Privacy policy
Last updated 22 October 2026 · JenX AI Technologies
Draft pending legal review. This page describes how the app is built and will be reviewed by health-data counsel before launch. Every claim below is a statement about the code, not an aspiration — but it has not yet been through external audit, and we will not describe it as audited until it has.
The short version
- What you log stays on your phone, in an encrypted database.
- You do not need an account, an email address or a phone number.
- We do not sell your data, share it with advertisers, or let an analytics company see it.
- You can export everything and delete everything, from inside the app, at any time.
What stays on your device
Your cycles, periods, symptoms and their severities, notes, medications, measurements, and any condition you have told the app about. All of it is stored locally in an SQLite database encrypted with SQLCipher. The encryption key is generated on your phone on first run and kept in the iOS Keychain or the Android Keystore. It is never transmitted and is not derived from anything we hold.
The app works with no network connection at all, from install through to producing a doctor report.
What we store, and what we can read
| What | Why | Can we read it? |
|---|---|---|
| An anonymous device identifier | So the app can talk to our server at all | Yes — it identifies a device, not a person |
| Your locale, platform and app version | Support, and knowing which builds are in use | Yes |
| Your encrypted backup, if you turn backup on | So you can restore onto a new phone | No. It is encrypted on your phone with a key wrapped by a recovery phrase only you hold |
| An encrypted doctor report, if you create a share link | So a clinician can open it in a browser | No. The decryption key travels in the link's fragment, which browsers never send to us |
| Product analytics events from a fixed list | To know which screens are used and where people get stuck | Yes — they carry counts and screen names, never symptoms, severities or dates |
| An email address, only if you sign in | To attach a backup to an account | Yes |
Backups, and what losing your recovery phrase means
Backup is optional and off until you turn it on. When you do, your data is encrypted on your phone before it is uploaded, using a key wrapped by a 12-word recovery phrase that is shown to you once and never leaves your device.
That means we cannot read your backup — and also that we cannot recover it for you. If you lose the phrase and the phone, the backup is unreadable by anyone, including us. We would rather say that plainly than hold a key we could be compelled to use.
Analytics and advertising
No third-party analytics or advertising SDK is built into Aali. Not Google Analytics, not Firebase Analytics, not Meta, not TikTok, not an attribution provider. Our product analytics run on our own servers and accept only a fixed list of events — things like "the insights screen was opened" or "a log with four entries was saved". The list is enforced on the device and again on the server, and an event carrying anything else is refused.
We do not run ads in Aali and do not plan to.
Where data is stored
Our servers are in the regions required by the laws that apply to you, including the UAE Personal Data Protection Law, India's Digital Personal Data Protection Act 2023, the UK and EU GDPR, and United States state health-privacy laws such as Washington's My Health My Data Act. Because what we store is an anonymous account row and ciphertext, residency is a question of which bucket the bytes sit in rather than a question about your health information.
Legal requests
We will resist requests for reproductive-health data wherever the law allows, and we publish a transparency report. In practice we have very little to give: we cannot decrypt a backup or a report, and we do not hold cycle data at all.
Your choices
- Use Aali with no account. This is the default path, not a setting you have to find.
- Export everything. Me → Privacy centre → Export, as CSV or JSON. Free, complete, no limit.
- Delete everything. Me → Privacy centre → Delete everything. This erases the local database and the key that protects it, and tells our server to destroy what it holds. Anything on our side, including backups and replicas, is gone within 30 days.
- Delete without the app, for example if you no longer have the phone: see aali.life/delete-account.
Children
Aali is not intended for children under 13, and we do not knowingly collect data from them.
Changes
If this policy changes in a way that affects what we store or who can read it, we will tell you in the app before the change takes effect.
Contact
Privacy questions: privacy@aali.life. A person replies — not a bot.