HERAZUR LLC / PCOS LAB

PCOS Lab privacy policy

Effective October 20, 2026

This policy explains how Herazur LLC (“we”, “us”) handles information in PCOS Lab, a cycle, symptom, meal, experiment, and lab-result tracker for people with PCOS. PCOS Lab is published on Google Play as “PCOS Lab: Symptom Tracker” (package com.pcoslab.app).

Summary

• By default, everything you log stays on your phone. You do not need an account, and nothing you log is uploaded.
• Four things are optional and off until you turn them on yourself: an account, cloud backup, usage analytics, and crash reports. Cloud backup is the only one that puts your health records on a server.
• Your health information is never used for advertising, never sold, and never shared with data brokers. There are no ads and no advertising ID in the app.
• You can export or delete your data, and delete your account, from inside the app.

Information we collect

Health records stored on your phone

What you enter is saved in the app’s private storage on your phone: bleeding days and flow, symptoms, meals and what they contained, weight if you record it, notes, experiments (what you tried, dose, dates, the symptoms you followed, and why you stopped), lab results (test, value, unit, date, and note), and your settings, such as which symptoms you track, reminder time, units, theme, language, and your choices for the switches described below. This is health information. With every optional switch left off, it stays on your phone, and we have no copy and no way to get one.

Account information (optional)

If you create an account with an email address and password, Firebase Authentication stores your email address and a user ID; your password is handled by Firebase and we never see it. If you continue with Google, Firebase receives the email address, name, profile photo link, and account identifier your Google account shares. Firebase also sends the verification and password-reset emails you ask for. Creating an account does not upload any of your health records and unlocks no feature.

Cloud backup (optional, requires an account)

If you sign in and turn on Keep a copy in my account, a copy of the days you logged (flow, symptoms, weight, notes, and meals), your experiments, your lab results, and the list of symptoms you track is stored in Google Cloud Firestore under your account, so it survives a lost phone and can follow you to another device. Your reminder time, theme, and language are not sent. Our database security rules allow only your own signed-in account to read or write these records. Turning backup off deletes the cloud copy and stops further uploads; the records on your phone stay as they are.

Usage analytics (optional, off by default)

If you turn on Usage analytics under You → Data sharing, Firebase Analytics receives which screens you open and a fixed set of feature events: onboarding completed, a day, meal, or lab result saved, an experiment started or stopped, an export, PDF, or progress card shared, a backup restored, sign-in, sign-out, and account deletion, backup or reminder switched on or off, the Pro screen viewed, and a trial, purchase, or restore. An event can carry at most a count of your own records. It never contains a symptom, flow level, weight, note, date, food, or lab value. Firebase also records standard technical information such as an app-instance identifier, device model, operating system and app version, and approximate location (country or region) derived from your IP address. Advertising-ID collection is switched off and the advertising-ID permission is removed from the app. Turning analytics off stops collection and resets the analytics data stored on your phone.

Crash reports (optional, off by default)

If you turn on Crash reports, a separate switch, Firebase Crashlytics receives a report when the app crashes: the technical stack trace, device model, operating system and app version, and a random installation identifier. Nothing you typed or logged and no account identifier is attached. Turning crash reports off stops collection and deletes reports that have not been sent yet.

Pro subscription (optional)

Google Play processes the payment for Pro; we never see your card details. RevenueCat tells the app whether Pro is active. The RevenueCat library is started only when you open the Pro screen, buy, or restore, or at launch if Pro is already active on your phone. RevenueCat then receives a random app user ID that its library creates, your purchase records from Google Play (product, purchase and renewal or expiry dates, and store transaction details), and basic technical information such as store country and app version. It is never told your email address, your account, or anything you have logged. Automatic device-identifier collection in that library is switched off.

Exports and sharing you start

Export as CSV or JSON, the summary PDF for an appointment, and a progress card (an image with aggregate numbers only) are created on your phone and handed to your phone’s share sheet. Where they go next is your choice, and that destination’s privacy policy then applies. Restoring from a file uses your phone’s file picker; the app reads only the file you choose.

