Don't take our word for it.
Privacy you can check, not just read about.
Every period app promises privacy. Promises are copy — anyone can write them. This page is different: it shows you the machinery. What we never store, how fast things delete themselves, and the result of the security check our database runs on itself every morning — published here, live, including on the mornings we'd rather it weren't.
What we never store
- No analytics or tracker SDKs. Not one. Scan the app with any network monitor — we ask journalists to. The only usage signal that exists is a date-only "opened the app today" mark, and even that self-deletes after 35 days.
- No location. No contacts. No photos. Never requested, nowhere to put them.
- No email next to health data. Your identity and your health records live in separate systems, joined only by a random ID — either half alone is close to worthless, including to a subpoena.
- No phantom predictions. Past your predicted date, the server stores null — not a guess. What we don't invent, no one can take.
- No free-text notes on our servers. Your notes stay on your phone.
How fast things delete themselves
Retention here is enforced by code that runs daily — not by a policy document.
| What | Gone in |
|---|---|
| An urgent ask (including emergency contraception) | 7 days after it's delivered · 30 days no matter what |
| What a gift actually was | 3 days after payment — then it's just "a little something" |
| "Opened the app today" marks | 35 days |
| Notification history | 90 days |
| Invite-code attempts | 30 days |
| Your health data | Until you delete it — it's yours |
And "Erase everything" means everything: account and every record, one transaction, effective immediately — out of rolling backups within 30 days. No limbo, no retention tricks.
What the morning check verifies
Six structural checks, every day at 9:30: row-level security is on for every table · no email column has crept into the health schema · sensitive functions can't be called anonymously · the consent guard on partner links is intact · gift rate-limits are intact · the waitlist can't be read out. If any check fails, the result above says so — to you, at the same moment it says so to us.
If you only remember one thing
We designed Ovae so that the most dangerous thing our database could ever reveal about you is roughly which weeks you opened an app. Everything else is either on your phone, deleted on a clock, or was never collected. That's not a promise. It's architecture — and this page is the window.
Questions, challenges, security research: hello@ovae.health. A human reads it.