PearPetal

PearPetal collects no personal data and stores nothing on a server. Your cycle data lives only on your own devices. There is no account and no cloud. If you choose to share with a partner, they receive only the specific, consented slice of your data you pick - never your full log.

All data is stored locally on your device (and any of your own devices you link):

• Your cycle log: period dates and flow, and any symptoms, notes, temperatures (BBT) or other day entries you record
• Your goal (for example tracking, trying to conceive, or pregnancy) and cycle preferences, including any health conditions or birth-control settings you enter
• Predictions such as your fertile window, predicted ovulation and next period - computed on your device from your own log
• The display name and optional photo you choose for yourself
• Pairing keys that identify your own devices, and any partner you share with, to each other
• App preferences, including your chosen flower and reminder settings

Sensitive health information (your cycle, fertility and pregnancy data) is treated as private by design. It is never sold, never used for advertising, and never sent to us or any third party.

PearPetal keeps your full cycle log and anything you share with a partner in two separate, separately-encrypted stores:

• Your private log replicates only across your own devices. Its encryption key is never given to a partner.
• A per-partner shared view carries only the scope you consent to - cycle phase only, fertility window, or your full cycle - written by you and read-only for your partner. A partner cannot edit your data or re-share it with anyone else.

Predictions are computed on your device and are never written to the shared view or sent over the network. If you end sharing, it stops going forward - revocation is one-way.

PearPetal syncs directly between your own devices, and between you and a partner you have shared with, using the Hypercore Protocol, a peer-to-peer technology. There is no server storing your data and no account. On networks where a direct connection cannot be made, the connection can fall back to the PeerLoom relay described below, which forwards the encrypted traffic without being able to read it. Data is shared only with the specific devices that hold the matching key.

All sync traffic is encrypted end-to-end, and every change is cryptographically signed by the device that made it, so a partner's device cannot forge entries in your log. No third party ever receives or has access to your data.

Most of the time your devices connect to each other directly. On a small number of networks that direct connection cannot be made at all. In that case PearPetal can fall back to a relay that PeerLoom runs, which passes the encrypted traffic between the two devices.

The relay cannot read what passes through it. Your cycle log and anything you share with a partner stay encrypted end to end and PeerLoom holds no key to them. What a relay unavoidably handles is the fact that two devices are talking, identified by random public keys rather than names or email addresses, along with the timing and the amount of data. It cannot tell what those devices are exchanging, or that the app is PearPetal at all. The relay keeps no record of it and stores nothing.

The relay is a last resort and never the first choice. The relay can be turned off, in which case PearPetal is purely device to device and will not connect on the rare networks where a direct connection is impossible. Full detail: The PeerLoom relay.

You can export a backup of your data to a plain file on your own device for safekeeping or to move to a new phone. You may optionally protect that file with a password; when you do, it is encrypted with strong, modern cryptography (Argon2id key derivation and an authenticated cipher) so only someone with the password can read it. A forgotten password cannot be recovered by anyone, including us. Backups never contain your device's secret identity key, and are never uploaded anywhere - where the file goes is entirely up to you.

• Camera: Used to scan the QR code when you link one of your own devices or accept a partner invite. Nothing from the camera is stored or transmitted.
• Notifications: Used to deliver optional local reminders such as a predicted period or fertile window. Reminders are scheduled and delivered on your device; their content never leaves it, and you can keep the wording discreet.
• Network and local network access: Used for peer-to-peer connections between your own devices and a partner, including directly over your Wi-Fi, and for the relay fallback described above. No readable data is sent to any server.

PearPetal contains no analytics, no advertising SDKs, no crash reporting services and no third-party trackers of any kind. Because there is no server, there are no server logs of your activity.

PearPetal does not require you to create an account or provide an email address or phone number. Each device's identity is a cryptographic key pair generated locally on the device.

PearPetal is not directed at children under 13, and we do not knowingly collect data from them. Because the app has no servers and stores nothing about anyone off-device, no personal data of any user is collected by us at all.

PearPetal is for personal tracking only. Its predictions are estimates, not a diagnosis or a contraceptive method, and should not be relied on to prevent or achieve pregnancy. For medical questions, consult a qualified healthcare professional.

PearPetal is fully open source. You can inspect the complete source code at github.com/peerloomllc/pearpetal.

Questions about this privacy policy? Reach out at peerloomllc@proton.me.