BiorythmBiorythm privacy policy
Last updated: 30 October 2026
Biorythm is an app for iOS and Android that shows biorhythm cycles, the Moon, the Sun and space weather. It is for entertainment and general wellness information only. This page explains what data the app and its optional server handle, why, for how long, and how you can delete it.
Who is responsible
Peter Lukan
Contact for privacy questions and requests: [email protected]
In short
- Your name, date of birth and location stay on your device. We never receive them.
- You can use the whole free app without an account.
- An account is optional. It is needed only for purchases and free trial weeks. The server stores a random account ID and a pseudonymous sign-in identifier, never your name, date of birth, location or email address.
- Usage statistics and crash reports are sent to Google Firebase only if you tap Allow, and you can switch them off at any time in Settings.
- We do not sell data, show ads or track you across other apps and websites.
What stays on your device
Your name, date of birth, chosen location (the device location, or a city you pick from a list built into the app), language and privacy choices are stored on your device. They are used on the device to calculate your biorhythm, the Moon and Sun times and the UV estimate. They are included in your own device backups (for example iCloud or Google backup) if you use those. They are not sent to us and are not part of analytics events or crash reports. Location, if you allow it, is approximate (coarse).
Space weather
The app downloads public space weather data from the U.S. NOAA Space Weather Prediction Center (services.swpc.noaa.gov). The request contains no personal data. Like any web service, NOAA can see your device's IP address.
Usage statistics and crash reports (optional)
If you tap Allow on the first-launch prompt, or turn it on in Settings, the app sends statistics and crash reports to Google Firebase (Google acts on our behalf as a service provider). Until then, and after you switch it off, nothing is collected.
- Statistics: screen names, which feature you open, completion of the first-run setup, language changes, and your consent choice. Firebase adds standard events (first open, session start, engagement, app update) and standard device information: device model, operating system version, app version, language, and an approximate region that Google derives from the IP address.
- Crash reports: the type and stack trace of the error, and standard device state (model, operating system, free memory and storage, time of the crash). No message text, no name, no location.
- Identifiers: a random app-instance ID created by the Firebase software. We set no user ID. Advertising ID collection is switched off.
The legal basis is your consent (GDPR Article 6(1)(a)), which you can withdraw at any time in Settings. Google may process data in countries outside the European Economic Area; Google relies on its own safeguards for such transfers. Analytics data is kept for the shortest retention period Firebase offers (2 months).
Account, purchases and free weeks (optional)
If you tap a locked feature, start a free week or buy something, you are asked to sign in with Apple, or with an email link or code. Data involved:
| Data | Purpose | Kept |
|---|---|---|
| Random account ID and creation / last use time | Your account; also the ID under which your purchases are recorded | While the account exists |
| Pseudonymous sign-in identifier: for Apple, a keyed hash of Apple's subject ID; for email, a keyed hash of your address. The email address itself is not stored: it is used once to send the sign-in message and then discarded. | Recognise you when you sign in again | While the account is linked |
| With Sign in with Apple: an encrypted Apple refresh token | So that we can revoke Sign in with Apple at Apple when you delete the account (an App Store requirement) | Until the account is deleted |
| Sign-in sessions (a hash of the session token, platform iOS or Android, expiry) | Keep you signed in; sign-in is required again at least every 180 days | Until about 30 days after expiry |
| Short-lived email sign-in challenge (hashes only) | Verify the emailed link or code | Deleted within 1 day |
| Free-week claims: account ID, campaign, feature, start and end | Grant the free week once | Until 7 days after account deletion |
| Offer views: when you are signed in, one record per offer you saw; when you are not, only a counter per offer, day and country with no identifier | Statistics for us on how many people saw an offer | Signed-in records are deleted with the account; counters hold no personal data |
| Purchase events from RevenueCat (product, expiry, account ID) | Unlock what you bought and fix problems | Linked to your account only while it exists |
Purchases are processed by Apple or Google, and managed by RevenueCat, Inc., our service provider for in-app purchases. RevenueCat receives your account ID (or an anonymous ID before you sign in), your store receipt and technical data such as your IP address, and handles it under its own privacy policy. We never see your payment card or other payment data; the store handles it. Subscriptions renew automatically and are cancelled in your Apple or Google account settings.
Email sign-in messages are delivered by an email service provider that we configure; it receives your address and the sign-in link for that message. The server does not keep request IP addresses: they are held only in memory for rate limiting, and our server logs contain no IP addresses, tokens, headers or email addresses.
The legal basis is performance of the contract with you (providing the account, free weeks and purchases; GDPR Article 6(1)(b)), our legal obligations such as accounting where they apply (Article 6(1)(c)), and our legitimate interest in running the service securely (Article 6(1)(f)).
Deleting your data
- Data on your device: Settings, Delete my data. This removes your profile, location and privacy choice from the device.
- Your account: Settings, Account, Delete account. This immediately deletes your sign-in sessions, identifiers and signed-in offer views, asks Apple to revoke Sign in with Apple, and deletes your customer record at RevenueCat. The remaining account row and free-week claims are deleted after 7 days. Finished clean-up tasks are deleted after 30 days.
- If you cannot use the app: email [email protected] from the address you used to sign in and ask for deletion. Because we do not store email addresses, we may ask you to complete the in-app deletion with our help, or to sign in so we can identify your account.
- Purchases stay with your Apple ID or Google account and are subject to the store's rules and RevenueCat's transfer rules; deleting the account does not refund a purchase.
- Firebase statistics already sent cannot be linked back to you by us; they expire automatically after the retention period above.
Your rights
If the GDPR applies to you, you have the right to access, correct, delete and export your data, to restrict or object to processing, and to withdraw consent at any time. Because we hold only pseudonymous identifiers, we may need you to sign in to prove the data is yours. You can also complain to your local data protection authority.
Children
Biorythm is not directed at children under 16, and we do not knowingly collect data from them.
Security
All traffic between the app and the server is encrypted (HTTPS). Sign-in tokens and email addresses are stored only as hashes; the Apple refresh token is stored encrypted.
Changes
If this policy changes in a way that matters, the new version is published here with a new date, and in the app where required.