Privacy Policy

Effective October 14, 2026

Poppy Days is made by RAS Studios ("we", "us"). This policy explains what information the Poppy Days app and website handle, where it goes, and the choices you have. We wrote it to be read, not skimmed past.

1. Information stored on your device

What you enter in Poppy Days stays on your iPhone or iPad: birth month and year, mode, period dates, flow, symptoms, moods, private notes, planner events, reminder settings, family links and learning progress. It is kept in protected storage that can't be read while your device is locked, it is not synced to iCloud, and it is excluded from device backups. We do not receive this information in readable form. The only exception is the sharing you choose with a linked family member, described in section 2: that is sent directly between your phones, or, with encrypted sync, stored on our server encrypted with a key we never receive.

2. Information we receive

If you use encrypted sync

Encrypted sync is optional and off unless a family chooses it. When it is on, the first device in your family creates a secret key, and other devices receive that key in person through a QR code. Shared information is encrypted on the device with that key before it is sent. Our server receives and stores:

• randomly generated identifiers for your family group and each device;
• encrypted records, with their size and the time they were updated;
• when each device last connected;
• an Apple push notification token, only if notifications are turned on, so we can tell a device that something new is waiting.

We do not receive your family's key, so we cannot decrypt the records, and we cannot recover them if every device in a family is lost. The server does not receive your name, email address, birth date or any health information in readable form.

Like any internet service, our server sees the IP address of a device when it connects. We use it only briefly, in memory, to limit abuse such as repeated guessing of invite codes. We do not store IP addresses in our database or logs.

If you use Nearby only sync, or no sync

Linked devices talk directly to each other over your local network with an encrypted connection. Nothing passes through our server, and we receive nothing.

When you contact us

If you email us, we receive your email address and whatever you write, and use it only to reply. Please don't send health details; we don't need them to help.

3. Apple Health

If you turn on Apple Health sync, Poppy Days reads and writes menstrual flow records in Apple Health on your device, with your permission. Poppy Days writes only the days you actually log, never estimates. It reads records other apps saved and shows them to you; nothing is added to your log until you choose to add it. Information from Apple Health is never sent to our server, used for advertising or marketing, sold, or shared with anyone, including through encrypted sync, unless you choose to add it to your log and then choose to share a category with a linked family member. You can change Apple Health permissions at any time in the Health app.

4. Sharing with family

A linked grown-up receives only support requests a child sends and any extra categories the child switches on (upcoming likely days, period dates, symptom days). Private notes, moods and flow are never shared. The child can preview, pause or end sharing at any time. Information already received, screenshots, and files or messages you send outside the app can't be recalled.

5. Purchases

Poppy Days Plus is sold through Apple's App Store. Apple processes payment; we never see your payment details. The app learns only whether Plus is active on your Apple Account. Apple's privacy policy applies to purchases.

6. Exports and reports

Export my data and the doctor report create files only when you ask. Once you save or send them, they are outside Poppy Days, and whoever has them can read them.

7. What we never do

• Sell, rent or trade personal information.
• Show ads or allow advertising or analytics tools in the app.
• Use health information to profile you or for any purpose other than showing it back to you.
• Store personal health information in iCloud.

8. Children

Poppy Days is designed to be used by children together with a parent or guardian. In the app, tracking for anyone under 13 stays off until a parent or guardian links their device and gives their OK. We don't ask for children's names or contact details, and we don't knowingly collect personal information from children. Encrypted sync stores only encrypted data we cannot read and random identifiers. A parent or guardian can ask for a child's tracking information to be deleted from within the app, or contact us at privacy@poppydays.app.

9. How long we keep information

• On your device: until you delete it, use Delete everything, or delete the app.
• Encrypted sync: a device's records are deleted from the server when it leaves the family or uses Delete everything. When the last device leaves, the whole family group is deleted. A family group that nobody opens for 12 months is deleted automatically. Our database provider keeps short-term backups, so deleted encrypted data may remain in a backup for up to 7 days before it is gone.
• Emails: as long as needed to help you, then deleted.

10. Where information is stored

Encrypted sync data is stored on Microsoft Azure servers in the United States. Push notifications are delivered by Apple.

11. Security

On-device data uses iOS file protection, and keys are kept in the device Keychain. Data sent between devices or to our server is encrypted in transit, and sync data is also encrypted with your family's key. No system is perfectly secure, but we designed Poppy Days so that even we can't read your health information.

12. Your choices and rights

You can see, export and delete your information in the app at any time, turn Apple Health or sync off, and end family links. Depending on where you live, you may have rights to access, correct or delete personal information. Because we hold no readable personal information about you, most requests are handled directly in the app, but you can always contact us.

13. The website

poppydays.app uses no cookies, analytics or tracking. Our hosting provider may keep standard server logs for security.

14. Changes

If we change this policy, we'll update the date at the top and, for important changes, tell you in the app before they apply.

15. Contact

RAS Studios — privacy@poppydays.app