1. Introduction

Welcome to ReglFit. This Privacy Policy explains how EgnaFlex Inc. ("EgnaFlex", "we", "our", or "us") collects, uses, stores, and protects your personal data through the ReglFit mobile application and our website www.reglfit.com ("ReglFit Services").

By using ReglFit Services, you agree to this Privacy Policy. Your trust is important to us, and we are committed to protecting your sensitive health data with the highest security standards.

2. Data We Collect and Purpose

a) Identity and Account Information

• Full name
• Email address
• Date of birth / Age
• Encrypted password (via Firebase Authentication)

Purpose: To create and manage your account, enable login, and personalize your health insights. This information is required for authentication and is not covered by end-to-end encryption.

b) Health and Cycle Data (E2EE-Protected)

• Menstrual start and end dates, bleeding duration and intensity
• Ovulation and PMS periods
• Daily logs of mood, symptoms, energy, sleep, pain, etc.
• Health issues, birth control method and program
• Personal notes and user-generated entries

Purpose: To help you understand your menstrual cycle, predict patterns, and provide tailored health recommendations. This data is processed entirely on your device and, if you enable cloud backup, is sent to our servers only in encrypted form (see Section 3).

c) Device and Technical Data

• IP address, device model
• Operating system and version
• App usage statistics (anonymous where possible)
• Crash reports and error logs
• Push notification tokens

Purpose: To improve app performance, provide technical support, and detect/prevent potential issues. Sensitive health content is not included in analytics.

d) Optional Sharing Preferences

• Research, analytics, recommendations, and advertising consent

3. End-to-End Encryption (E2EE), Zero-Knowledge, and Data Storage

How E2EE Works

• Encryption on device: Sensitive health data (daily tracking, health issues, birth control, notes, cycle results, etc.) is encrypted on your device using AES-GCM-256 before being stored locally or in the cloud.
• Data Encryption Key (DEK): A unique encryption key is generated for your account and stored only on your device in platform secure storage (Android Keystore / iOS Keychain). We never receive or store this key in plain form.
• Cloud storage: When you enable cloud backup, only encrypted data is sent to our servers (Firebase Firestore). We store and transmit encrypted blobs; we cannot decrypt or read your health content.

Data Storage Systems

• Firebase Firestore: Stores encrypted health data (ciphertext only). Used for optional cloud backup and sync. We cannot access the plaintext content.
• Firebase Authentication: Secure login and password management (email, UID). Necessary for account access and is not E2EE-covered.
• Hive (local): Encrypted database on your device (AES-256). Keys are derived from your DEK. Data remains on your device.
• Recovery code (optional): If you use the recovery feature, a backup of your encryption key is stored in Firestore encrypted with your recovery code. Only you can restore access with that code.

4. How We Use Your Data

Cycle tracking, predictions, and health insights are generated on your device; we do not process your health or cycle data on our servers. We use your data only as follows:

• To track menstrual cycles and offer health insights (on your phone)
• To send reminders and personalized notifications
• To generate AI-driven suggestions (processed on your device where applicable)
• To improve user experience and app functionality (using anonymized/aggregated data where possible)
• To conduct research (only with your explicit consent)

5. Data Sharing and Disclosure

Legal Compliance

Shared with government authorities when required by law

Research Collaboration

Only with your consent, for scientific health studies

Service Providers

(e.g., Firebase, Mailgun) solely to deliver essential app services

6. Your Rights

You have the following rights regarding your personal data:

• Access your data
• Request correction
• Request deletion (via "Delete My Account" feature)
• Request data portability
• Withdraw consent for optional data use

To exercise any of these rights, contact us at 📧 support@reglfit.com.

7. Child Safety

ReglFit is not intended for individuals under 13. Users under 18 must have parental or guardian consent. Paid services are only for users aged 18 or older. Any data we discover to have been provided without appropriate consent will be promptly deleted.

8. Data Retention

• Data is retained as long as your account is active.
• Upon account deletion, all personal data is permanently erased.
• Local data is deleted when the app is uninstalled.

9. Notifications and Permissions

• Notifications are sent only if enabled by the user
• Notification settings can be managed via system preferences
• Users can export or delete all personal data at any time

10. Security Measures

• End-to-end encryption (E2EE): Sensitive health data is encrypted with AES-GCM-256 on your device; only you hold the keys.
• Zero-knowledge architecture: We do not have access to your decryption keys or the plaintext of your health data.
• App lock: Optional biometric (Face ID / Touch ID / fingerprint) or PIN/password lock to protect app access.
• Recovery code: Optional recovery code lets you restore your encryption key on a new device; the key backup is stored encrypted and is only usable with your code.
• Encrypted sessions with Firebase Authentication
• SSL/TLS for all data in transit; secure storage (Android Keystore / iOS Keychain) for your encryption key
• Firestore security rules so only you can access your data; no third-party access to your health content

11. Changes to This Policy

We may update this Privacy Policy from time to time. All changes will be announced via our app and website. Updates become effective on the date of publication.

Contact

For privacy inquiries, contact us at: 📧 support@reglfit.com