Privacy Policy

1. Introduction

Welcome to CivvyMode ("we," "our," or "us"), operated by MB Djump. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App"). By using the App, you consent to the data practices described in this policy.

2. Data Collection

We collect information that you voluntarily provide to us when you register on the App. The personal information we collect may include:

• Identity Data: Name, Email address.
• Health & Cycle Data: Partner's cycle dates, symptoms, and mood logs (manually entered or synced).
• Device Data: Device model, operating system version, and unique device identifiers (for debugging and analytics).

3. How We Use Your Data

We use the information we collect to:

• Provide and maintain the CivvyMode service (including "Intel Briefs" and notifications).
• Process payments and manage subscriptions.
• Monitor the usage of our App to detect and prevent technical issues.
• Facilitate account creation and authentication.

4. Third-Party Service Providers

We do not sell your personal data. However, we share data with trusted third-party service providers to facilitate our services:

• Supabase: For backend database, authentication, and secure data storage (EU region).
• RevenueCat: For processing subscriptions and in-app purchases.
• OpenAI/Google Gemini: For generating generalized AI advice (data is anonymized - see Section 9).

5. Legal Basis for Processing (GDPR Art. 6)

We process your personal data under the following legal bases:

• Consent (Art. 6(1)(a)): For processing health/cycle data (special category data under Art. 9).
• Contract Performance (Art. 6(1)(b)): To provide the CivvyMode service you subscribed to.
• Legitimate Interest (Art. 6(1)(f)): For app security, fraud prevention, and service improvement.

You may withdraw consent at any time by deleting your account or contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Data Retention & Security

We use administrative, technical, and physical security measures (including Row Level Security) to help protect your personal information.

• Active accounts: Data is retained until you delete your account.
• Inactive accounts: Accounts inactive for 24 months may be flagged for deletion with prior notice.
• Backups: Encrypted backups are retained for up to 30 days after deletion.
• Analytics data: Anonymized analytics are retained for up to 12 months.

Retention Periods:

7. Your Rights (GDPR & Account Deletion)

Under GDPR and applicable data protection laws, you have the following rights:

• Right to Access: Request a copy of your personal data.
• Right to Rectification: Correct inaccurate personal data.
• Right to Erasure: Delete your account and all associated data.
• Right to Data Portability: Export your data in a machine-readable format (JSON) via the App's Settings.
• Right to Withdraw Consent: Withdraw consent for analytics at any time.

Delete Account: You can delete your account and all associated data directly within the App's "Settings" menu or by contacting us at the email below. Upon request, your data will be permanently removed from our active databases within 30 days.

8. Health Data (Special Category Data)

CivvyMode processes menstrual cycle data, which is considered "special category data" (health data) under GDPR Article 9. We process this data only with your explicit consent, which you provide when creating an account and accepting these terms. This data is:

• Encrypted at rest and in transit
• Never sold to third parties
• Only shared with AI providers in anonymized form for generating advice
• Subject to your visibility controls when shared with a connected partner

9. Partner Data Sharing & Visibility Controls

CivvyMode allows two users to connect as partners. When you link your account with a partner, you consent to sharing certain cycle data with them. The person who logs cycle data ("Tracker") has full control over what their connected partner can see.

• Basic Mode: Partner sees only the current phase (Phase 1-4) and general recommendations. Exact cycle day and detailed predictions are hidden.
• Full Access: Partner sees all cycle information including exact day, predictions, and detailed AI recommendations.

Visibility Modes:

• Trackers can change visibility settings at any time in the app's Settings
• Trackers can disconnect from a partner at any time, immediately revoking data access
• Partners cannot change visibility settings - only the Tracker controls this
• Partners cannot export or share Tracker's data to third parties through the app

Your Control:

🔒 Privacy Note: We designed CivvyMode to give Trackers full control over their sensitive health data. Linking with a partner is always optional and reversible.

10. AI Data Processing

CivvyMode uses AI (OpenAI/Google Gemini) to generate personalized tactical advice. When generating AI advice:

• Only cycle phase and day number are shared (no personal identifiers)
• Mood and symptom data may be included but is not linked to your identity
• AI providers do not store or train on your data per their API terms
• All AI-generated advice is for entertainment purposes only

11. International Data Transfers

Some of our service providers (OpenAI, RevenueCat) are located in the United States. When your data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): We rely on EU-approved SCCs for transfers to the US.
• Data Minimization: Only anonymized/pseudonymized data is sent to AI providers.
• EU-Based Primary Storage: Your core data is stored on Supabase servers in the EU region.

12. Children's Privacy

Our App is not intended for use by children under the age of 14 (the digital age of consent in Lithuania, our jurisdiction). We do not knowingly collect personally identifiable information from children under 14. If we discover that a child under 14 has provided us with personal information, we will delete such information from our servers immediately.

13. Contact Us

If you have questions or comments about this policy, or wish to exercise your data protection rights, you may contact us at: