Privacy Policy

What this is

Cycle is a private, personal web application operated by Dan Wishbone (the "operator") for use by two people: the operator and his partner. It is not offered to the public, has no commercial purpose, and is not sold or advertised. Accounts cannot be created without an invitation from the operator.

Data collected

With the account holder's explicit consent through Oura's OAuth login, the app reads the following from the Oura API for the connected Oura account only:

• Daily readiness summaries: readiness score, body temperature deviation and trend deviation, and the readiness contributor scores.
• Sleep summaries: sleep score, total sleep time, average and lowest overnight heart rate, average overnight heart rate variability (HRV), and breathing rate.

The app does not read location, workouts, activity, SpO2, tags, personal profile details (age, height, weight, email), or raw high-frequency heart rate data.

Users may also enter information themselves: menstrual period start and end dates, bleeding intensity, mood, energy, cramp ratings, and free-text notes.

How the data is used

Oura data and user-entered data are used solely to estimate the menstrual cycle phase of the connected account holder, to display trends to the two users, and to send push notifications about cycle phase to the operator's own devices. Data is not used for advertising, analytics, profiling, model training, or any purpose other than the function of the app.

Storage and security

Data is stored in a single Cloudflare D1 database in the operator's Cloudflare account, served over HTTPS from Cloudflare Workers. Oura access and refresh tokens are stored in that database and used only to call the Oura API. Access to the app requires a passkey (WebAuthn) bound to an invited account. Raw Oura records older than 24 months are deleted automatically.

Sharing

Data is not sold, shared, or transferred to any third party. The only external services involved are Oura (as the data source), Cloudflare (hosting and database), and the push notification service of the user's device platform (Apple or Google), which receives only the notification text.

Within the app, the operator can see the connected account holder's cycle phase, biometric summaries, and the notes she enters. She can see the same data for herself. This sharing is the purpose of the app and happens with her knowledge and consent.

Control and deletion

The connected account holder can disconnect Oura at any time from her view in the app, which deletes the stored Oura tokens and stops all further syncing. She can also revoke the app's access from her Oura account settings. On request to the operator, all stored data about her is deleted from the database. Period and symptom entries can be removed on request as well.

Children

The app is for two adults and is not directed at anyone under 18.

Changes and contact

If this policy changes, the new version is posted at this address with a new effective date. Questions: dan@wishbonemedia.com.