Legal

Consumer Health Data Privacy Policy

Effective date: 5 November 2026 · Applies to the app “Takt — Zyklus & Periode” and to the website taktcycle.com

This English version is the authoritative one. A German translation is available at Datenschutzerklärung für Gesundheitsdaten (USA).

1. The short version

Takt has no server. Everything you enter — bleeding, temperature, cervical mucus, symptoms, notes — is stored encrypted on your device and is not transmitted to us or to anyone else. There is no account, no login, no sync, no analytics, no advertising code and no crash reporting. We cannot see your entries, and we have no technical route to them.

You can check this instead of believing it. Put the phone in airplane mode. Takt keeps working — entering, calculating, the analysis, the “Cycle report”. Only your subscription talks to the App Store or Google Play: Takt asks there by itself whether it is active, and if the answer stays away for 14 days, full access pauses until it comes back (section 6 of our general Privacy Policy). Takt itself opens no connection and sends nothing.

We do not sell consumer health data, and we do not share it with anyone. Sections 5 and 6 explain why that is a fact about the architecture and not a promise about our intentions.

2. Categories of consumer health data we collect

“Collect” here follows the state statutes, not the app-store definition: it covers data that Takt records, stores, computes with, or displays, even when all of that happens on your device and nothing is transmitted. Every category below is stored only on your device.

Nothing in this list is mandatory, with two exceptions: if you begin your path after the pill, you state your reason (row “Life path events”); if you have Takt accompany you through your menopause, you state your year of birth (row “Year of birth”). Every other field you leave empty stays empty; Takt does not fill in or estimate anything, with two exceptions: the period Takt creates for you when you stop the pill (row “Life path events”), and the strength of a bleed. If you enter a whole period after the fact or carry over bleeding days without a strength from another app, Takt enters it as “medium”; you can change each day. The signs marked optional are switched off when you install the app.

Why each of these counts. Bleeding, cervical mucus, cervix and intercourse are reproductive and sexual health information, and menstruation is named in all three statutes. Basal body temperature and resting pulse are bodily functions and vital signs. Symptoms and their day-level severity are symptoms. The free-text note, the year of birth and everything Takt derives from your entries fall under the catch-all the statutes use for information that is derived, extrapolated or inferred, or that is used to associate a person with the categories above. Three of these deserve a paragraph of their own.

Menopause and hormonal transition

Takt does not measure hormone levels and makes no statement about them. It records what you enter. But hot flushes and night sweats are commonly read as signs of a hormonal transition, and California’s CMIA expressly lists “hormone levels” among the information it protects. We therefore treat these entries — and the day-level severity that belongs to them — as consumer health data and name them here, rather than argue about where the boundary runs. Takt forms no score from the severity, applies no threshold to it, and draws no conclusion about your stage of life. The value stays the value you entered.

Year of birth

Washington’s MHMDA does not list age as a category of its own, but it does have a catch-all: information used to associate or identify a consumer with the listed health categories, including data that is derived, extrapolated, inferred or algorithmic, is consumer health data. Your year of birth becomes exactly that the moment Takt uses it — and it uses it solely for the “Cycle report”: there it appears in the header, as a year and as an age range; it selects the clinical reference range that sits beside your cycle variation, which depends on age; and from the age of 45 the “Cycle report” also carries a section on menopause. Takt asks for it where the “Cycle report” is put together, not at first launch, and leaving it unanswered is a full answer. You can add or remove it at any time in the cycle settings. There is one exception: if you have Takt accompany you through your menopause, Takt asks for the year when you begin, because your doctor places your symptoms in relation to your age. For as long as you have Takt accompany you, you can change the year but not remove it. If you end the accompaniment, you can remove it again.

