What we can and can't see

Our privacy promise. Last updated October 11, 2026.

The short version: your cycle data lives on your device, not on our servers. We could not hand it to anyone, sell it, or leak it, because we do not have it.

What stays on your device

Everything you log: temperatures, cervical fluid, flow, intercourse, test results, moods, symptoms, and notes. All of it is stored in your browser's local database on your phone or computer. Saving an entry makes zero network requests, with one exception you choose: if you have turned on Sync when I log under Settings, each save also uploads the encrypted copy described below, which we cannot read. You can verify either behaviour yourself with your browser's developer tools, and we encourage you to.

What our servers can see

A short list. Your email address and login session, handled by Supabase, our authentication provider. Your goal setting and timezone, so the app greets you correctly, plus a flag recording that you finished onboarding and accepted these terms. If you turn on optional sync: encrypted copies of your entries that we cannot read. Sync data is encrypted on your device with a passphrase only you know before it is uploaded. What sits on our servers is ciphertext. We do not have the key, and neither does anyone who might compel us to produce your data. And if you turn on optional push reminders: your browser's push address, your chosen reminder time, and your timezone, so a scheduled job can send the nudge. The notification is always the same generic check-in; it never contains or reflects anything you have logged, and turning push off deletes the stored address immediately. The same push address carries the other optional alerts, a new mentorship message or, for admins, new feedback; those never include chart or health details either.

The optional AI rewording

The explanation of how each number on your chart was reached is written by the app itself, on your device, with no network request at all. If you additionally tap "Reword this," we send only what the on-device engine worked out: your coverline, estimated ovulation day, peak day, temperature-shift day, fertile-window dates, predicted next period, confidence level, and the short rule notes explaining how it reached them. The server accepts those fields and nothing else, so no daily entry can travel with them even by accident. That goes to Anthropic's Claude API to generate the plain-language explanation. Your raw daily log, your notes, and anything you typed never leave the device. We do not store the summary or the response on our servers, and Anthropic does not train models on API data. You can switch this off entirely in Settings, which removes the button.

If you connect with a mentor and choose to share a chart, that specific snapshot (the cycle's entries and computed summary) is uploaded to Lutaria so your mentor can view it, and chat messages between you are stored on our servers. This is the only health data that ever reaches us, it happens only through your explicit action, and you can delete any shared chart or end the mentorship at any time; deletion is immediate. Mentors agree to treat everything you share as confidential, and mentoring is charting support, never medical advice.

The assistant and feedback

The optional AI assistant runs only when you send it a message, and can be switched off completely in Settings. Nothing in Lutaria needs it: your chart, your predictions, and the reasoning behind them are all produced without it. It receives your recent cycle summaries (computed on your device) and your question, never your raw daily notes, and we do not store the conversation. When you send feedback, your message, your email, and the page you sent it from are saved so we can read and act on it, along with a screenshot if you choose to attach one. Screenshots are always yours to include or leave out, and they are deleted automatically once the report has been closed for thirty days. Neither feature ever runs on its own.

Analytics

Today: none. No analytics scripts, no ad SDKs, no trackers, no fingerprinting. If we ever add product analytics, it will be privacy-respecting and aggregate (counts of feature usage, never the content of anything you log), we will name the provider here, and we will update this page before it ships, not after.

Sync recovery

Turning on sync gives you a one-time recovery code, shown once and generated on your device. If you forget your passphrase, the code restores access and lets you set a new one; you can rotate it from Settings whenever you like. What our servers hold is your key wrapped twice over, once by your passphrase and once by that code, so either secret opens it and we hold neither. Lose both and the synced copy is unrecoverable, by us as much as by anyone: a recovery path we controlled would be a back door for everyone else. Your local data and your exports are unaffected by a lost sync passphrase either way.

Export and deletion

Your data is yours. Export it as JSON, CSV, or PDF anytime from Settings, and save any chart as an image from the Chart page. The calendar file of halachic reminders is written the same way, on your device, and goes only where you put it. Delete everything on your device with one tap. If you use sync, "Disable & delete server copy" removes every encrypted blob from our servers immediately. Deleting your account removes your email and profile from Supabase.

Terms of use

The terms of use, including billing and refunds, are on their own page: read the terms. The short version: Lutaria is an educational tool, not a medical device, not medical advice and not a contraceptive.

Questions

Email privacy@lutaria.com. We read everything.