Last updated: 2026-08-03
Flowers Flo is developed by Franky Fernandez (Apple Developer team PKL8E32WG9). This policy describes what Flowers Flo does with your information. It is written to be accurate about the version currently on the App Store, not about what the app might do later.
We cannot read what you log. Flowers Flo works with no account at all, and everything stays on your iPhone. If you choose to sign in with Apple, your entries sync to your other devices, and they are encrypted on your phone first, with a key that never leaves your Apple Keychain. We store a scrambled copy we have no way to unscramble.
That is not a promise about what we choose to look at. We do not have the key, so we could not read it if we tried, and neither could anyone who broke into our database or served us a court order.
There is no analytics and no advertising code in the app. One honest caveat, explained in full below: if you have iPhone backups switched on, your entries are included in that backup the same way every other app's data is.
You can record, for a given calendar day, whether you bled and roughly how much (spotting, light, medium, or heavy), any of a fixed list of common symptoms, and how you felt overall on a five point scale. You can also simply mark that you checked in and had nothing to report. Every one of those is optional, and any day can be left blank.
From your bleeding entries alone the app works out, entirely on your device, your cycle phase, an estimate of when your next period may start, and an estimate of your fertile days. Symptoms and mood are recorded and shown back to you. They are not analysed, not averaged, not charted against your cycle, and are never used to suggest what any of it might mean.
That is the whole of it. The app does not ask for your name, email address, date of birth, location, contacts, photos, or health data from any other app.
Your entries are stored in the app's own storage on your device.
Data you log is stored on your device. It is protected by iOS device encryption, which means it is unreadable while your device is powered off. It is not encrypted separately while your device is simply locked, so anyone who can unlock or exploit your device can read it. We never store your health data in iCloud.
We are stating that plainly rather than describing the app as "encrypted", because the second would not be true and you should be able to make your own decision about it.
One consequence worth knowing: if you have iPhone backups turned on, whether to iCloud Backup or to a computer, your Flowers Flo entries are included in that backup like any other app's data. That backup is made and controlled by Apple or by you, not by us, and we cannot read it. If you do not want your entries in a backup, you can exclude Flowers Flo from backups in your iPhone's settings.
If you never sign in, nothing. The app has no account by default and talks to no server.
If you do sign in with Apple, we receive two things. First, an anonymous identifier Apple gives us so we know which stored copy is yours. It is not your name, not your email, and not your Apple ID; it is a random-looking string that means nothing outside this app. We do not ask Apple for your name or email at all. Second, your encrypted entries, as a block of scrambled data.
We cannot decrypt that block. The key is generated on your iPhone and stored in your Apple Keychain, which syncs it to your own devices end to end. It is never sent to us and there is no copy of it on our side. If we were asked to produce your cycle history, we could hand over the scrambled block and nothing else, because that is genuinely all we have.
We never store your health data in iCloud. The encryption key travels through Apple's Keychain, which is a different thing: a key is not a health record, and your entries themselves go to our own server as ciphertext.
Flowers Flo contains no advertising, no analytics, and no third-party tracking code. Nothing about you is sold or shared for marketing, ever.
Two companies host the encrypted copy on our behalf: Fly.io runs the service and Supabase hosts its database. They hold the same scrambled block we do and are equally unable to read it. Sign in with Apple is operated by Apple.
Flowers Flo can send reminders. These are local notifications, scheduled and delivered by your iPhone. They are not push notifications, nothing about them travels over the internet, and we do not learn whether you received or opened one. You can turn them off at any time in Settings, and the rest of the app keeps working.
Your entries stay until you remove them. If you have signed in, the encrypted copy is kept while your account exists and is hard deleted, not merely hidden, when you ask.
To delete a single day, open that day in the app and clear the entry.
To delete everything, use Delete all my data on the Account screen. That does three things: it destroys the encryption key, it erases every entry on the device, and it signs you out. Destroying the key is the important one, because from that moment the copy we hold can never be decrypted by anyone, including us. It is not recoverable, by you or by us, and that is the point.
Deleting the app also removes its on-device storage. If you have a device backup containing the app's data, deleting the app does not alter that backup, and restoring from it later can bring entries back. Backups are managed in your iPhone's settings.
Sync is opt in and stays off until you sign in. To withdraw it, sign out on the Account screen: syncing stops immediately and the app keeps working exactly as before, with every entry still on your phone.
To withdraw consent and remove what we hold, use Delete all my data. Turning off notifications stops reminders, and deleting the app removes its on-device storage.
Flowers Flo is not directed at children under 13 and we do not knowingly collect information from anyone, of any age.
Flowers Flo is not a contraceptive, is not a method of birth control, and does not provide medical advice. The predictions and fertile day estimates it shows are calculated from the cycles you have logged and are estimates, not certainties. If something about your cycle worries you, talk to a clinician.
This policy was rewritten when optional encrypted sync was added. If a future version changes what leaves your device, or what we are able to read, this policy will be updated before that version ships and the change will be described here rather than quietly folded in.
Questions about this policy or about the app: fernandezfranky3@gmail.com