Privacy

The mandatory §21 privacy documents.

• Data inventory — every personal-data field with source, classification, purpose, retention, and legal basis.
• Data flow — where data goes on and off the device.
• Processors — third parties that receive personal data. Currently none in production (fully local-first).
• Permissions — iOS and Android runtime permissions, requested only at feature-enable time.
• Analytics event allowlist — deliberately empty. Hard deny-list of properties that must never be sent.
• Retention policy — per-category retention windows.
• Consent register — every consent type + the versioned consents table schema.

Core rule

Sensitive menstrual, reproductive, symptom, or health-state values must never be sent to generic analytics, advertising, or marketing systems.

Enforced by review on every PR that touches personal-data handling.