate and sleep, weight and body measurements, workouts and lifts, training blocks, lab values, anything you import from another app and your settings. Only for features you turn on, it also stores your birth date, time and city (astrology), your pressure city and readings (pressure tracking) and that day's report (daily report). None of it is sent to us. We have no server for the app and no way to see what is on your phone.

When the app uses the internet

Out of the box, never. The app only connects to the internet when you turn on and use one of these optional features, and then only to the service you pick:

• AI assistant (off by default). You choose where it runs: your phone's built-in AI, which answers on the phone; an offline model (Gemma, about 2.6 GB) that you download once from Hugging Face, with no personal data sent to download it, and that then answers on the phone; a server you run yourself; your own OpenRouter account; your own API key for OpenAI, Anthropic, Google Gemini or xAI; or "Ask in your AI app," which hands a question to an app you pick (such as Claude, ChatGPT, Grok or Gemini) for you to send. Before anything is sent, you see exactly what will be sent. It contains your cycle status and the things you logged by hand that the question needs. Raw Health Connect values are never included; your cycle predictions, which Health Connect data can influence, can be. What you send is handled by that provider under its own terms and privacy policy. The app keeps a private log on your phone of when you sent something and to which provider. If a server you run uses plain http instead of https, the app warns you first, because anything sent that way is not encrypted. The daily report and AI-written partner messages, described below, use the same AI service you pick here. While the AI assistant is on, whichever option you pick, Google's on-phone AI library (ML Kit) can send Google usage and error statistics, such as device information, app version, an installation identifier and error codes. It never includes your question or your data, and with the AI assistant off nothing is sent.
• Partner messages (off by default, and only available with the AI assistant on). If you set them up, the app sends short notes to a partner through the route you choose: a text message that you send yourself, Discord or Telegram. By default a note says only whether your period started, could start any day now, or is about a week or more away, plus a kind suggestion. For each partner you can choose Detailed and tick what that partner may see: your phase, your cycle day, the days until your period, symptoms that are common in your phase, symptoms you logged today, your energy and your mood in a word, and ways to help. You see a preview and confirm before the first detailed note, and again when you add a detail. Whatever you tick, notes never mention fertile days, ovulation or ovulation tests, cervical mucus, temperature, sexual activity, weight or body measurements, lab values, pressure readings or your city, and never include a value from Health Connect. With the AI assistant set to write them, the AI service you picked receives only those details and writes the note in your language. The timing of notes, and any details you share, can hint at where you are in your cycle; the app explains this before you turn them on.
• Daily Cosmic + Cycle report (Pro, off by default, needs the AI assistant). If you turn it on, your phone shows a notification each morning at the time you pick. The notification is scheduled on your phone; no push service is involved. The report is written the first time you open Ferrabelle after that time, by the AI you chose for the assistant, from facts the app works out on your phone: your phase and cycle day, your next period estimate and its window, symptoms you logged in the last few days, the moon phase, your sun sign if you turned on astrology, and today's pressure reading if you track it. It never includes your name, your city or your fertile days. The report shows what was sent, and the app keeps that day's report on your phone. With your phone's built-in AI or the downloaded model, nothing leaves your phone.
• Barometric pressure (off by default). If you turn it on and pick your city from the app's offline list, the app asks MET Norway, the weather service of the Norwegian Meteorological Institute (api.met.no), for the forecast at that city when you open the app, at most once an hour. It sends only the city's position rounded to one decimal place (about 11 km), with the app's name, version and our contact email, which MET Norway asks apps to send. It never sends your name, your logs or your phone's location, which the app never reads. Like any internet service, MET Norway sees your phone's IP address and may keep logs under its own terms. The readings are kept on your phone, in your backups and exports, and are shown next to your symptoms. Weather data from MET Norway, licensed under CC BY 4.0.
• Backups you save. The app can save an encrypted backup file wherever you choose through Android's file picker, for example Google Drive. The file is encrypted on your phone with a passphrase only you know. We cannot read it or recover the passphrase.

One feature connects only to your own devices, never to us: moving your data to a new phone, which runs over your own Wi-Fi. It is described below. When you use the on-phone AI engine or the lab report reader, Google Play downloads it for the app; that is Google Play's connection, not Ferrabelle's.

