Privacy Policy

Your data belongs to you. We built Onah with privacy at its core. We will never sell your personal data, and we are committed to being transparent about how your information is used.

We collect: (a) Account data — email address, first name; (b) Health data — menstrual cycle dates, cycle length, mood, energy, physical and spiritual check-in scores, and personal notes; (c) Usage data — app interactions and feature usage for improving the experience; (d) AI conversation data — messages you send to AI specialists within the app.

Your data is used to: provide and personalise the cycle tracking experience; generate phase-aligned recommendations; power AI specialist conversations; and improve the app through aggregated, anonymised analytics. We do not sell your personal data. We do not use your data for advertising.

Sensitive health data — including check-in notes, personal context, and AI conversation messages — is encrypted at rest using column-level encryption in our database. Your data is never stored in plaintext. Authentication tokens are stored in your device's secure keychain.

We share data with: (a) Supabase — our database and authentication provider, who process data under strict data processing agreements; (b) OpenAI — to power AI specialist conversations. Messages are processed to generate responses but are not retained by OpenAI beyond the API call duration; (c) Circle of Trust members — only information you explicitly choose to share through the Circle feature. We do not share data with advertisers or data brokers.

You have the right to: access your personal data; correct inaccurate data; delete your account and all associated data; withdraw consent at any time; request data portability (export your data in a standard format). To exercise these rights, use the Legal & Privacy section in Settings, or contact privacy@onah.me.

Your data is retained for as long as your account is active. Upon account deletion, all personal data is permanently removed within 30 days, except where retention is required by law.

The Onah mobile app does not use web cookies or third-party tracking pixels. We use Supabase's session management for authentication, stored securely in your device's encrypted keychain.

Onah is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe a child has provided us data, please contact us and we will delete it promptly.

Material changes to this Privacy Policy will require your re-acceptance before you can continue using the app. You will always be notified within the app when updates occur.

For privacy inquiries: privacy@onah.me