Privacy Policy

PCOS Pandy

Last updated: July 18, 2026

Kaya Apps ("we," "us," or "our") built PCOS Pandy (the "App") to help people with PCOS track their cycle, symptoms, food, and weight. This Privacy Policy explains what data the App collects, how it is used, and the choices you have. It applies to the App and to this policy page.

If you do not agree with this policy, please do not use the App.

1. Summary (Plain-Language Overview)

PCOS Pandy does not require an account. There is no sign-up, login, or password.
Your health data (cycle, symptoms, weight, food logs) is stored locally on your device. We do not operate a database of your personal health records.
We do not sell your data, and we do not use your health data for advertising.
Apple Health (HealthKit) data is used only to power features you explicitly enable, never for advertising, and never sold or shared with data brokers.
A meal photo you choose to scan is sent securely to our server, which forwards it to our AI provider (Google Gemini) to estimate nutrition. The photo is not stored after the estimate is returned.
Subscriptions are handled entirely by Apple and our subscription-management partner (Adapty); we do not process or store your payment card details.

The sections below give the full detail required for App Store review and for privacy laws such as the GDPR and CCPA.

2. Who We Are

PCOS Pandy is developed and published by Kaya Apps. For any privacy question, request, or concern, contact us at:

furkan18388@gmail.com

Kaya Apps is the data controller for the limited data described in this policy.

3. Data We Collect and How We Use It

3.1 Data that stays on your device

The core of PCOS Pandy — your cycle entries, symptom logs, mood check-ins, habit tracking, food logs, weight entries, notes, medication reminders, and app settings — is stored locally on your device using encrypted on-device storage. This data is not transmitted to or stored on our servers, is not linked to your identity by us, and is not accessible to us. It stays on your device unless you choose to export it (Section 3.6) or it is synced to Apple Health (Section 3.2).

Because we never receive this data, we cannot read it, back it up on your behalf, or recover it if you uninstall the App or lose your device — except as noted in Section 6.

3.2 Apple Health (HealthKit)

If you choose to connect Apple Health from Settings, PCOS Pandy may:

Read your step count and body weight from Apple Health, to display them inside the App.
Write the weight you log in the App to Apple Health, and, if you record period days in the App, write that menstrual-flow data to Apple Health, so your records stay consistent across apps you choose to use.

HealthKit permission is requested only when you first use a feature that needs it — never during onboarding, and never as a condition of using the rest of the App.

Our commitments regarding Apple Health data, in line with Apple's Health data guidelines:

We will never use data obtained through HealthKit for advertising, marketing, or other use-based data-mining purposes unrelated to your health and fitness.
We will never sell HealthKit data to anyone, including advertisers or data brokers.
We will never share HealthKit data with third parties (including analytics or advertising networks) except where strictly necessary to provide a health or fitness feature you have directly requested, and never without your awareness.
HealthKit data is used solely to power the in-app features described above.

You can disconnect Apple Health access at any time from the iOS Settings app (Settings → Privacy & Security → Health → PCOS Pandy) or from within the App's Settings screen.

3.3 AI Meal Photo Scanner (Premium Feature)

If you use the photo food scanner, the photo you select or capture is:

Resized on your device before it ever leaves the App (to reduce data transferred).
Sent over an encrypted (HTTPS) connection to our backend, hosted on Cloudflare Workers, which acts as a secure relay.
Forwarded by our backend to our AI provider, Google Gemini, which analyzes the image and returns estimated food items, portion sizes, and nutritional values.
Not stored by us or, per our configuration with our AI provider, retained for model training. The photo exists only for the seconds needed to produce your estimate.

The nutrition estimate returned by the AI is then saved on your device, like any other food log entry, unless you choose to save it. Estimates are not medical or diagnostic information — see Section 9.

The same proxy architecture is used for the optional monthly "Letter from Pandy" AI summary (where available): only anonymized, aggregate numeric statistics (e.g., counts of symptoms logged, cycle-length statistics, habit completion percentages) are sent — never your name, freeform notes, or photos — and the response is a short personalized message generated for you and stored on your device.

We never require your API credentials or any third-party account to use these features; your device never talks to Google Gemini directly. Our server, not the App, holds any provider credentials.

3.4 Device Attestation and Anti-Abuse Data

To protect our backend from automated abuse (which would otherwise let bad actors drain the free AI-scan quota meant for real users) we use Apple's App Attest / DeviceCheck framework. This creates a cryptographic, anonymous proof that requests come from a genuine, unmodified copy of the App running on genuine Apple hardware. This mechanism:

Does not identify you personally.
Does not access your health data, photos, or app content.
Is used solely to validate that API requests (like a food-scan request) are legitimate, and to enforce fair daily usage limits.

Alongside App Attest, our backend also receives a randomly generated, non-identifying client identifier (created and stored on your device) and, if you are a subscriber, a subscriber/entitlement identifier from Adapty (Section 3.5) — used only to check your subscription status and enforce usage limits (e.g., daily scan counts).

3.5 Subscriptions and Payments

Subscription purchases are processed entirely by Apple through the App Store, via Apple's In-App Purchase / StoreKit system. We never see or store your payment card, Apple ID password, or billing details.

We use Adapty, a subscription-management platform, to validate purchases, track entitlement status, and (for products that support it) run limited, permission-based promotional offers. Adapty receives a device-generated subscriber identifier and purchase/entitlement events (e.g., which plan you purchased and whether it is active) from Apple's StoreKit. Adapty's own privacy practices are described at adapty.io/privacy.

You can view, manage, or cancel your subscription at any time in your iPhone's Settings → [Your Name] → Subscriptions, or via the "Manage Subscription" link inside the App.

3.6 Data Export

If you are a subscriber, you may export your locally stored logs as a CSV file from Settings, for your own records or to share with a healthcare provider. This export happens entirely on your device using your device's standard share sheet; we do not receive a copy of the export unless you choose to send it to us (e.g., by attaching it to a support email).

3.7 Notifications

If you enable notifications, the App schedules local reminders (daily check-in, medication/supplement reminders, predicted period reminders) directly on your device using iOS's notification system. These reminders are generated and scheduled entirely on-device from your locally stored data; we do not operate a push-notification server and do not receive any data as a result of you enabling notifications.

3.8 Diagnostic and Analytics Data

We may collect limited, aggregated product-analytics data (such as which screens are opened, which features are used, and coarse crash/performance diagnostics) to understand how the App is used and to fix bugs. Where this is implemented, it is:

Not linked to your name, email, or any account (the App has none).
Not used to build an advertising profile of you.
Not sold or shared with data brokers or advertising networks.

If we later add analytics tooling (e.g., for crash reporting), that provider's own privacy terms will govern their processing of the limited technical data described above, and we will update this policy accordingly.

4. Data We Do Not Collect

We do not collect, and the App does not ask for:

Your name, email address, or phone number.
An account, password, or any login credential.
Your precise or approximate location.
Your contacts, photos beyond the single meal image you actively choose to scan, microphone, or camera roll access beyond what you explicitly select.
Advertising identifiers (IDFA) for tracking, and we do not run behavioral advertising.

5. Legal Basis for Processing (EEA/UK Users)

Where the GDPR or UK GDPR applies, we process the limited data described in Section 3 (photo forwarded for a scan you requested, device attestation signals, anonymized AI-summary statistics, subscription entitlement identifiers, and optional analytics) under the following legal bases:

Performance of a contract — to provide the features you request (e.g., generating a food-scan result you asked for, validating your subscription).
Legitimate interests — to secure our backend against abuse (App Attest) and to understand product usage (aggregated analytics), balanced against your privacy interests.
Consent — for optional features such as Apple Health access and push notifications, which are always opt-in and can be withdrawn at any time.

6. Data Retention and Deletion

On-device data (cycle, symptoms, food logs, weight, notes, settings) persists on your device until you delete it. You can delete all locally stored data at any time from Settings → Data → "Delete All Data," which requires a double confirmation and is irreversible.
Uninstalling the App removes all locally stored data from your device (subject to Apple's standard iOS behavior for app data).
Meal photos sent for AI scanning are processed transiently and are not retained by us after your result is returned.
Device attestation and client identifiers are retained only as long as needed to enforce usage limits and prevent abuse, and are rotated or reset if a device is deemed compromised.
Subscription/entitlement identifiers are retained by Adapty and Apple in line with their own retention practices, generally for the duration of your subscription relationship plus any period required for financial/legal record-keeping.

You may request deletion of any of the limited server-side identifiers described above by contacting furkan18388@gmail.com.

7. Your Rights

Depending on where you live, you may have rights to:

Access the limited data we hold about your device/subscription.
Correct inaccurate data.
Delete your data (for on-device data, this is self-service in Settings; for the limited server-side identifiers we hold, contact us).
Restrict or object to certain processing.
Data portability (for on-device data, this is self-service via the CSV export feature).
Withdraw consent at any time for optional features (Apple Health, notifications) by disabling them in iOS Settings or in-app.
Lodge a complaint with your local data protection authority (for EEA/UK users) or, for California residents, exercise rights under the CCPA/CPRA as described in Section 8.

To exercise any of these rights, contact furkan18388@gmail.com. We will respond within the timeframe required by applicable law.

8. California Privacy Rights (CCPA/CPRA)

We do not sell or share (as defined by the CCPA/CPRA) your personal information, and we do not use sensitive personal information (including health information) for purposes beyond providing the App's features. California residents have the right to know what personal information is collected, to request deletion, to correct inaccurate information, and to not be discriminated against for exercising these rights. Contact furkan18388@gmail.com to exercise these rights.

9. Health Information Disclaimer

PCOS Pandy is a self-tracking and educational tool. It is not a medical device, does not provide medical advice, diagnosis, or treatment, and is not a substitute for professional medical care. Cycle predictions, symptom pattern insights, AI nutrition estimates, and the "Doctor Report" export are estimates intended to support conversations with a qualified healthcare provider — always consult a doctor or other qualified health professional for any questions about a medical condition. Educational content in the App is drawn from published, peer-reviewed sources but is not personalized medical guidance.

10. International Data Transfers

Our backend infrastructure (Cloudflare) and AI provider (Google Gemini) may process the limited transient data described in Section 3.3–3.4 on servers located outside your country, including in the United States. Where required by law, such transfers are made subject to appropriate safeguards (such as Standard Contractual Clauses) provided by these processors.

11. Children's Privacy

PCOS Pandy is not directed to children under 13 (or the minimum age required by your local law) and we do not knowingly collect personal information from children. Because the App requires no account and stores health data locally on the user's own device, we have no practical means of identifying a user's age from data we hold. If you believe a child has provided us with information (for example, via a support email), contact furkan18388@gmail.com and we will address it.

12. Third-Party Services

The limited processing described above may involve the following categories of third-party service providers, each acting as our data processor under their own privacy terms:

Provider	Purpose	Data Involved
Apple (App Store, StoreKit, HealthKit, App Attest, Push Notifications)	Purchases, health data sync, device attestation, local notifications	Purchase/entitlement events, HealthKit data you authorize, device attestation signals
Google (Gemini API)	AI-based food/nutrition estimation and letter generation	Meal photo (transient, not retained), anonymized aggregate statistics
Cloudflare	Secure backend relay/hosting	Encrypted request traffic; no persistent storage of your health content
Adapty	Subscription management and entitlement validation	Device-generated subscriber identifier, purchase/entitlement status

We do not permit these providers to use the data shared with them for their own advertising purposes.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the App, our practices, or legal requirements. We will update the "Last updated" date above, and for material changes we will provide reasonably prominent notice within the App (e.g., a Settings notice) before the change takes effect.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, contact:

Kaya Apps
Email: furkan18388@gmail.com

Bu Blogda Ara

Kayaapps

PCOS Pandy - Privacy Policy