Notifications

The daily check-in reminder is scheduled on your phone. No notification is sent from a server, and we do not collect a push token.

Android device backup

If Android backup is turned on for your Google account, Android may include the app’s data, including your health records, in your device backup so it can be restored on a new phone. That backup is managed by Google under your Google account; we cannot read it. You control it in your phone’s backup settings.

Permissions

Notifications: the daily reminder you turn on. Run at startup: rescheduling your reminder after the phone restarts. Internet: the optional account, backup, analytics, crash reports, and Pro. The app does not request access to your camera, microphone, contacts, location, or photos. You can change permissions in your device settings.

How we use information

We use information to keep your records on your phone for you; provide your optional account and backup; verify and restore Pro; send the reminder you choose; fix crashes and improve the app, only if you opted in; respond to support requests; and meet legal obligations. Health information is used only to provide these features to you.

Service providers

We share information only with providers that process it on our behalf to run the app, and only when the related feature is in use:

• Google Firebase (Authentication, Cloud Firestore, Analytics, Crashlytics): your optional account, your optional cloud backup, and, if you turn them on, usage analytics and crash reports.
• RevenueCat: Pro status and purchase records.
• Google: Google Sign-In, Google Play distribution, and in-app purchases.

We may also disclose information if required by law or to protect the rights, safety, or security of our users or others. We do not sell personal information or share it for cross-context behavioral advertising.

Where data is processed

Cloud backups are stored in Google Cloud Firestore in the European Union (the eur3 multi-region, in Belgium and the Netherlands). Account information, analytics, crash reports, and purchase records may be processed by Google and RevenueCat in the United States and other countries. Where required, transfers rely on appropriate safeguards such as the providers’ standard contractual clauses.

Retention

• Records on your phone stay until you delete them or uninstall the app.
• The cloud copy mirrors your phone and is kept until you delete the records, turn backup off, or delete your account.
• Your account is kept until you delete it.
• Analytics data and crash reports, if you opted in, are kept for Firebase’s retention periods (crash reports for 90 days).
• Purchase records are kept by RevenueCat and Google Play for as long as needed to provide and restore Pro and to meet tax and accounting obligations. They contain no health information.

Deleting your account

In the app, open You → Account → Manage your account → Delete account and confirm with Delete the account. This permanently deletes the cloud copy of your records and then your account. If the app asks, sign out and sign in again first, then repeat. It cannot be undone.

Deleting your account leaves the records on your phone alone. To erase them, use Delete everything on the You tab, which removes every log, experiment, and lab result from your phone (and from the cloud copy if backup is on), or uninstall the app. Deleting your account does not cancel a Pro subscription: cancel it in Google Play under Payments & subscriptions → Subscriptions.

If you cannot use the app, email support@herazur.us from your account’s email address with the subject “PCOS Lab account deletion”, and we will delete your account and its cloud copy and confirm.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can view, edit, export (You → Your data), and delete your records in the app, and turn every optional switch off where you turned it on. For other requests, contact us at the address below. We aim to respond within 30 days and will not discriminate against you for exercising your rights. You may also complain to your local data protection authority.

Security

Records on your phone are kept in the app’s private storage, protected by Android’s app sandbox and your device’s encryption. Data sent to our providers is encrypted in transit, and each cloud backup can be read only by its owner’s signed-in account. No method of transmission or storage is completely secure.

Children

PCOS Lab is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

Not medical advice

PCOS Lab is for tracking and education. It does not diagnose, treat, or replace your doctor, makes no predictions about your cycle, and does not interpret lab values. Experiment results are observations, not proof. Talk to a qualified health professional about your care.

Changes to this policy

If we change how we handle information, we will update this page and its effective date and, for significant changes, tell you in the app.

Contact

Privacy questions: furkan@herazur.us. Support and account deletion: support@herazur.us.