Android may also back up the app's main database to your Google account if backup is turned on in your phone's settings. On Android 9 and newer with a screen lock, Android encrypts that backup end to end. You control it in your phone's backup settings.

Health Connect

Ferrabelle only reads from Health Connect. It never writes to it. It reads menstruation periods and flow, ovulation tests, cervical mucus, basal body temperature, body temperature, resting heart rate, heart rate variability, sleep sessions, weight, steps, distance, exercise sessions and active calories burned, and your past records of these when you import your history.

What it reads is kept in Ferrabelle on this phone, and in the backups and copies you choose to make. It feeds your cycle predictions, the Fe Score, the Today log card, the Body tab and your steps and cardio log. Ferrabelle reads when you open the app, never in the background.

Your Health Connect data is never sent to us, never used for ads and never sold. The raw values are never sent to an AI provider or to a partner. If you turn on the AI assistant or partner messages, only your cycle predictions can be shared, and only after you agree. A detailed partner message you set up can also say your energy level in one word, from the Fe Score.

You can remove these permissions at any time in Health Connect settings.

The paragraphs above are the same words the app shows on its Health Connect privacy screen. In more detail: your cycle predictions, which can be influenced by Health Connect periods and temperatures, can be included in an AI request only after you turn the AI assistant on and either read the exact text and tap Send, or turn on the daily report, which shows what was sent. The energy word in a detailed partner message comes from the Fe Score, which can use heart rate variability and recent cardio from Health Connect; no Health Connect value itself is sent. Health Connect data also travels with your own copies of your data: your encrypted backup file, Android's backup of the app's database if backup is on, a move to your new phone, and any export or doctor report you create and share. If you share your training with a coach, workouts that came only from Health Connect are included only if you tick them, and the text goes only where you send it. The monthly recap card leaves out workouts that came only from Health Connect. It is never used for credit, insurance or employment decisions, and never used to build a profile of you. Ferrabelle's use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

Lab values

Lab values you enter, such as ferritin or hemoglobin, stay on your phone. They are never sent to us, to an AI provider or to a partner. Like the rest of your data, they are also in the copies you control: your backup file, Android's backup of the app's database if backup is on, a move to your new phone, and any data export you make.

Scanning a lab report

You can fill in lab values from a photo of your lab report. The photo is read on your phone and deleted right after. Only the values you check and save are kept, exactly as you confirm them. If you take the photo with "Take a photo", your camera app takes it, and your camera app may keep its own copy. The first time you scan, Google Play downloads the lab report reader for the app (about 6 MB) after you agree. Ferrabelle sends nothing, and nothing from the photo leaves your phone.

Voice logging

You can say what you want to log. Voice logging uses your phone's own offline speech recognizer, and only that one. If your phone does not have one for your language, the mic button is hidden. The app asks for microphone access the first time you tap the mic, and listens only while the mic is on. We never send your voice anywhere, and no recording is kept. What it heard becomes a proposed log that you check before anything is saved.

Moving to a new phone

You can move all your Ferrabelle data from your old phone to a new one. Both phones must be on the same Wi-Fi. Your data goes straight from one phone to the other over your own network, encrypted with a one-time passphrase that the old phone shows as a code and as words. It never goes to us or to anyone else, and it never uses the internet. If you photograph the code, your camera app takes the photo; Ferrabelle reads it on the phone and deletes it.

Importing from Flo or Clue

Importing from Flo or Clue is in beta. You download your data from Flo or Clue yourself, then pick the file in Ferrabelle. The file is read on your phone. Nothing is sent to us, to Flo or to Clue. You see what will be imported before anything is saved.

Monthly recap card

Pro can make a monthly recap card: an image of your training numbers for the month, such as workouts, sets, new bests and cardio minutes. It holds training numbers only, never your cycle, symptoms, weight or lab values. It is made on your phone and goes only where you share it.

Downloads Google Play makes for the app

To keep the app small, two parts come separately from Google Play, only if you use them: the on-phone AI engine (about 10 MB), when you turn on the downloaded AI model, and the lab report reader (about 6 MB), when you first scan a lab report. The app asks you first. Google Play does the download under its own terms. Ferrabelle sends nothing for it.

