Effective date: October 29, 2026. Version 1.2. Applies to: the Her Almanac mobile application ("the app"), published by Rowan Digital LLC, a North Carolina limited liability company ("Rowan Digital," "we," "us"). This policy is the privacy policy for the app and for heralmanac.app.
The short version
Everything you record in Her Almanac is stored on your phone, encrypted, and is never transmitted to us. We operate no servers that hold your information, there are no accounts and no login, and the app contains no analytics, advertising, or crash-reporting software. We have no technical ability to see, recover, share, or sell anything you write down. By default, your health information stays on your device. If you choose to share a Visit Summary, export a backup, or add an appointment to your calendar, only the information you select leaves your device, and only when you choose to send it. The app makes no network connections of any kind, and it does not hold the Android permission that would allow it to. This policy is short because there is very little to disclose.
What we receive
We receive nothing you record. The app has no account system and no login. Everything you record is stored on your device. That includes cycle events and the setting that tells the app you are not having periods right now; symptoms and their severity; moods; journal entries; medications, the days you mark them taken or skipped, and the reminder times and days you set; health conditions and records; appointments together with the provider, the address you type, the questions you plan to ask, the answers you receive, and, for a visit that was on your calendar before it happened, a saved copy of the Visit Summary as it stood that day; life journeys you select; an optional profile name and photo; your app PIN and recovery answer, which are stored hashed and encrypted and never in plain text; the record of when you accepted these terms and this policy; and housekeeping details such as setup flags and the time of your last backup. It is encrypted at rest using AES-256, with the key held in your device's secure storage. It is never transmitted to us. The app sends nothing anywhere on its own; the only ways anything you record can leave your device are the ones you start yourself, described under "Sharing you choose to do" below.
Because that information stays on your device and is never sent to us, we cannot access it, recover it, disclose it, sell it, or produce it in response to a subpoena, a court order, or a request from any law enforcement or government agency in any state or country. That is not a promise about how we would behave. It is a description of what we are technically able to do. We do not possess your information, so there is nothing for us to hand over.
Sharing you choose to do
By default, your health information stays on your device. If you choose to share a Visit Summary, export a backup, or add an appointment to your calendar, only the information you select leaves your device, and only when you choose to send it.
Her Almanac does not read or write your phone's calendar and does not request calendar permission. If you choose to add an appointment, Her Almanac opens your phone's own calendar app with the event already filled in for your review. You decide whether to save it, and where it is saved, including which calendar account, is controlled entirely by your phone's calendar app, typically your default calendar account. Her Almanac cannot see whether you saved the event or where it went. In Private mode the event contains only the word "Appointment" and the time. In Details mode it contains the appointment title, with the provider's name in the notes field. It never includes the address, your symptoms, medications, questions, or your answers to those questions.
If you choose to share a Visit Summary or export an encrypted backup, Her Almanac hands that file or text to your phone's standard share menu, and you choose where it goes. Her Almanac does not send it anywhere on its own. A Visit Summary may include the appointment's title, provider, and date; the names of the symptoms you logged since your last visit, or in the last 30 days if there was no earlier visit, with the number of days each was logged and the highest severity you recorded; your current medications and their doses, with a "Stopped:" line naming any you have marked inactive; and the questions you prepared for that visit. At every share you can also choose to include, for each medication, the number of days you marked it taken out of the days you marked in the 30 days before the visit; that count is never included unless you say so. It does not include the answers you recorded, your journal, or your private notes. When a visit that was on your calendar passes, the app keeps a copy of the summary as it stood on that day, on your device, with the visit. A visit you add after it has already happened has no prepared summary; its record is the questions and answers you write. An exported backup file is your full encrypted backup; restoring a backup uses your phone's file picker, but creating one for export does not. Once you share or export a file, it has left Her Almanac's architecture and is governed by the privacy practices of wherever you sent it.
Our email list
If you choose to join our email list from heralmanac.app, we collect only the email address you provide. We use Buttondown, a third-party email service provider, to manage the list and send messages. Buttondown asks you to confirm your email by clicking a link before you are added, and you will receive one automatic welcome email after confirming. We have turned off Buttondown's open and click tracking, so we do not receive data on whether you opened a message or clicked a link in one. You can unsubscribe at any time using the link in any email we send. This list is entirely separate from the health information you record in the app: nothing you enter in Her Almanac is linked to or ever reaches your email address or Buttondown, and joining or leaving the list has no effect on your in-app records.
Backups are yours, and only yours
You can export a backup file that is encrypted with a password you choose. The file is created on your device and handed to your phone's standard share menu, and you choose where it goes. We never receive it and never see the password. The password must be at least eight characters, and the file is encrypted with a key derived from it. Without that password the file is unreadable, by us or by anyone else. If you lose both the file's password and your device, your information cannot be recovered. This is a deliberate design, not a limitation we can waive.
