Privacy Policy

Last updated 1 November 2026

This Privacy Policy explains how Kausaly ("we", "us", "our") collects, uses, stores and shares ("processes") your personal information when you use the Kausaly iPhone app, your Kausaly account, our website kausaly.ai, or contact us (together, the "Services").

We are responsible for deciding how your personal information is processed (the "controller" under the EU General Data Protection Regulation, GDPR). If you have questions, write to us at hello@kausaly.ai. If you do not agree with this policy, please do not use our Services. The rules for using Kausaly are in our Terms of Service.

Summary of key points

What do we collect? Your account details (name, email address, profile picture), and only if you choose to: a backup of what you log, usage data, and your email for news or the waitlist. More

Do we process sensitive information? Yes. What you log in Kausaly is up to you and can reveal information about your habits. We treat it as sensitive data under the GDPR. It only leaves your phone if you give your explicit consent, for example by switching on backup. More

What about Apple Health? Kausaly reads Apple Health data on your phone only. It is never uploaded to us, never shared and never used for advertising. More

Do we sell your data or use it for ads? No. We don't sell personal information, show ads or track you across other apps or websites.

Who do we share it with? Only with service providers that help us run Kausaly (such as hosting and email), under contracts that bind them to our instructions. More

What are your rights? You can access, export, correct and delete your data, and withdraw any consent at any time, much of it directly in the app. We give these rights to everyone, wherever you live. More

What information do we collect?
Health data and Apple Health
How do we use your information?
What legal bases do we rely on?
When and with whom do we share your information?
How long do we keep your information?
How do we keep your information safe?
AI features (planned)
What are your privacy rights?
Additional information for your region
Children
Do we update this policy?
How can you contact us?

1. What information do we collect?

In short: account details you give us when you sign in, and further information only if you choose to share it.

Account. Kausaly requires an account. When you sign in with Google or Apple, we receive your name, email address and, from Google, your profile picture. You can also upload your own picture.

What you log. Your metrics, entries, notes, goals and patterns are stored on your iPhone. A copy is stored on our servers only if you switch on Back up my logs.

Usage data. Only if you switch on Help improve Kausaly: which features you use and how, including values you log for the metrics Kausaly suggests, together with a random identifier. Never your name, email address, Apple Health data or text you type.

Waitlist. If you join the waitlist on our website: your email address and the date and wording of your consent.

Contacting us. If you email us, the information in your message.

Payments. If you buy a subscription in the future, payment is handled by Apple. We never receive your payment details, only whether your subscription is active.

Website. Our website uses no cookies and no analytics. Our hosting provider processes technical data such as your IP address to deliver the website and protect it from attacks.

2. Health data and Apple Health

In short: health-related data stays on your phone unless you explicitly agree otherwise.

If you allow it, Kausaly reads data such as sleep, heart rate, heart rate variability, steps, workouts and cycle tracking (period days and ovulation tests) from Apple Health. This happens only on your iPhone: Apple Health data is not uploaded to our servers, not included in backups, not used for usage data, and never used for advertising or shared with third parties. Kausaly does not write to Apple Health. You can change Apple Health permissions in your iPhone's settings at any time.

What you log yourself can also be health-related. We only process it on our servers with your explicit consent (backup, usage data, and AI features once available), and you can withdraw that consent at any time in the app.

Kausaly shows patterns in your own data. It does not give medical advice and does not make decisions about you that have legal or similarly significant effects.

3. How do we use your information?

In short: to provide Kausaly, keep it secure, improve it with your consent, and communicate with you.

To create and manage your account and keep you signed in.
To back up and restore what you log, if you switch on backup.
To understand how Kausaly is used and improve it, if you switch on usage data.
To send emails about your account, such as a welcome email, confirmations when you delete your data, and a notice before an unused account is deleted.
To send news or launch updates, if you opted in.
To answer your questions and requests.
To keep our Services secure and prevent misuse.
To comply with legal obligations.

4. What legal bases do we rely on?

In short: your consent, our contract with you, legal obligations, and our legitimate interests.

Contract (Art. 6(1)(b) GDPR): providing your account and the Services, and account emails.
Explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR): backup, usage data and future AI features, because they involve health-related data. For usage data, storing a random identifier on your device is also based on your consent (§ 25 German TDDDG).
Consent (Art. 6(1)(a) GDPR): newsletter and waitlist.
Legal obligations (Art. 6(1)(c) GDPR): for example handling your privacy requests or keeping records we are required to keep.
Legitimate interests (Art. 6(1)(f) GDPR): keeping our website and Services secure and answering messages.

You can withdraw any consent at any time, in the app or by emailing us. This does not affect processing that happened before you withdrew it.

In short: only with service providers that help us run Kausaly, and only as needed.

We use carefully selected service providers that process data on our behalf under data processing agreements (Art. 28 GDPR):

Hosting, storage and email delivery provider. Account and backup data is stored in the EU.
Analytics provider, only if you switch on usage data. Data is hosted in the EU.
Email provider for messages you send to us.

When you sign in with Google or Apple, they handle the sign-in under their own privacy policies. Subscriptions will be handled by Apple through the App Store.

You can ask us for the names of our current service providers at any time. Some of them are based in the United States. Where data leaves the EU, it is protected by an EU adequacy decision (the EU–US Data Privacy Framework) or the EU's standard contractual clauses.

We may also share information if required by law, to protect our rights, or as part of a merger, sale or transfer of our business, in which case this policy continues to apply to your information. We do not sell your personal information.

6. How long do we keep your information?

In short: only as long as needed, and never longer than you have an account, unless the law requires it.

Account: until you delete it. Accounts that haven't been used for two years are deleted; we email you 30 days before, and using the app in that time keeps your account.
Backup: until you switch backup off or delete your account.
Usage data: at most one year, and earlier if you delete your data or account.
Newsletter: until you unsubscribe or delete your account.
Waitlist: until launch or until you unsubscribe; unconfirmed addresses after 30 days.
Emails to us: as long as needed to handle your request.

Where the law requires us to keep certain information for longer (for example for tax purposes once subscriptions exist), we keep it only for that purpose.

7. How do we keep your information safe?

In short: through appropriate technical and organisational measures.

We use appropriate technical and organisational measures to protect your personal information, and keep as much of it as possible on your own device. However, no transmission over the internet or storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorised third parties will never be able to defeat our security. Please keep your iPhone and your Google or Apple account secure.

8. AI features (planned)

In short: not available yet; they will be optional and need your explicit consent.

We plan to offer optional AI feedback, where Kausaly sends a selection you choose to an AI provider and shows you its answer, and a way to connect Kausaly to your own AI assistant account. Before these features are available, we will update this policy, and they will only work after you give your explicit consent. AI answers can be wrong and are not medical advice.

9. What are your privacy rights?

In short: you control your data, and you can use most of your rights directly in the app.

Under the GDPR you have the right to access your data, get a copy (data portability), have it corrected or deleted, restrict or object to processing, and withdraw consent at any time. In the app you can:

export everything (Settings → Export my data),
delete your account and all your data (Settings → Delete my data),
switch backup, usage data and the newsletter on or off,
edit or delete what you have logged.

For anything else, email us at hello@kausaly.ai. We answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

10. Additional information for your region

In short: we give everyone the rights described above, wherever you live. Some places give you additional rights, listed here.

Where your data is stored

Kausaly is operated from Germany. If you live outside the EU, the information you share with us is transferred to and stored in the EU, and some of our service providers may process it in the United States, protected as described in section 5.

United Kingdom and Switzerland

The UK GDPR and the Swiss Federal Act on Data Protection give you the same rights as described in section 9. You can complain to the UK Information Commissioner's Office (ICO) or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Canada

We collect, use and share your personal information only with your consent or where the law allows it, and you can withdraw consent at any time. You can ask to access and correct your information. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

United States

Depending on the state you live in, you may have the right to know whether we process your personal information, to access it and get a copy, to correct it, to delete it, and to opt out of the sale of your personal information, targeted advertising and profiling. We honour these requests for all US users.

What we collect: identifiers (name, email address, account and device identifiers), information about how you use the app (only with your consent), and sensitive information, namely health-related information you log (only on our servers with your consent).
Sources: directly from you, and from Google or Apple when you sign in.
Sale and sharing: we do not sell your personal information, do not share it for targeted advertising, and do not use it for profiling with legal or similarly significant effects. We have not done so in the past 12 months. Signals such as Global Privacy Control therefore don't change how we handle your data.
Sensitive information: we use it only to provide the features you ask for.
Health data: our Consumer Health Data Privacy Policy explains how we handle consumer health data under laws such as Washington's My Health My Data Act and Nevada's and Connecticut's health data laws.
How to make a request: use the options in the app or email hello@kausaly.ai. We may need to confirm that the request comes from you, usually through your Kausaly account. You may use an authorised agent with your written permission.
Appeals: if we decline your request, you can appeal by emailing us with "Appeal" in the subject. We will answer in writing with our reasons. If your appeal is denied, you can contact your state attorney general.
No discrimination: we will not treat you differently for exercising your rights.

Other countries

If you live elsewhere, for example in Australia, Brazil, Japan or South Korea, local laws may give you further rights. We apply the rights described in this policy to everyone; contact us to use them.

11. Children

Kausaly is only for people aged 18 and over. We do not knowingly collect personal information from anyone under 18; if we learn that we have, we delete it. If you believe a minor is using Kausaly, please contact us.

12. Do we update this policy?

We update this policy when our Services or the law change; the date at the top shows the latest version. If changes are significant, we tell you in the app before they take effect, and we ask for your consent where needed.

13. How can you contact us?

The controller responsible for Kausaly is the operator named, with postal address, in our Impressum. Email: hello@kausaly.ai.