Privacy Policy

Last updated: August 27, 2026

1. Who we are

Halea is made by Halea (“Halea,” “we,” “us”), which operates the Halea app and the website halea.me. Halea is built local-first and serverless: the app has no accounts, no backend, and no database. The simplest privacy promise we can make is architectural — we do not collect your data, so most of this policy describes what happens on your own device.

2. What we collect

Nothing, by default. There is no sign-up, no email, no password, and no profile. Everything you log in Halea — cycle dates, symptoms, mood, wearable readings, preferences — is stored on your device and never transmitted to us.

3. Data on your device

  • Health data you log: menstrual cycle dates, symptoms, mood, and related entries live in the app's local storage on your phone.
  • Wearable data: if you connect Apple Health or Health Connect, readings are accessed with operating-system-level permission and processed on-device. We never receive them.
  • Predictions and insights: calculated locally by the app. No health data is sent anywhere to compute them.
  • Notifications: reminders are scheduled on-device using local notifications.

4. Backups

If you enable backups, they are written to storage that belongs to you: your own iCloud (on iOS) or your own Google Drive app data folder (on Android). Halea encrypts the backup on your device before it is uploaded, with a key that is never sent to Apple, Google, or us. The key reaches your other devices separately — through iCloud's end-to-end encrypted key sync or Google Block Store — and you can set a recovery passphrase as a second way in. Backups are governed by your agreement with Apple or Google; we have no access to them and cannot read, restore, or delete them on your behalf.

Encryption depends on there being a way back to the key. If your device cannot store a key that would survive onto a replacement phone and you have not set a recovery passphrase, Halea uploads the backup unencrypted rather than create one that could never be opened again — your provider's own encryption in transit and at rest still applies. The Backup screen tells you which case you are in.

5. Doctor reports

Halea can generate a summary report of your cycles and symptoms for a healthcare appointment. The report is created on your device, and you choose what it includes and how to share it (PDF export, AirDrop, email, print). Sharing happens directly from your phone — no copy passes through us.

6. Payments

Optional subscriptions (such as Halea Plus), when offered, are purchased through the Apple App Store or Google Play. Payment is handled entirely by the platform: we never see or store your payment details, and no personal or health data is attached to the purchase.

Purchases go through the App Store or Google Play and nowhere else. Halea asks the store, on your device, whether this account owns Halea Plus; it has no payment processor of its own, no account, and never sees your card. A subscription belongs to the store account it was bought on, and the store handles renewals, refunds and receipts.

7. The website

halea.me is a static website. It uses no analytics, no tracking pixels, no advertising, and sets no cookies (see the Cookie Policy). Like any website, our web server and our network provider (Cloudflare) process standard technical request data — such as IP addresses — to deliver pages and protect against abuse; we do not use this to identify or profile visitors.

8. Your rights and control

Because your data never leaves your device, you exercise your rights directly:

  • Access & export: view everything in the app and export it in standard formats at any time.
  • Rectify: edit or correct any entry in the app.
  • Delete: delete entries in the app, or remove all data by deleting the app; delete your own backups from your iCloud or Google Drive.

There is no server-side copy for us to hand over, sell, leak, or be compelled to produce.

9. Children

Halea is not directed at children under 13.

10. Changes

If we change this policy, we will update this page and the “last updated” date. Because the architecture is the promise, any future change that would send data off your device would be called out prominently in the app — not buried here.

11. Contact

For privacy inquiries, contact us at [email protected].