Quenie Privacy Policy

Last updated: 22 October 2026

Who is responsible

Maria Santos operates Quenie and is responsible for the personal information described in this notice.

Quenie is operated from Portugal. Contact support@quenie.app for privacy questions, requests or complaints. This notice covers the Quenie app, its widget, quenie.app and support. Our separate Consumer Health Data Privacy Policy explains health-data practices and applicable US rights.

The current beta

The current TestFlight beta is for adult testers aged 18 or over, with explicit consent for on-device tracking. The current internal build removes Partner Mode and app-usage analytics permanently. It requires no Quenie account and does not upload health records or app-usage events. Earlier installed test versions are not changed by this notice; see the retired-services section below.

A future public launch is planned for the United States, with an intended minimum age of 13 where the required consent and safeguards can be supported. That plan does not make the current beta available to children or enable any future feature. We will explain material changes and obtain any required additional consent before introducing them. Publishing this notice does not enable purchases or online sharing.

Information on your device

Quenie stores the information you enter, including your preferred name, period dates, check-ins, symptoms, moods, energy, notes and preferences. It also stores saved drafts, cycle estimates, patterns and other insights inferred from your entries. The app uses this information to show your history and personal insights, estimate cycle dates and support features you choose. Predictions can be inaccurate.

These records are stored on your device, in storage also used by the widget. Ordinary logging does not upload your health history to Quenie's server. Your device and Apple backup settings may create additional copies. Widgets and notifications may display information to anyone who can see your device.

If you use voice logging, Apple's on-device speech tools transcribe your speech. Quenie does not save an audio recording or send it away for transcription. A speech model may need downloading; you can type if transcription is unavailable. Keeping the full transcript and keeping extracted remarks are separate choices, both off by default. Text you choose to save becomes part of your local records. Interpretation uses local rules and, on supported devices, on-device models.

Calendar access is optional. After permission is granted, Quenie can initially read all calendars available to it through iOS until you narrow the selection. This may include calendars synced to your iPhone by other services. It uses event information to show overlaps with estimated period dates. Microphone and calendar permissions can be changed in iOS Settings; revoking a permission does not erase previously saved records.

Your consent and privacy controls

Quenie asks for explicit consent to use health information for cycle history, predictions and personal insights. Consent is separate from accepting terms, reading this notice or granting an iOS permission. You can decline; health tracking stays paused.

In Privacy, use Export my records before deletion if you want a copy. Delete my health records withdraws health-processing consent and deletes local health records, preferred name, relevant preferences, saved drafts, derived insights, widget health state and associated notifications. The new privacy release does not contact retired services to delete older server records. Contact support for any earlier online sharing or pending server-removal request.

Your data export and deletion remain available from the subscription screen without an active subscription. Expiry preserves local records and returns to the subscription screen without repeating onboarding. Exported files remain under your control. Deleting app data does not delete Apple backups, files you exported, information another person copied or Apple subscriptions. We cannot remotely retrieve local-only health records from your phone to answer a request.

Quenie keeps evidence of your consent, such as purpose, notice version, date, age band and a local grant identifier. The beta records your self-declared age range, declaration time and adult eligibility; it does not require your birthday, country or state for its local-only consent route. Minimal consent and pending-deletion information can remain after health erasure where needed to record withdrawal or complete cleanup.

Information you choose to send

Support. When you email support@quenie.app, we receive your address, message, attachments and correspondence. Zoho Mail EU provides the mailbox. Please avoid sending health history, pairing codes or other sensitive information unless necessary. If support needs health information, we ask for specific consent to use the necessary details. Unneeded sensitive material is removed rather than used for unrelated purposes.

Exports and sharing. If you export a file or send a discovery card through the iOS share sheet, the recipient or service you select receives that content. Review it before sending. Quenie does not upload these exports to its own service.

TestFlight and Apple services. Apple processes beta invitations, feedback, diagnostics and other platform information under its settings and terms. Information made available to the developer through TestFlight or App Store Connect may include feedback, screenshots, crash and testing information. Review feedback attachments for health details before sending. Apple may also provide product or transaction information used to check paid access; Quenie does not receive your payment-card details. Build 24 is available to the existing internal TestFlight group for sandbox subscription testing. Production checkout is not enabled; publishing these policies does not launch the app or enable purchases.

Website. Vercel hosts quenie.app and receives technical request information, such as IP addresses and request metadata, to deliver and protect it. The site's pages do not use advertising trackers, analytics scripts, forms or browser storage. Visiting the site does not upload your app health records.

