Privacy policy
The short version
- We collect only what the app needs to work: your email and what you choose to log.
- Your entries are private to your account. Other members can't see them.
- We never sell your data, share it with advertisers, or use it for ads.
- You can download your data or erase it from inside the app at any time.
Skin by Phase ("we", "us") is a period and cycle tracker created by Liz Portugal in Toronto, Ontario. This policy explains what personal information we collect, why, and the choices you have. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Your cycle and symptom logs are health information, and we treat them as sensitive.
What we collect
Your account
Your email address, used to sign you in with a one-time code. If you add a passkey, your device keeps the private key and we store only the public part needed to recognize it. We never see or store a password.
What you log
- Period start and end dates
- Daily check-ins: flow, mood, energy, sleep, cramps, bloating, cravings, skin, and any notes you write
- Your settings, like usual cycle and period length, and your support list if you make one (things like cravings, comfort and what to skip)
- If you use Plus: the skincare products you add, skin diary photos you upload, and questions you send to Liz
- Feedback you choose to send, and whether you agree to be quoted
Skin diary photos
Photos are stored privately, linked to your account only. They're shown to you through links that expire after a few minutes. Anyone who has one of those links could open the photo until it expires, so please don't share them. Deleting a photo, or erasing your data, removes it from storage.
Payments
If you subscribe to Plus, Stripe processes your payment. Your card details go directly to Stripe and never touch our servers. We keep your subscription status, plan and renewal date, and a Stripe customer ID so you can manage billing.
Reminders and your calendar
If you turn on reminder emails, we use your predicted dates to send them, and every email has a one-click unsubscribe link. If you add your calendar link to Apple, Google or Outlook Calendar, that service fetches your estimated period dates from a private link. The calendar event is titled "Skin reminder" so it doesn't spell out what it's about, but email previews and calendar details can still show on a lock screen. Anyone you share the link with could see those dates, so keep it private. You can make a new link at any time, which switches off the old one.
Sending the partner guide
When you tap "Send to my partner", you choose what goes with the link each time: just the guide, or also your current phase, your support list and a short note. Your phase is private unless you choose to share it. What you include travels inside the link itself, after the "#", which browsers don't send to our servers, and we don't save it when your partner opens the page. Your dates, check-ins, notes and photos are never included. Anyone who has the link can see what's in it, so send it only to people you trust. The message is sent by you, through your own phone or computer.
Technical basics
A sign-in cookie that keeps you logged in, and standard server logs (such as time of request and error details) that our hosting provider keeps for security and troubleshooting. We count page visits ourselves, storing only the date, the page and the website that sent you, with no cookies or identifiers. Our pages load fonts from Google Fonts, so your browser connects to Google, which receives your IP address and browser details. We don't use advertising cookies, tracking pixels or third-party analytics.
How we use it
Only to run the app for you: to sign you in, save your entries, calculate your cycle predictions and phases, and show your patterns. We don't use your logs for anything else, and we don't build profiles of you for marketing.
Who can see it
Other members: no. Your entries are tied to your account, and the app only returns them to you when you're signed in.
Us: as the operator, we have technical access to the database. We look at personal data only when you ask us for help, to fix a problem, or when the law requires it. Questions and feedback you send are read by Liz personally. Your email address is hidden in her view: it's only used to send you her reply to a question. Feedback is stored without your email address.
Feedback: we only quote your feedback on the website if you tick the box agreeing to it, and only with the name you choose.
Stripe: processes subscription payments as described above, under its own privacy policy.
Service providers: the app is hosted on Hatchable, which stores the database and sends sign-in code emails on our behalf. They process data only to provide that service. Their servers may be outside Canada, which means your information could be subject to the laws of the country where it's stored.
Everyone else: we don't sell, rent or trade personal information. We would only disclose it if required by law, such as a valid court order.
How long we keep it
For as long as you have an account. When you erase your data in the app, it's removed from our live database right away. Our hosting provider may keep backups for a limited time before they expire. When you ask us to close your account, we delete it, along with any remaining data, within 30 days.
Your choices and rights
- See and download your data: in the app, go to Patterns, then Settings, then Download my data.
- Correct it: edit or delete any period or check-in at any time.
- Erase it: Settings, then Erase all my data. This permanently removes every period, check-in, setting (including your support list), product, photo, question and piece of feedback. If you have a paid plan, cancel it separately with Manage billing. We keep your subscription record (plan, status, dates and Stripe IDs) for billing.
- Close your account completely (including your email sign-in): send us a message and we'll do it within 30 days.
- Withdraw consent: you can stop using the app and erase your data whenever you like.
Security
Connections are encrypted (HTTPS), sign-in uses one-time codes or passkeys instead of passwords, and the database only returns your rows to your signed-in account. No system is perfectly secure, so we'll let you know promptly if a breach ever puts your information at real risk, as PIPEDA requires.
Age
Skin by Phase is meant for people 16 and older. If you're younger, please use it only with a parent or guardian's permission.
Not medical advice
Predictions and phase guidance are estimates based on averages and your own logs. They aren't a diagnosis and aren't a form of birth control. See our Terms for more.
Changes
If we make a meaningful change to this policy, we'll update the date above and let you know in the app before it takes effect.
Contact
Questions, access requests or account closure: send a direct message to @lizportugalofficial on Instagram. If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.