Pregnancy and postpartum

Takt has no pregnancy mode: it does not ask whether you are pregnant, it does not follow a pregnancy week by week, and it offers no postpartum programme. What you can record yourself is an event on your life path — a pregnancy, including how it ended (with a birth, or earlier), breastfeeding, an illness, a medication, an operation, a therapy. Takt never distinguishes between a miscarriage and a termination, and it stores no such distinction. We name the category here because California’s CMIA expressly covers “pregnancy outcome”, and because you should be able to see what is there as plainly as what is absent. These entries sit in the same encrypted block on your device as everything else, and they leave it only if you share a file yourself. If Takt ever gains a mode that follows a pregnancy week by week, this policy will say so before that mode ships.

What Takt never asks for

Your name, your email address, your full date of birth, your location, your contacts, your phone number, a device identifier or an advertising identifier. There is no account and no registration. The app does not know who you are. It records no genetic data, no biometric identifiers and no gender identity. An illness, a medication or a treatment you can set as an event on your life path; Takt does not read it, does not link it to anything and does not evaluate it.

3. Purposes

Every purpose below is served on your device. None of them involves transmitting anything.

We do not use any of this data for advertising, marketing, profiling, scoring, market research, product analytics, or to train any model. That is not a policy we could quietly change: there is no transmission and no copy anywhere else, so there is nothing to use.

4. Sources

There are exactly two, and you open both of them yourself.

1. You. Almost everything comes from what you enter in the app — temperature and resting pulse included. Both are signs of their own, with their own entry.
2. A file you import. If you switch from another cycle app, Takt can read an export file you supply — from Clue (including password-protected archives), Flo, drip, Natural Cycles, a Takt backup, or a generic CSV table. You choose the file; nothing is fetched from anywhere. Imported values land in the same encrypted block on your device as everything else.

Apple Health and Health Connect are not a source at all. No system permission, no permission dialog, no ongoing access, no import — and no file route either: the one that existed until 31 Aug 2026 has been removed.

We receive consumer health data from no other source. No data brokers, no advertising networks, no partners, no public records, no other apps. We receive nothing at all, because there is nowhere for anything to arrive.

5. Categories of third parties with whom we share consumer health data: none

We share consumer health data with no one. Not with affiliates, not with processors, not with service providers, not with advertising or analytics partners, not with data brokers, and not in anonymised or aggregated form.

This is a statement about the architecture, and it can be checked:

• There is no server of ours. Takt has no backend. There is no place at our end for data to arrive.
• The app works without a network. In airplane mode, everything keeps working except your subscription’s exchange with the store; if the store’s confirmation stays away for 14 days, full access pauses until it comes back. An app that keeps working offline is not sending anything.
• There is no third-party code that could send anything. No analytics or statistics tools (no Google Analytics, no Firebase, no Matomo), no crash reporting (no Crashlytics, no Sentry), no advertising SDK, no advertising ID, no cross-app tracking, and no third-party subscription service (no RevenueCat, no Adapty). Subscriptions run through the store interfaces alone.
• We have no key. The data is encrypted by the operating system with a key that does not leave the device (section 7).

Two things we will not leave unsaid.

Files you share yourself. Takt can produce a full backup (JSON), a table (CSV) and a “Cycle report” (PDF), all generated on the device. As soon as you pass such a file to your operating system’s share sheet, it leaves your device, and where it goes is your choice: an email goes through your email provider, a cloud upload sits with that cloud provider. Those destinations have their own privacy terms. We are not involved and learn nothing about it. A cycle export is a health document; it deserves the care you would give a letter from your doctor.

The stores. Apple and Google know that you downloaded and paid for Takt. That is the one data trail an app without a server still produces, and we cannot take it away from you. It says nothing about your cycle, because no store reaches that far. It is purchase data, not consumer health data — but it exists, and we would rather name it than pretend otherwise.

6. We do not sell consumer health data

We do not sell consumer health data, and we never have. There is no exchange of your entries for money or for any other valuable consideration, in any form.

