Privacy Policy
Last updated: June 18, 2026
1. Introduction
Femora ("we," "our," or "us") is committed to protecting your privacy and the security of your personal health data. This Privacy Policy explains how we collect, use, store, and share information when you use the Femora mobile application, our website at femora.app, and related services (collectively, the "Service").
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use the Service.
2. Information We Collect
2.1 Account Information
When you create an account, we collect your email address and name. If you sign in with Google or Apple, we receive your name, email address, and a unique identifier from the provider. We do not receive or store your social login passwords.
2.2 Health & Cycle Data
To provide cycle tracking and predictions, we collect the health data you choose to log, including:
- Period start and end dates
- Flow intensity levels
- Cramp severity
- Mood entries
- Free-text notes
This data is classified as sensitive health information and is treated with the highest level of protection.
2.3 Technical Data
We automatically collect certain technical information when you use the Service, such as device type, operating system version, and app version. We do not collect precise location data, contact lists, or browsing history.
2.4 Cookies & Website Analytics
On our website (femora.app), we use cookies and similar technologies together with third-party analytics tools to understand how visitors find and use the site so we can improve it. These analytics run only on the website and do not access the health data you log in the app. See Section 4 for the providers we use and how you can control them.
3. How We Use Your Information
We use your information to:
- Provide and maintain the Service
- Generate cycle predictions and health insights
- Authenticate your account and maintain security
- Send important service-related notifications
- Measure and improve how our website and app perform
We do not use your health data for advertising purposes. We do not sell your personal or health data to third parties.
4. Cookies, Analytics & Your Consent Choices
Our website uses the following third-party analytics services:
- Google Analytics (Google LLC): collects pseudonymous usage data such as pages viewed, approximate (city-level) location, referral source, and device and browser type, using cookies. We use GA4, which does not store full IP addresses.
- Mixpanel (Mixpanel, Inc.): collects product analytics such as page views, link and button interactions, and campaign (UTM) parameters. We do not use session recording or session replay.
These tools collect data about your use of the website only. They do not have access to the cycle, period, or symptom data you log in the app.
Your choices:
- EEA, UK, and Switzerland: We detect your region and show a consent banner. No analytics cookies or tracking load until you click "Accept." If you "Decline," no analytics are loaded. You can change your decision at any time by clearing this site's data in your browser, which will show the banner again.
- Other regions: Analytics load by default. You can opt out at any time using your browser's cookie controls or privacy settings, or browser-level "Do Not Track" / "Global Privacy Control" signals where supported.
- You can also block cookies entirely through your browser settings. Strictly necessary functionality does not depend on analytics cookies.
5. Data Storage & Security
Your data is stored on secure servers with encryption at rest and in transit. We use industry-standard security measures, including:
- TLS encryption for all data transmission
- Encrypted database storage
- Bcrypt-hashed passwords
- JWT-based authentication with short-lived access tokens
- Regular security audits and updates
While we implement robust security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
6. Data Sharing
We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:
- Service Providers: Trusted third parties that help us operate the Service (e.g., cloud hosting and the website analytics providers named in Section 4), bound by confidentiality and data processing agreements.
- Legal Requirements: When required by law, legal process, or government request.
- Safety: To protect the rights, property, or safety of Femora, our users, or the public.
7. International Data Transfers
We operate globally, and your information may be processed in countries other than the one in which you live, including the United States (where our analytics providers are based) and the country in which our servers are hosted. These countries may have data protection laws that differ from those in your country. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
8. Your Rights
You have the right to:
- Access your personal data and request a copy
- Correct inaccurate or incomplete data
- Delete your account and all associated data
- Export your data in a portable format
- Object to or restrict certain processing of your data
- Withdraw consent at any time, including by declining or clearing website analytics cookies as described in Section 4
To exercise any of these rights, please contact us at [email protected]. We will respond within the timeframe required by applicable law.
9. Legal Bases for Processing (EEA & UK Users)
If you are in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent laws apply. Femora is the data controller for your personal data, and you can reach us at [email protected].
We process your personal data on the following legal bases:
- Performance of a contract: to create your account and provide the cycle tracking, predictions, and other features you request.
- Explicit consent: to process your health and cycle data (a special category of data under Article 9 GDPR), and to set non-essential website analytics cookies. You may withdraw consent at any time, without affecting processing carried out before withdrawal.
- Legitimate interests: to secure the Service, prevent abuse, and improve our products, balanced against your rights and freedoms.
- Legal obligation: to comply with applicable laws and respond to lawful requests.
You also have the right to lodge a complaint with your local data protection supervisory authority (for UK users, the Information Commissioner's Office) if you believe we have not handled your data lawfully.
10. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. If you delete your account, we will permanently delete all your personal and health data within 30 days, except where retention is required by law.
11. Children's Privacy
The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy within the app and on our website and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.
13. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: