Privacy policy
Last updated 29 September 2026
The short version
- What you log in Coggy lives on your phone.
- If you use backup, it is locked on your phone before it is sent. We store the locked copy and cannot open it.
- We never sell your data, never show ads, and never use your health information to train AI.
- You can export or delete your information at any time, inside the app, without asking us.
Contents
- Who we are
- What stays on your phone
- Backup
- What our server holds
- Apple Health
- Usage counts
- What we never do
- Companies that help us
- How long we keep things
- Deleting your account
- Your rights
- Why we are allowed to use your information
- Legal requests
- Where information is stored
- Age
- This website
- Changes to this policy
1. Who we are
Coggy is a wellbeing tracking app for iPhone, run from London, United Kingdom. In this policy "Coggy", "we" and "us" mean the people who make the app. We are the controller of the personal information described here.
Questions about privacy: support@coggy.app
2. What stays on your phone
Your phone holds the main copy of everything you record in Coggy, including:
- periods, spotting and flow
- symptoms, mood, energy, stress and how your body feels
- fasting, medication, treatment and other context you add
- private notes
- anything imported from Apple Health
- summaries and reports you create
We treat all of this as health information, which the law gives extra protection. It is encrypted on your phone using Apple's built-in data protection. Coggy works fully without an internet connection.
Patterns, predictions and reports are all worked out on your phone. Our server never does this.
Your doctor's summary and your CSV export only leave your phone when you choose to share them yourself.
3. Backup
Backup is on when you create your account, and we tell you so at that moment. It lets you get your record back on a new phone.
- Each entry is locked (encrypted) on your phone before it is sent.
- The key to unlock it is kept in your iCloud Keychain, and in a recovery key that we offer you once you have some history saved. We never have the key.
- Our server stores only the locked copy. It cannot read your entries, dates, symptoms or notes.
- So that your record can be put back in the right order, each locked entry carries a few plain labels: an entry number, when it was last changed, which of your devices changed it, a format number, whether it has been deleted, and a broad type such as "entry" or "settings". These labels never name a symptom, a health date or a cycle length.
You can turn backup off in Settings → Privacy & data. This erases the backup from our server, and your phone becomes the only copy.
4. What our server holds
Our server does three jobs: it checks it is really you when you sign in, it keeps your locked backup, and it remembers your subscription. It holds:
| Information | What it is |
|---|---|
| Account | A random account number, the date you joined, how you sign in (your Sign in with Apple identifier, or your email address), and your subscription status. |
| Locked backup | Your encrypted entries and locked keys, which we cannot open. |
| Devices | A random number for each phone you sign in on, its app version and when it was last seen. You can see and remove these in the app. |
| Subscription history | Records Apple sends us about your purchase and renewals. Apple handles the payment; we never see your card. |
| Usage counts | See section 6. |
| Server logs | Which part of the server was used, whether it worked, how long it took and a rough region. No contents, no email addresses, no sign-in tokens. |
Signing in. You can use Sign in with Apple or an email address with a one-time code. There are no passwords. If you choose Apple's "Hide My Email", we only ever see the relay address. If you use email, we send your code through our email provider (see section 8).
5. Apple Health
Connecting Apple Health is optional. If you connect it, Coggy asks permission to read your period and spotting history, one type at a time. You choose what to allow in Apple's own permission screen and can change it in the Health app at any time.
- Coggy does not write anything into Apple Health.
- Information from Apple Health is kept on your phone like the rest of your record, and is included in your locked backup if backup is on.
- We never use Apple Health information for advertising or marketing, never sell it, and never share it with anyone.
6. Usage counts
To learn which parts of the app work, Coggy sends simple counts, such as "a screen was opened", "a check-in was finished in 20 seconds with 4 answers" or "a badge was earned".
These counts never include a symptom, an answer, a note, a date of anything health-related, a cycle length, your companion's name or anything you type. Our server rejects any count that tries to carry more than this.
You can turn usage counts off in Settings → Privacy & data. Once off, nothing is sent from your phone. We do not use any advertising, tracking or third-party analytics tools in the app.
7. What we never do
- Sell your information, or use it for advertising.
- Share your health information with anyone.
- Read, scan or search your notes.
- Use your health information to train AI models.
- Guess whether you are pregnant. Coggy only knows what you tell it.
8. Companies that help us
A few companies provide services Coggy runs on. None of them can read your health information.
| Company | What they do | What they handle |
|---|---|---|
| Supabase | Runs our server and database, in London | Everything in section 4 (backup stays locked) |
| Postmark | Sends your one-time sign-in code by email | Your email address and the code |
| Apple | Sign in with Apple, App Store payments, iCloud Keychain | Handled under Apple's own privacy policy |
| Vercel | Hosts this website | Basic visit logs (see section 16) |
Before adding any new company that could come near your information, we review it and update this list.
9. How long we keep things
| Information | How long |
|---|---|
| Your health record | Until you delete it or your account. It never expires on its own. |
| A single entry you delete | Gone from our backup within 7 days. |
| Your whole account | See section 10. |
| Usage counts | 13 months, then only combined totals that cannot be linked to you. |
| Server logs | 30 days. |
| Subscription records | As long as the law and Apple require, kept apart from your health record. |
| If you stop paying | We keep your record so you can still see, export or delete it. We never delete it because a subscription ended. |
Our hosting provider also keeps daily safety copies of the database for 7 days. These hold the same locked data and nothing more.
10. Deleting your account
Go to Settings → Privacy & data and choose delete. You never need to contact us.
- Everything is wiped from your phone straight away.
- Our server copy is deleted within 30 days.
- For the first 7 days, signing back in cancels the deletion, in case you change your mind.
- We confirm when you start, and again when it is finished.
Deleting your account does not cancel your subscription. Only Apple can do that: open the Settings app on your iPhone, tap your name, then Subscriptions.
You can also delete smaller pieces: one entry, a range of dates, one kind of entry, or everything imported from Apple Health. Your badges and Care Points stay unless you delete the account.
11. Your rights
Under UK and EU data protection law (and similar laws elsewhere) you have the right to:
- see the information we hold about you
- correct it
- delete it
- take a copy of it (use Export in the app for a CSV file)
- object to or limit how we use it
- withdraw your consent at any time
Most of this you can do yourself in the app. For anything else, email support@coggy.app and we will reply within one month.
If you are unhappy with how we handle your information, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.
12. Why we are allowed to use your information
- Health information: your explicit consent, which you give when you set up and use Coggy's tracking. You can withdraw it at any time by deleting the information or your account.
- Your account, backup and subscription: we need them to provide the service you signed up for.
- Usage counts and server logs: our legitimate interest in keeping Coggy working and improving it. Usage counts can be switched off.
- Subscription records: legal duties, such as tax and accounting rules.
13. Legal requests
If a court or authority lawfully asks us for information, this is all we could hand over: your account details, your device list, your subscription records, and your locked backup, which we have no key to open.
We cannot produce your cycle dates, symptoms, notes or reports, because we do not have them and have no way to work them out.
14. Where information is stored
Our server and database are in London, UK. Our email provider, Postmark, may process your email address and sign-in code in the United States. Where information leaves the UK or EU, we rely on approved legal safeguards such as standard contractual clauses.
15. Age
Coggy is for adults aged 18 and over. We do not knowingly collect information from anyone younger.
16. This website
This website has no cookies, no tracking and no analytics. Our host, Vercel, keeps short technical logs of visits (such as IP address and browser type) to keep the site running and secure.
17. Changes to this policy
If we change this policy, we will update the date at the top. If a change affects how we use your health information, we will tell you in the app first.