Privacy
Rhythm Tracker is a daily log for women whose period is missing or irregular, made by Rhythm Within. What you write in it is about your body, your cycle and sometimes your relationship with food. That is about as personal as data gets, so here is exactly what happens to it, in plain words.
Who is responsible
Rhythm Within, Janne Tiktak, the Netherlands. KvK 83144498.
Questions or requests: support@rhythm-within.com
What the app stores
- Your account: your email address, and if you sign in with Google also your name and profile photo as Google shares them.
- Your onboarding answers: if you fill in the quiz, your answers (no weight or height), every time you take it.
- What you log: the days you log, signs of return (like cervical fluid, libido, appetite, energy), mood, stress, sleep, symptoms, temperature, your notes and your daily one thing.
- The check-in: if you fill it in, your answers about eating and compensation behaviour.
Most of this is health data, a special category under the GDPR. The app stores it only because you choose to log it, and only so it can show it back to you.
Why, and on what basis
The only purpose is to let you track your own rhythm and see your own patterns. The legal basis is your explicit consent (GDPR Article 9(2)(a)), which you give by creating an account and logging. You can withdraw it any time by deleting your account.
Your data is never sold, never used for advertising, never shared with other users and never used to train AI models. There are no analytics or tracking cookies in the app.
Ask Rhythm (the AI companion)
Ask Rhythm is off until you switch it on, and it asks before the first use. It reads your last four weeks to point out what moved and suggest one small step, or answers your question. It is written by AI, it can be wrong, and it is not medical advice. You can switch it off any time in your profile.
Your conversations with Ask Rhythm are saved on your account so you can go back to them. Only you can see them. Delete a chat with the cross next to it; deleting your account deletes all of them.
Oura Ring (optional)
If you connect your Oura Ring in your profile, the app reads three things from Oura once in a while: your temperature deviation, Oura's summary of your stress for the day (restored, normal or stressful), and how much you moved compared with your own usual (light, usual or a lot). Never calories, steps or anything else. The connection is stored encrypted on your account. Disconnect any time in your profile; what was already filled in stays in your log until you delete it. You can also remove the app's access in your Oura account.
Who else handles it
- Supabase stores the database and handles sign-in. Your data sits on servers in the EU (Ireland).
- Vercel hosts the app itself. It sees technical data like your IP address when you open the app, not your entries.
- Nebul, a Dutch AI provider, only if you switch on Ask Rhythm. When you ask it something, your last four weeks of logs and your quiz answers are sent to Nebul to write the answer. Never your name or email address.
- Stripe handles payments for Rhythm Plus. Your card details go to Stripe, never to this app; the app only keeps whether your subscription is active.
- Google, only if you choose to sign in with Google. Google then knows you use this app. The app also loads its font from Google Fonts, which sees your IP address.
These companies process data on Rhythm Within's behalf under data processing agreements. Some of them are US companies; transfers outside the EU are covered by the EU-US Data Privacy Framework or standard contractual clauses.
Who can see your entries
You. The database is set up so every account can only read its own rows. As the person running the app I technically have access to the database. I only look at someone's entries when they ask me to, for example to fix a problem, and never for anything else.
How long it is kept
Until you delete your account. When an account is deleted, all its entries are deleted with it, immediately and permanently.
Your rights
You can see your data, get a copy of it, correct it, or delete your account and everything in it. The first and last you can do yourself: tap the account button at the top right of the app for Download my data and Delete my account. For anything else, email support@rhythm-within.com and it is done within 30 days, usually much sooner. If you think something is not handled properly, you can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Not medical advice
Rhythm Tracker helps you notice patterns. It does not diagnose anything and does not replace a doctor, dietitian or psychologist. If you are struggling with eating right now, please reach out to a professional.
Age
The app is for people aged 16 and over.
Changes
If this policy changes in a way that matters, for example a new feature that uses your data differently, you will be told in the app first and asked again where needed.