We graded ourselves against Mozilla’s own standard — on purpose.

We use one product analytics tool (PostHog) to understand how people use the general, non-health parts of the site. It runs on an allowlist, not a blocklist: the code enumerates exactly which pages are ever tracked — things like the homepage and the rewards page — and every page where you view or enter health information (assessments, the cycle tracker, the maternity companion, labs, your account) is excluded by default, the same way a route we haven’t written yet would be excluded by default too, not just the ones we remembered to block. That exclusion covers individual education articles and supplement pages too — the article title itself is health information — so only the general education and supplements hub pages are ever tracked, never a specific article or stack. No ad SDKs exist anywhere in our code — this is a scoped analytics vendor, not an advertising one, and it never receives anything from a health page. That’s a real, meaningful difference from Euki’s zero-analytics baseline, and we’d rather say so plainly than claim parity we don’t have.

Structurally true, not just promised — there’s no ad-tech vendor relationship anywhere in our stack a data-broker deal could even run through.

We don’t collect geolocation anywhere in the app — the exact signal that made Spot On’s provider-search leak so damaging. Nothing in our systems could place someone at a clinic. That includes PostHog, our analytics vendor: it derives country/city-level location from IP address by default, so we explicitly turned that off rather than leave it as an unmentioned side effect of adding an analytics tool.

Our privacy policy names Washington’s My Health My Data Act specifically, explains what legal process we can and can’t resist, and commits to notifying you when legally possible — more specific than the boilerplate most apps in this category use.

Washington’s My Health My Data Act requires collection and sharing consent as “separate and distinct” affirmative acts, not one bundled checkbox most apps use. We built it that way, with every consent event tied to the exact policy version shown at the time.

A real, working data export — assessments, cycle logs, mood check-ins, maternity data, lab requests, all in one readable file, from your Account page any time. Account and data deletion available on request.

You don’t need an account to use the cycle tracker. Log without signing in and your entries stay on your device, genuinely — nothing is sent to us until you decide to save. If you sign in later, you’re offered the choice to bring that local data into your account, rather than losing it silently.

Encryption in transit and at rest are standard across our infrastructure. On top of that, the specific content of self-assessment answers and mood check-ins — including anything mental-health related — is encrypted a second time at the application layer, so even direct database access exposes only ciphertext, not readable answers.

Our crash-reporting tool is configured to never receive your IP address, cookies, or request data by default, and to scrub known-sensitive field names out of anything it does capture — the kind of unscrubbed side channel that Mozilla’s methodology is specifically built to catch, closed before it could ever leak anything.

A published, monitored security.txt gives security researchers a real way to reach us in good faith — one of Mozilla’s five baseline Minimum Security Standards.

This is the one honest gap left, and it’s architectural, not a mistake. Data you save to your account lives in one database, tied to your account — the shape Mozilla’s own framing calls higher-risk by default, because a centralized record is the thing that could theoretically be sold, breached in bulk, or subpoenaed. We built it this way on purpose, because it’s what lets you sync across devices, get a follow-up if an assessment result is concerning, and use the maternity companion the way it works today — and we’ve encrypted, minimized, and rights-protected that data as much as a centralized model reasonably allows. But it’s not the same as never having the data at all, and we’d rather say that plainly than paper over it.

Our privacy policy is unusually specific for this category, and it says so itself: it’s an accurate description of current practice that hasn’t yet had a formal legal review, given the MHMDA-specific claims it makes. That review is in progress.