Privacy Policy — WOMY

Women's health mobile application (cycle, nutrition, workouts)

1. Minimum Age and Consent

The WOMY application is accessible to users 15 years of age and older. In accordance with French law (Article 45 of the French Data Protection Act), the processing of personal data of a child under 15 is lawful only if consent is given jointly by the child and the holder of parental authority.

By creating an account, you confirm that you are at least 15 years old, or that you have the consent of a parent or legal guardian if you are between 15 and 18.

2. Data Collected

When using WOMY, we collect the following data:

a) Identification and account data

• Email address (via Google OAuth or Apple Sign-In)
• First name entered during onboarding
• Year of birth
• Application language

b) Reproductive health data (GDPR Article 9 — sensitive data)

• Menstrual cycle dates and duration
• Menstrual flow (heaviness, color, texture)
• Pain (cramps, back, head, breasts, legs, ovulation)
• PMS symptoms (bloating, acne, fatigue, mood swings)
• Cervical discharge and basal body temperature (optional)
• Ovulation and pregnancy test results (optional)
• Menstrual protection used
• Type of contraception (optional)
• Situation: pregnancy, postpartum, breastfeeding, menopause, fertility (optional)

c) Body and anthropometric data

• Current weight and weigh-in history
• Height
• Weight goal (loss, gain, maintenance)
• Fitness level

d) Daily well-being data

• Mood, energy level, sleep quality (hours and perceived quality)
• Digestive state, skin condition, hair condition
• Stress level (1-10 scale)
• Free-form personal notes

e) Nutritional data

• Foods and meals consumed (name, calories, macronutrients, portion)
• Daily water intake
• Daily calorie goal (optional)
• Saved recipes and meals

f) Physical activity data

• Workouts: type, duration, estimated calories, intensity
• GPS data: complete route (latitude/longitude) during outdoor activities (running, walking)
• Distance covered
• Daily step count
• Personalized or adopted training programs

g) Apple HealthKit data (iOS only, read-only)

• Step count (read from Apple Health)
• Average heart rate (read from Apple Health)
• Active calories burned (read from Apple Health)
• Most recent weight (read from Apple Health)

This data is never written to Apple Health by WOMY. Reading is optional and can be refused or revoked at any time via Settings → Health → App access.

h) Payment data

• Subscription status (free / premium / expired)
• Apple product identifier (e.g., com.womy.premium.monthly)
• Subscription start date and expiry date
• Apple transaction identifier (for verification, not used for marketing)

Bank/card data is handled exclusively by Apple and RevenueCat. WOMY does not have access to your banking details.

i) Data collected during onboarding

• Tracking goals and main goal
• Reason for cycle tracking and initial emotional state (free text)
• Lifestyle and daily activity (free text)
• Initial symptoms experienced

3. Processing Purposes

Your data is processed exclusively to:

• Personalize your experience according to your cycle phase and profile
• Calculate cycle predictions, nutritional and sport recommendations
• Synchronize your data across devices via Supabase
• Recognize foods by photo or barcode (local or AI processing)
• Generate personalized health articles and recipes (AI)
• Manage your Premium subscription via RevenueCat and Apple's App Store
• Reply to your support messages

Your data is never used for advertising, commercial profiling, nor sold to third parties.

4. Legal Basis for Processing

The processing of your data is based on:

• Your explicit consent (Art. 6.1.a and Art. 9.2.a GDPR) — given upon account creation, for all health and well-being data
• Contract performance (Art. 6.1.b GDPR) — for data necessary for the application to function and for subscription management

You may withdraw your consent at any time by deleting your account from the Profile tab.

5. Hosting and Storage

Your data is stored on servers operated by Supabase (Supabase Inc.), hosted in the EU North region — Stockholm, Sweden (eu-north-1). Supabase is GDPR-compliant. A Data Processing Agreement (DPA) is in place via the Supabase Pro plan.

Some data is also stored locally on your device to enable offline functionality. This local data is encrypted in transit (HTTPS/TLS) during synchronization.

6. Data Sharing with Third Parties

We never sell your data to third parties.

Your data may only be shared with the following technical service providers, strictly within the scope of their mission:

For data transfers outside the European Union (Supabase, RevenueCat, Google, Resend), appropriate safeguards under the GDPR are applied (standard contractual clauses or adequacy decision).

7. Retention Period

• Account and health data: retained for the entire period of active use of the application
• After account deletion: permanent deletion of all data within 30 days
• Payment data: retained in accordance with applicable legal obligations (up to 10 years for accounting data)

8. Your Rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: obtain a copy of your personal data
• Right of rectification: correct inaccurate or incomplete data
• Right to erasure: request the deletion of all your data ("right to be forgotten")
• Right to portability: receive your data in a structured, readable format
• Right to object: object to certain processing
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing
• Rights of minors: for users under 15, the parent or guardian may exercise these rights on their behalf

To exercise these rights, send a request to lunabitmz@gmail.com. We will respond within 30 days.

You can also delete your account directly from the Profile tab → My Profile → Delete my account, which results in the immediate and permanent deletion of all your data.

9. Data Security

We implement the following technical and organizational measures:

• Encryption of all communications in transit (HTTPS/TLS)
• Row Level Security — each user only accesses their own data
• OAuth 2.0 authentication only (no password stored)
• Hosting in the European Union (Stockholm)
• Access to production data strictly limited

10. Cookies and Local Storage

The mobile application does not use tracking cookies. Data is stored locally on your device solely to allow the application to function in offline mode. This local data remains on your device and is not shared with third parties.

11. Contact and Complaints

For any question regarding your privacy or to exercise your rights:

lunabitmz@gmail.com

You have the right to file a complaint with the CNIL (French Data Protection Authority — cnil.fr) if you believe your rights are not being respected, or with the competent supervisory authority in your country of residence.

12. Applicable Law

This policy is governed by French law and European Regulation 2016/679 (GDPR). In case of dispute, French courts will have jurisdiction, without prejudice to consumer rights under the laws of their country of residence.

13. Data Controller

The controller of personal data collected through the WOMY application is:

• Name: Louka Bianchi
• Status: Independent developer (individual)
• Address: 234 Rue du Faubourg Saint-Honoré, 75008 Paris, France
• Email: lunabitmz@gmail.com

Last updated: July 2026