Retired services and earlier test versions

Partner Mode and optional usage analytics are retired from the current internal build. The new app contains no partner relay or analytics uploader and does not send new records to Supabase. It removes local partner caches and queued usage events during upgrade. Earlier pairing and deletion credentials may remain dormant on the device so a previous removal request is not silently lost.

Earlier test versions could, with the required choices, send selected partner updates and related pairing, consent and delivery metadata, or pseudonymous feature-use events and installation metadata, to Supabase in the United States. Partner updates could include inferred health details and selected calendar information; analytics could reveal an interest in reproductive health. The service was encrypted in transit, not end-to-end encrypted. Recipients may have retained copies.

Removing the feature does not prove that earlier server information has been erased. Contact support@quenie.app about earlier records or a pending deletion request. Do not send your health history or live pairing code in the initial email. Existing server retention rules below continue to apply until retirement and removal are verified. Older installed builds may still contact those services while they remain available.

Retention

• Device cycle history: stays until you remove it. Server retention limits do not automatically delete your device history. Backup copies depend on your Apple settings.
• Earlier partner server information: acknowledged revocation removes active shared snapshots and alerts. Recipient access to a stale snapshot expires after 30 days from the server-recorded sender update. Alerts expire after the first server-recorded acknowledgment plus 24 hours, or 30 days from server receipt, whichever is earlier. Pairings lose access after 90 days without authenticated sender activity. A daily cleanup job removes expired records; the sender can read their own stale snapshot until cleanup. Receiver polling does not renew these periods.
• Receiver copies: the receiving app expires its shared cache and alerts after 30 days and clears known related notifications on expiry or disconnect. An offline device cannot be guaranteed to clear immediately; recipient-made copies remain outside this control.
• Consent and security evidence: server sharing receipts are removed 24 months after recorded revocation. Minimal revoked-pairing identifiers remain while needed to prevent old credentials being reused. We retain only necessary local consent or request evidence for accountability and cleanup; automated pruning of all historical local receipts is not currently implemented.
• Earlier analytics: daily cleanup retains the server receipt day and preceding 89 days. Offline events can therefore be older than 90 days from the original activity. Installation metadata expires after 90 days without uploads. A deletion-token hash remains for 180 days to reject late uploads.
• Support and closed requests: our retention policy is 12 months after support resolution and 24 months for minimal closed privacy-case evidence, with unnecessary sensitive content removed sooner. These periods are administered through support handling; there is no verified automatic mailbox-wide cleanup. A specific legal obligation or claim may require limited records to be kept longer.
• Provider logs and backups: providers maintain separate operational copies and schedules. We do not promise immediate erasure from every backup or that ordinary app deletion removes provider logs. Contact us for information about handling a particular deletion request.

Legal grounds and international processing

Because the operator is based in Portugal, applicable EU data-protection duties remain relevant even though the planned public launch is US-only. Health tracking relies on consent and explicit consent for health data under GDPR Articles 6(1)(a) and 9(2)(a). Retirement does not extend consent to any new use of previously shared information. Withdrawal does not make earlier lawful processing unlawful.

Ordinary service support may be necessary to perform a contract or respond to your request. General enquiries and service security use our legitimate interests in responding and protecting the service. Applicable legal obligations support rights handling and compliance; necessary legal-claim records require an appropriate separate basis. These grounds do not provide blanket permission to use health information for unrelated purposes.

Service providers include Apple, Zoho, Vercel and, for records from retired services and their cleanup, Supabase. Their roles differ by service. Supabase hosting is in the United States; an EU mailbox does not mean every provider or support operation stays in Europe. International processing must meet applicable transfer requirements. We do not describe an unverified agreement or certification as an established safeguard. Contact support@quenie.app to ask about the safeguards applicable to a particular transfer.

Requests, complaints and changes

Email support@quenie.app to request access, correction, deletion, restriction or portability, withdraw consent, object where applicable, or raise a privacy complaint. No account or special legal wording is required. We may seek proportionate verification; do not send your health history, live pairing code or identity documents with the initial request.

Where GDPR applies, we normally respond within one calendar month. A permitted extension for complex or numerous requests will be explained within that month. You may complain to Portugal's CNPD or another competent authority. Applicable US requests and appeal routes are described in the Consumer Health Data Privacy Policy.

If you believe a child has used the adult beta or provided information to our online services, contact us so we can investigate and take appropriate steps. A parent's request does not automatically authorise disclosure of another person's health records.

We show the date of changes to this notice and explain material changes through appropriate service notices. Where new consent is required, updating the policy alone does not provide it.