HerMetrics Privacy Policy
Last updated: 12 October 2026
HerMetrics tracks food, cycle and training together. That means the app handles some of the most personal information there is, so this policy tries to be specific rather than reassuring — it says which fields go where, and which ones we can read.
If anything here is unclear, write to hello@fem-fit.com.
The short version
- Your data lives on your phone first, and the app reads from it, so it works without a connection once you are signed in.
- If you create an account, most of it also syncs to our servers so you do not lose it when you change phones.
- Your cycle, your symptoms, and your pregnancy status are encrypted on your phone before they are uploaded. We hold only unreadable ciphertext for those. Someone who obtained a copy of our database could not read them.
- Some other data — your weight, height, goal, food and workout logs — is stored on our servers in a form we could read. It is protected by per-user access rules, but we are not going to claim it is end-to-end encrypted, because it is not.
- We do not sell your data, we do not advertise, and we never use Apple Health data for marketing.
What stays on your device
HerMetrics stores your logs in a database on your phone and computes your targets there. An account is needed to use the app — it is what carries your history to a new phone — but the app reads from the phone, and only what is listed below leaves it.
What syncs to our servers
If you create an account, HerMetrics syncs your data to Supabase, a hosted database provider, so it survives a lost or replaced phone. Every row is tagged with your user ID, and database-level Row Level Security rules mean a request authenticated as you can only ever reach your own rows.
Encrypted end-to-end — we cannot read these
Before upload, these are sealed on your phone with XChaCha20-Poly1305 using a key that exists only on your devices:
| Data | Fields |
|---|---|
| Cycle log | date, flow, whether a period started, your notes |
| Symptom log | date, symptom type, severity |
| Pregnancy | pregnancy status, due date |
Our servers store these as an opaque blob and hold no key that can open it. We cannot browse them, and we cannot produce them in readable form in response to a legal demand.
How the key reaches a new phone, and what that costs
The key that opens the data above never leaves your devices in a usable form. Two encrypted copies of it are kept on our servers so you can get it back:
- one locked with your account password, which is what makes signing in on a new phone simply work;
- one locked with your twelve-word recovery phrase, which is the way back if you ever forget your password.
Both open the same key. The second exists because a password reset makes the first unopenable — which is exactly when the phrase matters.
If you sign in with Apple, there is no password copy. An Apple account has no HerMetrics password, so the only copy of your key on our servers is the one locked with your recovery phrase. Signing in with Apple on a new phone brings your account but not your encrypted history; the twelve words are what bring that. Lose the phone that holds the key and the words together, and that history is gone — permanently, for everyone, including us. The app tells you this when it shows you the phrase.
The honest caveat. Because your password can unlock the key, someone who could capture your password as you typed it in — which in practice means us, or anyone who had compromised our sign-in service — could in principle derive that key. We do not do this, and a stolen copy of the database is not enough to do it: the password copy is protected by a slow, memory-hard function and a random value unique to your account, and the password itself is never stored, only a one-way hash of it.
If that residual risk matters more to you than the convenience, the phrase-locked copy is unaffected by any of it.
And the part that has not changed: if you lose both your password and your recovery phrase, that data is gone — permanently, for everyone, including us. Write the phrase down.
Stored in readable form on our servers
These sync under the same per-user access rules, but are not end-to-end encrypted:
- Profile: date of birth, height, weight, body fat percentage, activity level, goal, contraception method, training experience, units preference
- Weight log
- Food items and food entries
- Workout sessions
- Resting heart rate, when Apple Health provides it (only a watch records it)
- The Coach's daily cards. Chat messages are not stored anywhere after the conversation ends; only the day's card is kept, so it is not fetched twice.
Your account
Supabase Auth holds your email address and, if you set one, a hash of your password. We never store your password itself.
If you use Sign in with Apple, it holds the email address Apple gives us — your own, or a private relay address if you chose to hide it — and Apple's identifier for you in this app. We never see your Apple password, and we do not ask Apple for your name. If an account already exists with the same verified email, Apple sign-in opens that account rather than creating a second one.
Apple Health
HerMetrics asks for Apple Health access so your coaching reflects everything you do, not only what you type in. Granting it is optional and the app works fully without it.
What HerMetrics reads from Apple Health
- Workouts
- Body mass
- Body fat percentage
- Lean body mass
- Active energy burned
- Resting heart rate (only a watch records it; an iPhone alone has none)
What HerMetrics writes to Apple Health
- Workouts you logged in HerMetrics
- Body weight you logged in HerMetrics
That is the complete list, in both directions.
HerMetrics does not read or write menstrual or reproductive health data in Apple Health. Your cycle information moves in neither direction.
Health data imported from Apple Health is treated exactly like data you typed in: stored on your device, and synced under the rules above. In line with Apple's requirements, HealthKit data is never used for advertising, marketing, or sold or shared with data brokers, and is never disclosed to third parties except as described in this policy.
The Coach
The Coach writes plain-language guidance around numbers the app has already calculated. It is optional, and if it is unavailable the app falls back to a briefing composed entirely on your phone.
When you use it, HerMetrics sends a summary of your current situation to our server, which forwards it to Anthropic, the provider of the language model. That summary contains:
- your age, goal, training experience and contraception method
- your current cycle phase and cycle day
- your pregnancy status and gestational week, if you have entered them
- your calculated energy needs, calorie and macro targets, and what you have eaten today
- any safety flags the app has raised, and its training recommendation
Read that list carefully. Cycle and pregnancy information is end-to-end encrypted in storage, but using the Coach necessarily sends a derived form of it off your phone. Both statements are true, and it would be misleading to publish only the first. If you would rather nothing left your device, do not use the Coach — every other part of the app works without it.
Your name, email address and account identifier are not included. Anthropic processes the request to generate a reply and, under its commercial terms, does not use it to train its models. Our server logs the request method, path, response status and token counts — never the contents.
Our server also keeps a per-day count of how many Coach requests each account has made, so a runaway loop cannot exhaust our budget. It stores a user ID, a date and a number, and nothing about what was asked.
Food information
- Barcode scans and text searches go through our server to USDA FoodData Central. Our server caches results for a day, so a common search or scan may not leave our server at all. The cache holds food facts, not who searched for them.
- A barcode USDA does not recognise is sent to Open Food Facts, an open food database, from your phone.
Neither service is told who you are.
We send account emails — confirmation and password reset — through Resend, which processes your email address in order to deliver them. We do not send marketing email. An account that signs in with Apple receives neither: Apple has already confirmed the address, and there is no password to reset.
What we never do
- Sell or rent your data.
- Show advertising, or share data with advertisers or data brokers.
- Use Apple Health data for anything other than the coaching features described here.
- Use your data to train machine-learning models.
Keeping and deleting your data
Your data is retained while your account exists. You can delete individual entries in the app at any time; on the next sync the entry is marked deleted on every device and disappears from the app. The row itself stays in our database, marked deleted, until your account is deleted.
To delete your account and everything associated with it, use Delete my account on the You tab. It removes your account and every row belonging to it, including the encrypted blobs we could never read, straight away. If you signed in with Apple, the app first asks you to confirm with Apple so it can disconnect HerMetrics from your Apple Account; if that step fails, your account is still deleted and you can remove HerMetrics yourself under Settings → Apple Account → Sign in with Apple. If you no longer have the app, email hello@fem-fit.com from your account address and we will do the same by hand.
Children
HerMetrics is not intended for anyone under 13, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.
Security
Data in transit is encrypted with TLS. Data at rest is encrypted by our hosting providers, and cycle, symptom and pregnancy data is additionally encrypted with a key we do not have. Access rules are enforced by the database itself rather than by application code, so a bug in the app cannot expose one user's rows to another.
No system is perfectly secure, and we will tell you promptly if we ever learn that your data has been exposed.
Changes to this policy
If we change what we collect or who we send it to, we will update this page and change the date at the top. Material changes will be announced in the app.