Privacy policy

Soma is made by Apptalic Lab Ltd., a company registered in Nigeria (“we”, “us”). We are the controller of the personal data described in this policy.

This policy covers the Soma app on iOS and Android and the website at somacircle.online. For questions or requests about your data, email support@somacircle.online.

• Soma works without an account. Your cycle history, check-ins and notes are stored on your phone.
• Cloud features are optional: backup, sharing with someone you choose, and Soma AI. Each one only sends what it needs, and only after you turn it on.
• We don't sell your data, show ads, or use advertising or analytics trackers.
• A few things leave your phone even without an account: crash reports, a notification token for service notices, and font downloads. Section 4 lists them.
• You can delete your account and cloud data from inside the app.

Everything you log in Soma is stored in the app's private storage on your phone: period and cycle dates, symptoms, moods, check-ins, notes, reminders and settings. Predictions and insights are calculated on your phone. We cannot see this data unless you turn on a cloud feature described below.

Reminders are scheduled on your phone. Home screen widgets read from the same on-device data; with discreet mode on, they avoid cycle terms.

Anyone who can unlock your phone may be able to open Soma. You can add an app lock in settings.

The table lists everything that leaves your device, why, and the legal basis we rely on under the EU and UK GDPR and the Nigeria Data Protection Act 2023.

Our website forms use a bot check from Cloudflare, which sees your IP address and browser details. The website does not use tracking cookies or pixels.

We do not use your data for advertising, to build marketing profiles, or to train AI models.

Soma AI is a Premium feature. Before you use it for the first time, the app explains what is sent and asks for your agreement. Replies are labelled with where they were made. Today they are made in the cloud.

Each time you ask something, the app sends:

• Labels about your cycle: phase, cycle day, how confident the prediction is, recent symptom and mood labels, and simple trend flags (for example, whether cycles have been regular).
• The question you type and up to eight earlier messages from the same conversation, each shortened. Email addresses, phone numbers and web links are removed on your phone and again on our server.
• Your tone preference.

It never sends your dates, notes, measurements, name or email address. Please don't type other details that identify you, such as your full name or address.

The request goes to our server, which checks your account and daily limit, and then to Anthropic, the company that runs the AI model. Anthropic processes it to write the reply and does not use it to train its models. We don't store your questions or Soma AI's replies on our servers; the conversation is kept on your phone. We keep a count of today's uses and anonymous totals, such as how many replies were made each day.

Soma AI gives general wellness information, not medical advice. If a message suggests you may be in crisis, Soma shows support resources instead of an AI reply.

Cloud backup is off until you turn it on. Your records are encrypted on your phone with AES-256 before they are uploaded, so our database holds them only in encrypted form.

To let you restore by just signing in, the key that unlocks your backup is stored with your account. That means your backup is protected by your account and our access controls, rather than by a separate password that only you know. We don't open backups, and access to our systems is limited to the people who run Soma.

You can turn backup off or delete your cloud data at any time in the app. If Premium ends, backup pauses and the encrypted copy is deleted after 30 days unless you subscribe again.

You can invite someone to see a read-only view of your cycle. You choose what they see, and you can stop sharing at any time. The shared view is encrypted on your phone, and its key is stored so that only you and the person you invited can open it in the app.

Invites that aren't accepted expire after 48 hours. When you stop sharing, the shared view and its key are deleted.

We never sell personal data or share it with advertisers or data brokers. We use these service providers, who may only process data on our instructions:

• Google (Firebase and Google Cloud): accounts, the database (stored in the EU), our server code (run in the US), crash reports, notifications and app integrity checks. Google Fonts provides the app's typefaces.
• Anthropic (US): writes Soma AI replies.
• RevenueCat (US): manages subscriptions and purchases.
• Apple and Google: app stores, payments, sign-in and the app integrity check. Their own privacy policies apply to your store account.
• Cloudflare: hosts our website, runs the form bot check, and forwards email sent to our support address.

We may disclose data if the law requires it. Because cycle data is sensitive, we review every request, challenge requests that are unlawful or too broad, disclose as little as possible, and tell you about the request unless we are legally prevented from doing so. Most of your cycle data is only on your phone, and your backup is encrypted.

If Apptalic Lab Ltd. is ever merged or sold, your data would only move under this policy, and we would tell you first.

We are based in Nigeria, our database is in the EU, and some of our providers process data in the US. When data moves between countries, we rely on the safeguards the law requires, such as the European Commission's standard contractual clauses and the transfer rules of the Nigeria Data Protection Act.

• On your phone: until you delete it or uninstall Soma.
• Account and backup: until you delete your cloud data or your account. If your Premium plan or free trial ends, your backup is paused and kept for 30 days in case you come back, then deleted.
• Sharing: until you stop sharing; unaccepted invites after 48 hours.
• Soma AI: questions and replies are not stored on our servers; the daily count is replaced each day and deleted with your account.
• Crash reports: 90 days.
• Purchase records: as long as needed for tax, accounting and fraud prevention. Apple and Google keep their own records.
• Waitlist: until shortly after launch, or until you ask us to remove you.
• Feedback and emails: up to two years, unless you ask us to delete them sooner.

In the app you can:

• use Soma without an account;
• turn cloud backup off, or delete your cloud data;
• stop sharing at any time;
• stop using Soma AI, which ends what it sends;
• turn off notifications in your phone's settings;
• delete your account, which deletes your backup, sharing and Soma AI usage record.

Wherever you live, you can ask us to access, correct, delete or export your data, to stop or limit how we use it, and to withdraw consent at any time (this doesn't affect anything done before). These rights come from laws including the EU and UK GDPR, the Nigeria Data Protection Act, and US state privacy and consumer health data laws. Email support@somacircle.online. We reply within 30 days and may need to confirm it's you. We won't treat you differently for using your rights.

If you're unhappy with how we handle your data, you can complain to a data protection authority, such as the Nigeria Data Protection Commission, the authority in your EU country, or the UK Information Commissioner's Office. We'd like the chance to help first.

Soma is for people aged 16 and over. We don't knowingly collect data from anyone younger. If you think a child under 16 has given us data, email support@somacircle.online and we'll delete it.

We use encryption in transit and at rest, encrypt backups and shared views on your phone, require app integrity checks for paid features, limit staff access, and log administrative actions. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.

If we change this policy, we'll update the date above. If a change affects how we use data you've already given us, we'll tell you in the app first and, where needed, ask for your consent again.

Apptalic Lab Ltd., Nigeria. Email support@somacircle.online. See also our Terms of service.