Privacy Policy

Last Updated: June 14, 2026

1. Introduction

Welcome to Phasely.

Phasely (“Phasely,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, disclose, and protect your information when you use the Phasely mobile application, website, and related services (collectively, the “Services”).

Data Controller: Karolina Bittman, operating Phasely as an individual founder, based in Zürich, Switzerland. If Phasely is incorporated as a legal entity in the future, the data controller will be updated accordingly, and notice will be provided through the Services.

Phasely is operated from Zürich, Switzerland. By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Services.

2. Important Notice

Phasely is an educational wellness application focused on menstrual cycle awareness, fasting, nutrition, and exercise guidance.

Phasely is not a medical device, healthcare provider, or diagnostic service. Any health-related information provided through the Services is educational in nature and should not be considered medical advice. Please refer to our Medical Disclaimer for further detail.

3. Information We Collect

Account Information

When you create an account, we may collect:

• Email address
• Password (stored securely in encrypted, hashed form)
• Account creation date
• Subscription status
• User preferences

Cycle and Wellness Data

To provide personalized recommendations, we may collect:

• Menstrual cycle dates
• Cycle length information
• Phase calculations
• Fasting schedules
• Food and exercise preferences
• Hormonal status (e.g., menstruating, perimenopausal, postmenopausal)
• Lifestyle context (e.g., activity level, sleep, stress, conditions you choose to share)
• Wellness-related settings

AI Coach Conversations

When you interact with the AI Coach, we collect:

• Questions you submit
• Messages exchanged with the AI Coach
• Conversation history
• Citations and sources referenced in responses

This information is used to provide responses and improve the functionality of the Services.

Meal Photo Data (Keep only if active in v1)

When you use the meal photo logging feature, we collect:

• Photos of meals you choose to upload
• AI-generated analysis of meal contents (food items identified, estimated macros, inflammation assessment)
• Coach-generated insights based on photo analysis
• Timestamps of meal logs

Meal photos are stored privately in your account and are only accessible to you. They are processed by our AI vision service (Anthropic) to identify food contents. You may delete individual meal logs or all meal data at any time through the application.

HealthKit Data (Optional)

If you choose to connect Apple HealthKit, we may access only the data categories you explicitly authorize. Depending on permissions granted, this may include:

• Steps
• Walking distance
• Active energy burned
• Exercise minutes
• Workouts
• Sleep information
• Menstrual cycle data (if you choose to sync from HealthKit)

HealthKit access is entirely optional. You may revoke HealthKit permissions at any time through Apple Health settings or your iOS Settings app. HealthKit data is never used for advertising, marketing, or shared with third parties.

Technical Information

We may automatically collect:

• Device type and model
• Operating system version
• App version
• Crash logs
• Diagnostic information
• Anonymous usage analytics

Subscription Information

Payments are processed through Apple App Store subscriptions. We do not receive or store your credit card information. We may receive subscription status information from Apple, including:

• Active subscription status
• Purchase date
• Renewal status
• Subscription tier

AI Processing and Third-Party AI Providers

Phasely’s AI Coach feature is powered by AI models hosted by third-party providers. To give you personalized, research-grounded answers, we transmit certain information to these providers when you use Coach.

Who processes your data

• Anthropic (anthropic.com) — Our primary AI provider. Powers the conversational AI Coach and the meal photo analysis feature. Anthropic is based in the United States.
• OpenAI (openai.com) — Used to generate semantic embeddings of your queries so we can search our knowledge base. OpenAI is based in the United States.

What is shared

When you use Coach, we transmit the following to Anthropic:

• The text messages you type to Coach
• Any meal photos you send to Coach
• Your current cycle phase and day number
• Lifestyle context you have shared (activity level, stress level, sleep quality)
• Any health conditions you disclosed during onboarding (e.g. cycling/perimenopausal/postmenopausal status)
• Recent conversation history for context (last several messages)

A small text excerpt of your query is also sent to OpenAI to generate a semantic embedding.

How it is used

• Anthropic processes your inputs only to generate Coach’s response.
• Anthropic does NOT use your messages to train their AI models.
• OpenAI does NOT use API embedding inputs to train their models (per OpenAI’s enterprise terms).
• Phasely does NOT sell, rent, or share your data with advertisers, data brokers, or analytics providers.

