Period tracker privacy should be part of the product.
Ovumcy is built around a simple baseline: cycle tracking should stay useful without turning sensitive health data into someone else's business model, whether the person chooses the local-first app, the full self-hosted web deployment, self-hosted sync for the app, or a managed path later.
Privacy claims should survive contact with history.
On June 22, 2021, the U.S. Federal Trade Commission finalized an order with Flo Health after alleging that, despite privacy promises, Flo shared sensitive health data with marketing and analytics firms including Facebook and Google. Read the FTC order.
Ovumcy is built around a different baseline: app-only use keeps core records on-device, self-hosted web keeps records on the operator's server, and self-hosted sync is designed around ciphertext plus sync metadata instead of ad-tech disclosure.
What Ovumcy does not do
- It does not sell health data.
- It does not run ad-tech or third-party surveillance on the product.
- It does not make cloud mandatory for basic cycle tracking.
- It does not treat export as a premium ransom feature.
How privacy changes by product path
App-only use keeps core health data on-device by default. Self-hosted web moves records into the database on the server the operator runs. Self-hosted sync for the app is designed to store ciphertext and sync metadata rather than plaintext health records. Managed hosting is a separate trust decision that should be evaluated on its own current surface.
What privacy still requires from the operator
The self-hosted models keep storage, backups, and network exposure under operator control, which means the host, reverse proxy, secrets, logs, and backup retention still need to be secured deliberately.
What self-hosting means
If full infrastructure control matters, there is a supported self-host path instead of a hidden workaround. That is part of the trust model, not a side channel.
What portability means
Data should stay portable. If someone wants to leave, change setups, or move between deployment shapes later, that should remain possible without lock-in drama.