Privacy Policy

Last updated 3 October 2026 · Version 2026-10-03

The short version. What you log about your cycle and health is encrypted on your device before it leaves it, with a key made from your password. We store only that scrambled copy, so we cannot read it, sell it, or hand it over in readable form, even if asked. We don't use advertising, analytics or tracking tools. You can download or delete everything at any time.

1. Who we are

Shark Week Tracker (“the app”, “we”, “us”) is operated by Yasa Yard Management, Victoria, Australia. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Contact us at j.clissoldyasa@gmail.com.

2. What we collect, and why

Information	Why	Can we read it?
Your email address	To identify your account so you can sign in on other devices.	Yes
Health information you choose to log: period dates and flow, symptoms, mood, pain, sleep, temperature, cervical mucus, ovulation tests, exercise, medicines, notes, and your app settings	To show your calendar, predictions, charts and insights, and to sync them between your devices.	No. End-to-end encrypted (see section 4).
Security data derived from your password (a login key hashed with a secret, and your data key in encrypted form)	To check it's you when you sign in, without ever receiving your password.	No — your password never leaves your device.
Signed-in devices: a coarse label (e.g. “Android”), when each session started and was last used	So you can see and sign out devices.	Yes
Sleep estimates (Android app, only if you switch on sleep tracking): the times your screen turned on and off	To estimate when you fell asleep and woke up. Worked out on your phone; only the result (bedtime, wake time, duration) is saved, in your encrypted log. We never read which apps you used.	No. End-to-end encrypted.
Partner forecast (only if you switch on partner heads-up): your next expected period date, whether you're on your period, and, if you choose, your usual symptoms, plus the names you enter	To show the person you share the link with a "Shark Week forecast". Fertility information is never included.	No. Encrypted with a key that exists only in the link you share.
IP address, used briefly	To limit repeated sign-in attempts (rate limiting) and keep the service secure.	Yes, held for no more than 24 hours

Health information is “sensitive information” under the Privacy Act. We only collect it with your express consent, which you give when you create your account. You can withdraw consent at any time by deleting your account (section 8). Logging anything is optional.

We do not collect your name, location, contacts, photos, advertising IDs, or device identifiers, and we do not use cookies for tracking.

2a. Sharing with a partner

Partner heads-up is off unless you turn it on. When on, anyone who has your link can see your forecast, so only share it with people you trust. Turning it off deletes the forecast straight away and the old link stops working. Heads-up messages are sent by you, through your own messaging apps; we don't contact your partner.

3. How we use it

Only to provide the app to you: syncing your data, signing you in, keeping the service secure, and contacting you about your account if needed. We do not sell, rent or share your personal information for marketing, and we do not use it for advertising, profiling, or to train AI models. Predictions and insights are calculated on your device.

4. Encryption and security (APP 11)

Your password is turned into keys on your device (PBKDF2-SHA-256, 600,000 rounds). One key unlocks a random 256-bit data key; a separate key is used to sign in. The server never receives your password or your data key.
Every entry is encrypted with AES-256-GCM on your device. Entry names are scrambled too, so the server can't even see which dates you logged.
All connections use HTTPS (TLS). The service uses strict security headers, rate limiting on sign-in, and per-account access controls so one account can never read another's records.
On Android, the app blocks screenshots and hides its content in the recent-apps screen by default, and excludes your data from device backups.
Because we can't decrypt your data, we can't recover it if you lose both your password and your recovery code.

If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

5. Where your information is stored (APP 8)

We use Cloudflare, Inc. to host the app and its database. The database is set to be stored in the Oceania region, but Cloudflare is a US company with a global network, so your information (including your email address and encrypted data) may be processed in other countries while it is in transit or cached. Cloudflare acts only on our instructions and is bound by contractual data-protection terms. Your health data is encrypted before it leaves your device, so it is unreadable to Cloudflare and anyone else. By consenting to this policy you acknowledge this disclosure.

6. Disclosure

We don't disclose your personal information to anyone except our hosting provider (as above), or where required by Australian law. If we are lawfully required to provide data, we can only provide your email address, device-session records and encrypted data that we cannot read.

7. Keeping, accessing and correcting your information (APPs 11–13)

You can view, correct and delete any entry in the app at any time.
You can download all your data (JSON or CSV) from Me → Your data.
Inactive device sessions are removed after 90 days; sign-in attempt records after 24 hours.
We keep your account until you delete it.

8. Deleting your account

Choose Me → Delete account and all data. This permanently deletes your account, all your encrypted entries and all sessions from our database straight away. Copies in our hosting provider's encrypted backups expire within 30 days. If you can't sign in, email us from your account's address and we'll delete it.

9. Children

You must be 16 or older to create an account.

10. Not medical advice

The app provides general wellbeing information. It is not a medical device, is not a contraceptive, and doesn't diagnose or treat any condition. See our Terms of Use.

11. Complaints

If you have a question or complaint about privacy, email j.clissoldyasa@gmail.com. We'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992.

12. Changes

If we make material changes to this policy we'll ask you to review and agree to them in the app before continuing.