Your consent

Before Coach sends any data to these providers, you must explicitly consent within the Phasely app. You can withdraw consent at any time by contacting hello@phasely.today and requesting account deletion.

Data retention by AI providers

Anthropic and OpenAI retain API request data per their own retention policies (currently 30 days for safety monitoring under their API Terms). See their privacy policies for details:

• Anthropic: https://www.anthropic.com/legal/privacy
• OpenAI: https://openai.com/privacy

4. How We Use Your Information

We use information to:

• Create and manage accounts
• Provide personalized cycle-aware guidance
• Deliver AI Coach and meal photo analysis functionality
• Sync user settings across sessions
• Improve app performance and stability
• Provide customer support
• Process subscriptions
• Detect fraud, abuse, or misuse
• Comply with legal obligations

We do not sell personal information. We do not use personal information for behavioral advertising or cross-app tracking.

5. AI Processing

For full details of what data is transmitted to AI providers, who those providers are, what consent is required, and their data retention policies, see the AI Processing and Third-Party AI Providers section above.

In summary: your Coach inputs (text, any meal photos, cycle phase, lifestyle context, and onboarding health disclosures) are sent to Anthropic to generate responses. A text excerpt of your query is sent to OpenAI to generate a search embedding. Neither provider uses API data to train their models. Your name, email, and full account profile are never sent to AI providers.

6. Health Data

Health-related information is treated with heightened care. We use health-related data solely for:

• Personalized phase calculations
• Wellness recommendations
• Fasting and exercise guidance
• AI Coach personalization
• User experience improvements

We do not sell health data. We do not use health data for advertising purposes. HealthKit data is never used for advertising, marketing, or shared outside of providing the Services.

7. Legal Basis for Processing

For users located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under one or more of the following legal bases as required by GDPR Article 6 and the Swiss Federal Act on Data Protection (FADP):

• Consent — for optional features such as HealthKit integration and marketing communications.
• Performance of a contract — to provide the Services you have subscribed to.
• Legitimate interests — to improve the Services, ensure security, and detect fraud.
• Compliance with legal obligations — to meet tax, accounting, and regulatory requirements.

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

8. Third-Party Service Providers

We may share information with trusted service providers that help us operate the Services. These providers are only permitted to process information as necessary to provide services on our behalf and are bound by contractual obligations to protect your data.

Supabase

• Used for: User authentication, account management, database storage of profiles/cycle data/conversation history, private storage of meal photos, and Edge function execution.
• Data centers: Primarily European Union (Frankfurt, Germany).

Anthropic

• Used for: AI Coach response generation and meal photo analysis (vision processing).
• Data protection: Data is processed in the United States under Standard Contractual Clauses.

OpenAI

• Used for: Text embeddings to retrieve relevant knowledge base content.
• Data protection: Data is processed in the United States under Standard Contractual Clauses.

Apple

• Used for: Subscription billing, App Store distribution, and optional HealthKit integration.

Vercel

• Used for: Hosting the Phasely marketing website (phasely.today) and running standard web analytics. Vercel may collect technical information from website visitors, including IP address, browser type, device type, and pages visited.

9. International Data Transfers

Some of our service providers process information outside Switzerland, the European Economic Area, or the United Kingdom. Specifically:

• Anthropic processes data in the United States, protected by Standard Contractual Clauses approved by the European Commission.
• OpenAI processes data in the United States, protected by Standard Contractual Clauses.
• Apple processes data globally; Apple’s data handling is governed by their own privacy practices and Standard Contractual Clauses where applicable.
• Supabase primarily processes data within the European Union (Frankfurt, Germany). Some administrative functions may involve transfers to the United States, protected by Standard Contractual Clauses.
• Vercel processes website data primarily in the United States, protected by Standard Contractual Clauses.

When international transfers occur, we rely on appropriate safeguards as required by GDPR Article 46, including Standard Contractual Clauses and supplementary technical and organizational measures.

10. Data Retention

We retain personal information only as long as necessary for the purposes described in this Privacy Policy.

