TL;DR. Your cycle data lives on your device by default. The optional cloud sync is end-to-end encrypted — even we can't read your logs. We don't sell data, we don't run third-party analytics, and we don't show ads. AI Coach messages are processed by OpenAI in real time; we don't share them with any other third party. Health Connect (Android) and HealthKit (iOS) access is opt-in, per-data-type, revocable from your system settings, and we only request two Health Connect permissions — READ_MENSTRUATION and WRITE_MENSTRUATION. See §2.6 for details.
1. Who we are
Pemsi is operated by Andrii Kedrov, an individual developer. You can reach us at support@pemsi.serenity.games. This Privacy Policy explains what data the Pemsi iOS and Android apps and the related backend (pemsi.serenity.games) collect, how we use it, and the choices you have.
2. What we collect
2.1 Data you create in the app (cycle, symptoms, mood, notes)
The app stores your cycle history, period events, symptoms, mood entries, daily check-ins, notes, and wellness logs in a local database on your device. These never leave the device unless you turn on cloud sync.
2.2 Account & authentication data
If you sign in, we store an account record with the identifier issued by your chosen provider — Sign in with Apple, Google Sign-In, or a guest account we generate for you on first launch. For Apple and Google we receive your email and (optionally) name; for guest accounts the email is synthetic (...@guest.pemsi.serenity.games) and contains no personal data.
2.3 Subscription data
Pemsi Pro is sold through the Apple App Store on iOS (via StoreKit) and through Google Play on Android (via Google Play Billing). We never see your card details. We do receive a transaction identifier and the active product (weekly / monthly / yearly) so we can grant Pro features.
2.4 AI Coach messages
When you send a question to AI Coach, your message and a privacy-scoped summary of your last 30 days of symptoms and current cycle stats are transmitted to OpenAI (see §4). We store the conversation history in our database so the thread persists across devices.
2.5 Apple HealthKit (iOS, optional)
If you grant HealthKit permissions, Pemsi reads and writes the data types you explicitly approve (period flow, ovulation signals, symptoms). HealthKit access is mediated entirely by iOS; we cannot read more than you allowed.
2.6 Android Health Connect (Android, optional)
On Android, Pemsi integrates with Health Connect — Android's system-level health data hub that mediates sharing between apps such as Samsung Health, Fitbit, Google Fit, Clearblue, Easy@Home, and Premom. Integration is opt-in per data type; you grant or revoke each permission individually in Profile → Privacy inside Pemsi, or in Android Settings → Health Connect → Pemsi.
Pemsi requests exactly two Health Connect permissions, no others:
-
READ_MENSTRUATION— read your menstruation flow records. Used to backfill cycle history from your previous tracker (Samsung Health, Fitbit, etc.) on first launch so the predictions are accurate on day one, without you having to re-enter months of data manually. Records are read on demand, processed on your device by Pemsi's CyclePredictor, and used to compute next-period date, fertile window, ovulation day and the 10-day PMS forecast. -
WRITE_MENSTRUATION— write the period entries you log inside Pemsi back to Health Connect. Used to mirror your Pemsi period logs (start date, end date, per-day flow intensity) so the same record shows up in any other Health Connect-aware app you use. We write only what you explicitly enter — never predicted or inferred dates.
What Pemsi does not do with Health Connect data:
- We do not share Health Connect data with any third party.
- We do not use it for advertising, profiling, or personalization beyond cycle predictions inside the app.
- We do not write data Pemsi did not collect from you directly (no inferred ovulation dates, no AI-generated entries).
- We do not request
READ_EXERCISE,READ_HEART_RATE,READ_SLEEPor any other Health Connect permission Pemsi doesn't need.
Health Connect data is processed on your device. If you have cloud sync enabled (see §3), the data is encrypted on your device before being uploaded — Pemsi servers see only ciphertext, even for Health Connect-sourced records.
2.7 Technical logs
Our backend logs requests for security and debugging (IP address, user agent, request path). These logs are rotated every 14 days. We do not run third-party trackers or advertising SDKs in the app.
3. End-to-end encrypted cloud sync
Cloud sync is opt-in. When enabled, your cycle entries, symptoms, and notes are encrypted on your device with a key derived from your account, then uploaded. The server stores ciphertext only — we cannot read your records, and a database breach would not expose them in plaintext. The decryption key never leaves your devices.
4. Sub-processors
We use a small, audited set of third parties to run the service:
- Apple Inc. — App Store, StoreKit (subscriptions), Sign in with Apple, HealthKit.
- Google LLC — Google Play (Android distribution), Google Play Billing (subscriptions), Google Sign-In, and Health Connect (Android's on-device data hub — Google does not see your records; it only mediates which apps you've allowed to read/write them).
- OpenAI, L.L.C. — AI Coach inference. Messages sent to OpenAI are subject to OpenAI's API data policy; we use the API tier where data is not used to train OpenAI's models.
- Our hosting provider — runs the backend infrastructure under a Data Processing Agreement.
5. Why we process your data (legal basis)
- To provide the service — predictions, calendar, AI Coach, sync. Legal basis: contract.
- To bill subscriptions — granting Pro after a StoreKit purchase. Legal basis: contract.
- To keep the service secure — request logs, rate-limiting. Legal basis: legitimate interest.
- To meet legal obligations — responding to lawful requests. Legal basis: legal obligation.
6. How long we keep your data
- Local data: until you delete it in the app or uninstall.
- Cloud-synced data: until you turn off sync or delete your account. Deletion is permanent and propagates within 30 days.
- AI Coach conversations: kept until you delete them or your account.
- Request logs: 14 days.
7. Your rights
You can:
- access a copy of the data tied to your account;
- correct it;
- delete your entire account and all server-side data — see /delete-account;
- delete specific categories of data without deleting the account — see /delete-data;
- export your local data via Profile → Export data;
- withdraw HealthKit consent at any time in iOS Settings → Health → Data Access & Devices → Pemsi;
- withdraw any Health Connect permission at any time in Android Settings → Health Connect → App permissions → Pemsi, or in-app via Profile → Privacy. Revoking a permission removes Pemsi's access immediately; previously-imported records remain on your device until you also clear them in-app.
Email support@pemsi.serenity.games to exercise any of these rights — we'll respond within 30 days.
8. Children
Pemsi is not directed to children under 13. We don't knowingly collect data from anyone under 13. If you believe a minor created an account, contact us and we'll delete it.
9. International transfers
Our backend is hosted in the EU. AI Coach inference uses OpenAI's infrastructure, which may process data in the United States. Where transfers occur outside the EEA, we rely on standard contractual clauses with the relevant provider.
10. Changes to this policy
If we make material changes we'll update the effective date at the top of this page and, where reasonable, surface the change inside the app on next launch.
11. Contact
Andrii Kedrov · support@pemsi.serenity.games