Privacy promise

Better a small promise that holds than a big one that doesn't.

This page is in plain language. The legally binding version is the privacy policy — longer and more precise, and it contradicts nothing here.

What we do

Everything sits in Frankfurt
Your cycle, symptoms, notes and deen data live in a database inside the European Union. The AI assistant, if you switch it on later, runs on a European inference profile.
No trackers, not on this site either
No ad SDKs, no attribution SDK, no social pixels, no Google Analytics. This website sets no cookie that would require your consent.
No training on your data
We train no models on what you log, and our suppliers are contractually barred from doing so. That's an agreement on paper, not an assumption about good intentions.
Two signatures for access
Access to user data runs through a break-glass procedure: a recorded reason, approval by two people, and logging that the person granted access cannot erase.
Identity separate from health
Who you are sits in a different table from what you log. We join them only where we genuinely must.
Gone is gone, within a number of days we write down
Delete your account and your live data is gone within 30 days, your backups within another 14. No "as long as necessary".

This is the part other apps leave out. Read it before you trust us.

We do not call this end-to-end encryption
Because it isn't. Your data sits readable in our database. It's encrypted in transit (TLS) and at rest (AES-256), but that's standard for any database and it doesn't protect you from the provider — meaning us.
We can technically reach your data
Including your notes and your deen data. What stops that is procedure and logging, not mathematics. If you find that insufficient, that's a fair objection and we won't pretend otherwise.
Some of our suppliers are American
The data sits physically in Frankfurt, but suppliers like Supabase, AWS and RevenueCat are American entities. That means something under the CLOUD Act. A fully European chain requires our own infrastructure — that's our documented way out, not our starting position.
We are not doctors
Mensis is not a medical device and not suitable as contraception. Predictions are estimates based on your own history.

The GDPR recognises special categories of personal data (Article 9). Mensis touches two of them, and we keep them apart.

You withdraw both through Settings → Privacy. Withdrawing is as easy as giving — that's not a courtesy but a requirement from Article 7(3) GDPR.

Health data
Your cycle, flow, symptoms and notes. We ask for consent before the first question about your data, not afterwards.
Religious belief
The deen module. Separate consent, separately withdrawable, and without that consent the module doesn't exist in your app.

Sub-processor list
Every party that processes data, with role, data location and transfer basis.
See the list
Break-glass procedure
Who can reach data under which conditions, and how that gets recorded.
Read the procedure
Annual transparency report
How many government requests we received and what we did with them. Including when the answer is zero.
More on this