Specific retention periods:

• Account data (email, profile, settings): Retained while your account is active. Deleted within 30 days of an account deletion request.
• Cycle and wellness data: Retained while your account is active. Deleted within 30 days of an account deletion request.
• AI Coach conversations: Retained while your account is active and may be retained for up to 12 months after creation for service improvement purposes. You may delete individual conversations or all conversation history at any time from within the application.
• Meal photos and analysis data: Retained while your account is active. Deleted within 30 days of an account deletion request. You may delete individual meal logs at any time.
• Billing and subscription records: Retained for up to 10 years to comply with Swiss accounting and tax requirements, even after account deletion.
• Crash logs and diagnostics: Retained for up to 90 days for debugging and stability purposes.
• Anonymous analytics data: Aggregated and not tied to individual accounts; retained for service improvement.

11. Security

We implement technical and organizational measures to protect personal information:

• HTTPS/TLS encryption for all data in transit between your device and our servers.
• Encryption at rest for stored data, including passwords (hashed using industry-standard algorithms).
• Row-level security (RLS) policies in our database to ensure users can only access their own data.
• Private storage buckets for meal photos, accessible only by the authenticated user.
• JWT-based authentication with automatic session expiration.
• Regular security updates of third-party libraries and dependencies.

Despite these measures, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. Please notify us immediately at hello@phasely.today if you suspect unauthorized access to your account.

12. Your Rights

Depending on your location, you may have the following rights regarding your personal information under the GDPR and Swiss FADP:

• Right of access — request a copy of the personal information we hold about you.
• Right to rectification — request correction of inaccurate information.
• Right to erasure (“right to be forgotten”) — request deletion of personal information.
• Right to data portability — export your information in a machine-readable format.
• Right to restrict processing — limit how we use your information.
• Right to object — object to certain types of processing.
• Right to withdraw consent — for processing based on consent.

Requests may be submitted using the contact information in Section 18. We will respond to verified requests within 30 days. Identity verification may be required to protect against unauthorized requests.

Right to lodge a complaint

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with a data protection authority:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — https://www.edoeb.admin.ch
• European Union: Your local Data Protection Authority — https://edpb.europa.eu/about-edpb/members_en
• United Kingdom: Information Commissioner’s Office (ICO) — https://ico.org.uk

13. Automated Decision-Making

The AI Coach uses automated processing to generate personalized educational recommendations based on your cycle data, profile information, and submitted questions.

These recommendations are educational in nature and do not produce legal effects or similarly significant effects on you. They are not automated medical diagnoses, treatment decisions, or determinations of eligibility for any service.

You may opt out of automated recommendations by not using the AI Coach feature. The rest of the application (cycle tracking, calendar, educational content) can be used independently. If you wish to review or request human reconsideration of any AI-generated guidance, please contact us at hello@phasely.today.

14. Account Deletion

You may request deletion of your account at any time through the Settings screen within the application or by contacting us directly. Upon verification of your request, we will delete or anonymize your personal information within 30 days, unless retention is legally required (for example, billing records under Swiss tax law).

To request deletion outside the application, contact: hello@phasely.today

15. Cookies and Tracking

Our Website (phasely.today)

Our website uses minimal cookies and tracking technologies:

• Essential cookies: Required for basic site functionality (e.g., remembering form inputs, session management).
• Anonymous analytics: Vercel may collect anonymous visitor statistics including page views, referrer URLs, and device types for site performance and security purposes.

We do not use third-party advertising cookies, tracking pixels, or cross-site tracking technologies. You may control cookies through your browser settings.

Our Mobile Application

The Phasely mobile application does not use traditional web cookies. We use local device storage (AsyncStorage / native equivalents) to remember your preferences and authentication state. This information is stored securely on your device and is only transmitted to our servers to validate requests.

16. Children’s Privacy

Phasely is intended only for adults aged 18 years or older. We do not knowingly collect personal information from individuals under 18. If you become aware that a child has provided personal information to Phasely, please contact us immediately at hello@phasely.today. Upon verification, we will promptly delete such information.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When material changes occur, we will update the “Last Updated” date at the top of this Policy and provide notice within the Services (such as an in-app notification or email). Continued use of the Services after changes become effective constitutes acceptance of the revised Privacy Policy.

18. Contact Information

If you have questions regarding this Privacy Policy or wish to exercise any of your rights, please contact:

Phasely Karolina Bittman

Zürich, Switzerland

Email: hello@phasely.today

For privacy-specific inquiries, please use the subject line “Privacy Request” to ensure timely routing. We aim to respond to all privacy inquiries within 30 days.