One thing to keep in mind: once you save or send a backup file somewhere else, whether that is a cloud drive, an email, or another phone, it is subject to whatever rules apply to that place, and our promises about your device cannot follow it there. Choose where you put it accordingly.
Notifications
Reminders you set, such as medication reminders, fasting reminders, and appointment nudges, are scheduled on your device by your device. A reminder never names the medication, the appointment, or the provider; it says only that it is time for a reminder, and you open the app to see which one. Nothing about them is sent to us.
Permissions the app requests
- Notifications, to show reminders you set.
- Exact alarms and boot-completed, so reminders survive a phone restart.
File access through your phone's own file picker, and only when you choose to restore a backup. The app sees only the single file you pick.
The app does not request internet access, so it cannot send anything anywhere even by mistake. It does not request location permission of any kind, and it does not request contacts, calendar access, or body sensors. If you choose to add a profile photo, you pick it through your phone's own photo picker, and the app receives only the single image you pick. Nothing in the app transmits any of this anywhere.
Deletion
In the app, Profile, then Privacy & Security, then Delete All My Data erases everything on your device instantly and permanently. There is no grace period, no retained copy, and nothing on our side to delete, because there was never anything on our side. Uninstalling the app also removes its data, on Android and on iPhone.
Since we hold nothing, we have no retention period and no deletion queue. What you keep, you keep for as long as you want it; what you erase is gone when you erase it.
Analytics, advertising, and third parties
Analytics and advertising: none. Her Almanac contains no analytics tools, advertising, or trackers. The only outside parties involved are those you choose to send something to and Buttondown, if you join our email list from our website.
The app contains no analytics software, no advertising software, no crash-reporting or attribution services, no social integrations, and no embedded web views, and it contacts no outside service at all.
We do not sell your information, and we do not share it, because we do not have it. We have never done so and we have no mechanism by which we could. If that ever changed, we would have to change this policy first, say so plainly, and ask you.
Your phone's operating system and the app store you installed from have their own privacy policies, which we do not control and which apply to your relationship with them rather than with us.
Children
Her Almanac is intended for adults and is not directed to children under 13. We do not knowingly receive personal information from a child under 13, and because the app has no accounts and transmits nothing to us, there is no channel through which we could. We also do not ask your age or your date of birth, and we do not want you to tell us. If you contact us by email and tell us you are under 13, we will delete your message rather than reply to it, and we will not keep a record of it.
Consumer health data laws, and your rights
Some of what you record in Her Almanac, including cycle events, symptoms, and anything you note about reproductive or sexual health, is treated as sensitive health information under laws such as Washington's My Health My Data Act, Nevada's consumer health data law, Connecticut's consumer data privacy law and Virginia's consumer protection act, California's Confidentiality of Medical Information Act, the California Consumer Privacy Act, and the EU and UK General Data Protection Regulation. We take that seriously, and the app is built so that the protections those laws are aimed at are structural rather than promised.
We do not receive your health information, and we have no way to. It stays on your device, under your control, encrypted. Nothing about it is transmitted to us, sold, or shared by us with anyone, for money or for anything else, and we do not intend that ever to change. The only sharing that ever happens is sharing you start yourself, described above. We do not use geofencing, we do not track you across apps or websites, and we do not build profiles.
Rights that these laws give you, such as the right to know what is held about you, to get a copy of it, to correct it, and to have it deleted, are built into the app rather than into a request form. You can read everything you have recorded, export it, correct it, and erase all of it permanently, at any time, without asking us and without waiting for us. There is nothing for us to confirm, produce, or delete, and no list of third parties to give you, because there are none.
If you have a question about any of this, write to us at the address below and we will answer in writing. If you believe we have not honored something this policy says, you may also contact the attorney general in your state.
Before you begin recording anything, the app asks you to confirm that you understand what it stores on your device. If we ever build a feature that would send any of it anywhere, we will describe that feature plainly, ask for your permission first in the app rather than in a document like this one, and treat a decision to say no as final.
How your information is protected
Everything you record is encrypted on your device at rest using AES-256, with the encryption key held in your device's secure storage and never transmitted anywhere by the app. You can set an app PIN and a recovery answer for a second layer. Reminders you schedule never name a medication, an appointment, or a provider. Backup files you export are encrypted with a password you choose and that we never see. Because we hold no copy of your information, there is no company database that could be breached, and no incident on our side could expose what you have written down.
Changes to this policy
If the app ever changes how it handles data (for example, a future optional feature), we will update this policy, change the effective date, and describe the change plainly. The core promise, that your health data stays on your device, is the foundation of the product.
Contact
Rowan Digital LLC, Wilmington, North Carolina, United States. Email hello@heralmanac.app.
Rowan Digital LLC is the publisher of Her Almanac on Google Play and the Apple App Store and is the company responsible for this policy. If you need a postal address for a formal notice, write to us at the email address above and we will provide one promptly.