MHMDA does not permit a company to sell consumer health data on the strength of a privacy policy. It requires a separate, written authorization, signed by you, distinct from any consent to collect or share, with a defined content and an expiry. Nevada SB 370 works the same way. We will never ask you for such an authorization, because there is no sale to authorize. If that were ever to change, it could not happen quietly: it would take a signed document from you, and this policy would say so first.

For the same reason, no one has to “opt out” of a sale here. There is nothing to opt out of.

7. Where the data actually lives

All entries sit in a single encrypted block. On the iPhone it sits in the operating system’s keychain (the iOS Keychain), tied to your device. On Android it sits encrypted in the app’s private storage area, and the key for it is protected by the Android Keystore. In both cases the key does not leave the device, and we have no access to it.

Takt keeps no unencrypted copy anywhere — with two exceptions, and only if you set them up yourself: what a Takt widget has to draw, if you place one, and your scheduled reminders, if you allow them. A widget cannot look inside the encrypted block; what it displays has to sit readable next to it. How much that is, you decide twice — with the version you place (on the home screen “Ring only” or “Ring with text”, on the iPhone lock screen round or rectangular) and at any time with the level under More → App → Widget: “Show everything”, “Without words” or “Hide everything”. What each version shows depends on the level: on “Without words”, “Ring only” shows just the ring, while “Ring with text” and the lock screen widgets keep the number of the cycle day, “Ring with text” also the words “Cycle day”; on “Hide everything” all of them show only a ring without a date, exactly as every fresh installation shows it. Scheduled reminders sit with your device’s operating system: text and time until delivery, outside Takt’s encrypted block, and the times follow your forecast; on Android, the names of the reminder types also appear in the system settings. If you switch reminders off, withdraw your consent, your full access ends or you delete all data, Takt cancels the scheduled reminders; after “Delete all data” only the reminder for the end of your trial month remains, for as long as it runs. None of it is transmitted anywhere, and with “Delete all data” the widget store disappears too (section 8). If you place no widget, this store does not come into existence.

Takt keeps itself out of the device backup. Without that, an operating system would carry the encrypted block into your Apple or Google account backup — not to us, but to a second location all the same. Takt counteracts this in four ways at once:

• iOS: the key store entry is bound to this one device; even from a backup it cannot be restored on any other device.
• iOS: in addition, Takt’s files are excluded from the backup at file level.
• Android: the app is excluded from the device backup.
• Android: a separate rules file additionally excludes the direct device-to-device transfer, which the first setting no longer covers on its own on newer systems.

So that this state cannot be lost unnoticed, an automated test checks it on every change to the program: if one of the four falls away, the test fails before a new version can be built. This matters for the risk this policy is about. The narrower the set of places your entries exist, the smaller the surface for unauthorised access — and here that set is one device, with no copy at our end, and no backup carries your entries to another device.

The flip side, said plainly: the block on your device is the only copy of your history. A device backup will not carry it to a new phone. If you delete the app, it is gone — and we cannot restore it, because we never had it. Make a backup file first if your history matters to you.

Two further protections are built in:

• Protection mode: if Takt cannot read the stored block at startup, the app blocks all writing and does not overwrite what is there. No input is better than lost data.
• App lock (optional, off by default): Face ID, Touch ID, other biometrics, or your device passcode. The check is performed by the operating system; Takt only learns “succeeded” or “did not succeed” and stores no biometric features itself. On Android, FLAG_SECURE additionally prevents a preview in the app switcher.

No location, and no geofencing. Takt does not request location access at all. It therefore cannot and does not operate a geofence around any health care facility, clinic, pharmacy or provider, and it collects no location data from which such a thing could be built.

8. Your rights, and the concrete way to exercise them

Under MHMDA and Nevada SB 370 you have the right to confirm whether we collect, share or sell your consumer health data and to access that data, the right to delete it, and the right to withdraw your consent to its collection and sharing.