The privacy meter

Settings → Privacy → What left your phone shows how much data Ferrabelle sent and received, today, over the last 7 days and since install. The numbers come from Android's own network counters for the app, measured by Android, not by us, and the app cannot change them. It also lists what it cannot see, such as downloads Google Play makes for the app, your phone's speech recognizer and the watch connection. The meter needs no permission. Its daily totals are kept on your phone only and are never backed up or exported.

Language

The app is available in English and Spanish. The translations are part of the app, so choosing a language downloads nothing and sends nothing. Your choice is saved with your settings. Partner messages and the daily report are written in your language; other AI assistant answers are in English.

Reminders

Reminders are scheduled on your phone. No push service or server is involved.

Buying Pro

The app is free. If you buy the optional Pro unlock, Google Play handles payment. The app asks the Google Play app on your phone whether you own Pro; that check runs between the two apps on your phone and sends nothing to us. Google shares limited order details with app developers, such as an order number, the price and your country or region, which we use only for tax, refunds and records. We never receive your card details, and orders are never linked to anything you log.

Crash reports

The app contains no analytics or crash-reporting code of our own. If your phone shares usage and diagnostics with Google, Google Play may show us anonymous crash and performance reports for the app. They do not include what you log.

Keeping and deleting app data

Your data stays on your phone until you delete it. Use Settings → Your data → Delete all data to erase everything, or uninstall the app. Backup files you saved elsewhere stay where you put them until you delete them there. See Delete your data for every step.

2. The older web app

If you have an account on the older Ferrabelle web app at ferrabelle.app, which is closed to new accounts, its own privacy and health data policy is on the web app page.

3. This website

• No tracking: this site uses no cookies, analytics, ads or tracking pixels.
• Hosting logs: our host, Vercel, automatically records basic request logs such as IP address and browser type for security and reliability, kept for a short period.
• Tester and launch sign-up: if you sign up, we receive your email address, your country, your phone model if you give it, whether you want to test or only hear about the launch, and your confirmation that you are 18 or older. It is delivered as a message to a private channel on our own Discord server, and as an email to our own inbox, sent through the email delivery service Resend. If you are a tester, we add your address to the test's tester list in Google Play so Google can let you install the app. We use your address only for the test and the launch email, and delete it when the test and launch are done or when you ask.
• Deletion requests: if you use the web app deletion form on the web app page, we receive the email address and any note you include, delivered as a message to a private channel on our own Discord server.

4. What we never do

• We do not sell personal information or consumer health data.
• We do not share your data with advertisers, data brokers, analytics companies or social networks, and there are no ads in Ferrabelle.
• We do not use your health data to train AI models.
• We do not use geofencing around health care facilities.

We would share web app or website information only if valid legal process requires it, and we will resist overbroad or out-of-state demands for reproductive health data as far as the law allows. We cannot hand over Android app data because we do not have it.

5. Your rights

You can access, export, correct or delete your information and withdraw consent at any time. For the Android app, you do all of this on your phone, since that is the only place your data lives. For this website, email ferrabelle@proton.me. Residents of Washington, California and other states with privacy laws have the rights described here and in the Consumer Health Data Privacy Policy, including the right to appeal a decision.

6. Security

The Android app keeps its data in private app storage and encrypts backup files with AES-256-GCM using a key derived from your passphrase with Argon2id. Keys for AI providers are kept in Android's secure storage and never leave the phone except to reach that provider. Every service built into the app is reached over HTTPS. A move to a new phone stays on your own Wi-Fi and is encrypted with AES-256-GCM, with a key made from a one-time passphrase with Argon2id. Report security issues to ferrabelle@proton.me.

7. Age

Ferrabelle is for people 18 and older. It is not directed at children, and we do not knowingly collect information from anyone under 18. If we learn we have, we delete it.

8. Where Ferrabelle is offered

Ferrabelle is made in the United States and offered in the countries where its Google Play page lists it.

9. Not a medical device

Ferrabelle is a general wellness app. It is not a medical device and not a method of contraception, and it does not diagnose, treat, cure or prevent any condition. Predictions are estimates and can be wrong. Talk to a health care professional for medical advice.

10. Changes

We will post changes here with a new effective date. When a change is material, the app shows you the updated policies and asks for your agreement again before you continue.

11. Contact

Privacy questions, requests and everything else: ferrabelle@proton.me.