Nini Privacy Policy
Nini is a period and cycle tracker for iOS and Android. Core tracking works without an account. This policy describes the app's local records, optional online features, subscriptions and advertising; availability can differ by app version.
Health records on your device
Period days, flow, symptoms, severity, moods, notes and optional measurements are stored in the app's local database. Cycle predictions are calculated on the device and are estimates, not medical advice or contraception. We do not send health record contents to advertisers or RevenueCat, sell them, or use them to target ads.
Optional account
If you sign in with Apple on iOS or Google on Android, the identity provider supplies an account identifier and, if available, your email and name. Apple may supply a private relay email. Our service stores your account ID, sign-in provider, consent choices, subscription status and profile/app metadata such as language, platform and app version. We do not receive your Apple or Google password. Signing out does not cancel a store subscription or automatically erase local records.
Optional encrypted backup
In versions supporting unified account backup, new cloud uploads require a signed-in Nini account, active Plus access, separate backup permission and confirmation that this phone's records belong to that account. Signing in or buying Plus does not enable backup. Records are encrypted on your device using your recovery key before upload. The server stores ciphertext, a key identifier, version, size and update time linked to your account; account linkage is not anonymity. Neither backup consent nor admin access gives us the decryption key. Keep your recovery phrase private: account sign-in alone cannot decrypt a backup and we cannot replace a lost key. Without Plus, new cloud uploads pause but existing backups remain available for recovery and deletion. You can create and share a local encrypted backup file without signing in or subscribing; sharing sends the file to your chosen destination, not automatically to Nini. Turning off account backup requests deletion of its server copy; an offline request needs a connection to complete. Older versions may reference a separate random-ID recovery vault; no automatic transfer to an account or arbitrary legacy server is performed.
Guest purchases use a generated RevenueCat identifier and the platform's store account. They are not anonymous to every service provider. Authorized administrators can see purchase events, subscription product, store, timing and the generated or linked account identifier, but not health record contents. Test purchase events are held separately from live revenue and access records and expire after 90 days.
Optional product analytics
With your separate analytics permission and an account, Nini sends limited usage events to our service: for example app/screen opens, completion of onboarding, a record being saved, feature use and purchase actions. Events can include account ID, time, platform, language, app version and allowed feature identifiers. They do not contain the text of notes, symptom values or health measurements. These are account-linked events, not anonymous statistics. You can disable future analytics in your account consent settings. Advertising and subscription services have their own necessary technical processing described below.
Advertising and choices
The free tier can show Google AdMob banners below the navigation bar. Both monthly and yearly Nini Plus remove in-app banners while active. The app requests non-personalized ads, does not attach health records, email or Nini account ID to ad requests, and loads ads only after the applicable privacy flow permits it. Non-personalized does not mean no data processing.
Google's advertising services may process IP-derived approximate location, app/device identifiers, ad impressions and interactions, and diagnostic/performance data for ad delivery, measurement and fraud prevention. Nini does not request precise location for advertising. Android advertising-ID permission is excluded from the app; this does not eliminate other identifiers or network data. The local advertising age-band answer is not included in backups. No ads are loaded for users who select under 18, use teen mode or have not selected an age band.
Where required, Google's consent form offers privacy choices. You can reopen available choices in You → Data & privacy → Advertising privacy options. Declining consent may prevent ads; it does not block core tracking. See Google Privacy Policy and Google's use of partner-site and app data.
Purchases and RevenueCat
Apple or Google processes payment; we do not receive your payment card details. RevenueCat verifies transactions and manages Plus access using a generated app-user ID or your Nini account ID, purchase history, product/receipt information and technical app/device data. This is separate from optional usage analytics. Health record contents are not sent to RevenueCat. See RevenueCat's privacy policy. Manage or cancel subscriptions through your store account. Deleting Nini does not cancel recurring billing.
Health permissions and notifications
Apple Health and Health Connect access is optional and controlled by OS permissions. Imported health records are used for your tracking features, never advertising. You can revoke access in system settings. Local reminders are scheduled on the device. Account messages are retrieved from our authenticated inbox.
On supported versions, remote account notifications are optional and require sign-in, your separate remote-notification choice and operating-system notification permission. Firebase Cloud Messaging (FCM), operated by Google, transports these alerts; on iOS delivery also uses Apple's Push Notification service. Our service associates your notification token with your account and stores platform, language, app version and notification preference. Google processes notification/installation identifiers and necessary technical network and app information to provide the service. The external push payload contains only generic “new message” copy and an inbox link, never health records, notes, account email or the actual message contents.
FCM is not our health database or sign-in system. This integration does not enable Firebase Analytics, Crashlytics or advertising audiences. You can turn off remote notifications in the app or disable notification permission in system settings. Token deregistration and server deletion require connectivity; already-dispatched alerts cannot be recalled. Signing out or deleting your account also requests removal of its notification registration. Removing a notification token is not a promise of immediate deletion of all Google installation/service records; Google's retention terms apply. Local reminders and core tracking do not require FCM. See Firebase privacy and security and Google Privacy Policy.
Retention, deletion and export
Local records remain until you delete them. Use You → Import/Export for your copy and You → Data & privacy → Delete everything for local deletion. Account deletion removes account records and the account's encrypted backup when the server confirms the request. Offline or failed deletion must be retried; uninstalling alone does not delete server copies. Store/RevenueCat transaction records may be retained for billing, fraud prevention and legal obligations. Raw optional usage events expire after 400 days; inbox delivery records after 180 days. Non-identifying aggregate counts may remain. Recovery-vault copies must also be deleted through their backup controls.
Service providers and requests
Our servers and service providers receive network requests and necessary operational data. Apple, Google and RevenueCat may process data in countries other than yours, under their applicable privacy terms and safeguards. This policy website is hosted on GitHub Pages, whose operator may process access logs. Depending on applicable law, you may request access, correction, deletion, portability, objection/restriction and withdrawal of optional consent. Contact techbaem@gmail.com for account deletion without the app or other privacy requests. Never email your recovery phrase or medical records. We may verify account ownership; we cannot decrypt your backup.
Age and policy updates
Nini is not intended for children under 13. Advertising is additionally restricted as described above. If you believe a child's account data was submitted, contact us. Material changes will be reflected on this page and, where required, communicated or presented for renewed consent.
Optional technical error reports
On supported versions, error reporting is off by default and requires an account and a separate diagnostic permission. Existing analytics permission does not enable it. If you opt in, our service receives account-linked reports with app version and build number, platform, operating-system major version when available, a predefined error code and severity, event time, and allowed application-code file and line references. Authorized administrators use these reports to find and fix problems. Reports do not include raw exception messages, screen URLs, request bodies, credentials, health record contents or notes. They are not anonymous.
Reports are scheduled for automatic deletion 30 days after collection. Turning off diagnostic permission clears unsent reports from the device; server reports are deleted when the consent update is confirmed by our service. Account deletion also removes them. Offline or failed requests need a connection to complete. The local queue is memory-only, not a disk archive. Reporting covers supported Dart and Flutter errors, not every native crash, freeze or failure before sign-in and permission. Core tracking remains available without diagnostic permission.
If you separately enable diagnostics, an ad loading or no-fill failure may also be reported as a fixed technical category. That report does not include ad request contents, ad response identifiers or health data.