For your cycle data, these rights run against us into a void — not because we refuse them, but because we do not have the data. Information from us about your entries would be empty information. So you exercise them in the app itself, immediately and without an application to anyone:

• Confirm and access → in the app's More section, under the data group, choose the backup entry — labelled “Back up your data”. The JSON backup contains everything you entered and your settings, machine-readable; the CSV table opens in any spreadsheet. It takes seconds.
• Correct → change any entry in the day editor; this is part of full access (free trial or subscription).
• Delete, individually → in the day editor, with full access. Deleting everything at once works at any time, also without a subscription (next point).
• Delete, completely → at the bottom of the More screen, below all groups — labelled “Delete all data”. This removes your entries, all settings, the main encrypted block, any block that was set aside after a read error, and the widget images. Uninstalling the app removes the encrypted block as well. Afterwards only these remain: your subscription status as confirmed by the store (otherwise you would be locked out without a network), the reminder for the end of your trial month while it runs, and on Android the names of the reminder types in the system settings; none of it contains cycle data.
• Withdraw consent → in the app's More section, under the legal group — labelled “Manage consent”. Withdrawal takes effect going forward. Your already-stored entries stay unchanged on your device until you delete them yourself — we cannot touch them.

If you would rather send us a request. Write to the address in section 10. You do not have to give a reason, and it costs nothing.

• We answer within 45 days of receiving your request.
• Where it is reasonably necessary, we may extend that period once by a further 45 days. If we do, we will tell you within the first 45 days, and why.
• If you are a Nevada resident asking us to delete your data, we answer within 30 days (NRS 603A.515(1)).
• To answer a request about a specific person we would have to be able to identify that person. We cannot — there is no account and no identifier. In practice, our answer will confirm that we hold no consumer health data about you, and it will point you to the paths above, which give you more, faster, than we could.

If we refuse a request, we will tell you why, and you can appeal. Send your appeal to the same address, marked as an appeal. We will decide within 45 days and tell you in writing how we decided and on what grounds (NRS 603A.520(2)). If we deny the appeal, you may lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint, or with the attorney general of your own state.

Residents of Nevada have equivalent rights under the statutes named at the top of this document and exercise them the same way.

California works differently. Its Confidentiality of Medical Information Act, as amended by AB 254, treats Takt as a “provider of health care” and holds it to that confidentiality standard (Cal. Civ. Code § 56.06(e)–(f)); if that standard is breached, it gives you a private right of action (§ 56.36). Takt keeps your data only on your device, with your consent, and shares it with no one.

Virginia works differently. SB 754 (Va. Code § 59.1-200(85)) does not set up a rights-request process; it forbids obtaining, disclosing, selling, or disseminating your personally identifiable reproductive or sexual health information without your consent and gives you a private right of action if that is breached (§ 59.1-204). Because Takt holds this data only on your device, with your consent, and shares it with no one, there is nothing here to act against — but the right stands, and it runs against anyone who does otherwise.

9. Why this document exists although the app stores show “Data Not Collected”

Takt’s privacy label in the App Store and on Google Play says that no data is collected. That is correct: both stores define “collect” as data that leaves the device and reaches the developer, and nothing does.

The state statutes define it differently. Under MHMDA and its counterparts, collecting and processing include recording, storing and computing on the device itself — the definition was written that way deliberately, so that a local-only architecture would not become a way around the rules. Both statements are true at once, and they answer different questions. The store label says nothing reaches us. This document says what happens on your phone, and what your rights are in respect of it.

10. Contact

TRAJA Projects
Owner: Bao Anh Tran
Sulzbacher Straße 48
90489 Nürnberg
Germany

Email: traja.projects@gmail.com

Please write in English or German. Please do not send us health data unless it is unavoidable — for a support request we do not need it. Describe the problem, not your cycle.

11. Changes to this policy

We update this policy when the app or the law changes. The version published on this page is the one that applies; the effective date at the top shows its state. If something material changes about how your data is handled, we say so in the app rather than quietly on a subpage. In particular, this policy will be extended before any new category of health data — a postpartum module, for instance — is collected for the first time.

For completeness: Takt is not a medical device and does not replace medical advice.