Last updated 6 September 2026
Everything you track stays on your phone, unless you choose to share part of it with somebody you invite. We cannot see anything you have not shared.
Koko is a period and cycle tracking app. For UK data protection law we are the data controller for the limited personal data described below. Contact us about privacy at help.koko@outlook.com.
As of this version:
The app stores what you choose to record, in a database on your phone. Depending on what you use, that can include:
This is special category data under UK GDPR, which deserves the highest level of protection. Our approach is not to collect it: it is written to your device and stays there.
We have no ability to access, read, recover or restore anything you have not shared. If you lose your phone or delete the app, it is gone. That is a deliberate trade in favour of your privacy, and you should know about it.
You can invite somebody into your circle so they can see where you are in your cycle. This is the only feature that sends anything about your cycle off your phone, and it never happens on its own.
Nothing is shared until you invite somebody and they accept. Everyone starts able to see only your current phase, and every other detail is off until you turn it on for that person.
Permissions are held per person, so you can share different things with different people. For each person you can allow:
Your phone works out what each person is allowed to see before anything is sent, and sends only that. If you have not allowed somebody to see your symptoms, your symptoms are never sent for them at all, rather than sent and hidden.
What you do share is stored on our servers, run by Supabase in London, so the person you shared it with can read it. It is a summary rather than your records: the phase, day and dates described above, and the symptoms you allowed. Your full history, your body signals and anything you have not shared never reach us.
Be clear-eyed about this part: information you share is on our servers, so unlike everything else in the app, we could technically access it. We do not look at it, and it is protected so that only the person you chose can read it, but we will not tell you we cannot see something we could.
Turning a permission off deletes what that person could see, rather than only stopping future updates. Removing somebody from your circle deletes everything shared with them. Either takes effect straight away.
The people in your circle are identified to us only by their account identifier. The name you give somebody is stored on your phone and is never sent to us or to them.
Our lawful basis is your explicit consent, given each time you invite somebody and each time you turn on a permission for them. You can withdraw it at any time by turning the permission off or removing them, and doing so deletes the data. We keep a shared summary only while the connection exists.
If you use Send feedback in Profile, we receive:
Nothing about your cycle, your symptoms or your predictions is attached. Only what you typed.
This is delivered and stored through Google Forms, acting as our processor, and may be processed outside the UK under Google’s standard safeguards.
Please do not put health information in the message box. We do not need it, and it would place information in our records that would otherwise never leave your phone.
Our lawful basis is your consent, given by choosing to send the message. We keep feedback for up to 24 months, then delete it.
One relief exercise can show a live view from your front camera, so you can see your own posture while you move, like a mirror.
Nothing is recorded, captured, photographed, saved or sent. The image exists only on screen while that exercise is open, and the app contains no code capable of taking a photo or a video.
You can decline camera access and the exercise still works, and you can withdraw it at any time in iOS Settings.
If you allow notifications, the app can remind you to log, or tell you a period may be due. These are local notifications scheduled by your own device. No server is involved and no notification content reaches us.
Creating an account stores one thing about you: the identifier you signed in with. It is held by Supabase, who run our authentication on our behalf, on servers in London. Nothing else about you is sent when you sign in.
You can sign in with an email address or with Apple. If you use Apple, we receive whatever Apple chooses to give us, and you may tell Apple to hide your real address, in which case we only ever see a relay address and never learn your own. We are not told anything else about your Apple account.
We use that identifier only to sign you in and, if you ever ask us something, to reply to you. It is never used for marketing and never shared. The lawful basis is performance of a contract: you cannot have an account without an identifier for it.
An account does not move your health data off your phone. Your cycles, symptoms and notes stay on this device exactly as before.
Deleting your account deletes the identifier we hold. Because your health data was never uploaded, deleting the app removes all of that at the same time.
Neither is available yet. If we add them, each would be something you switch on, never something enabled on your behalf, and you would be told exactly what would leave your device before you turned it on.
Backup or sync would store an encrypted copy of your entries with our hosting provider so you could restore them or use more than one device. Until then, this does not happen and there is nothing to opt out of.
Sharing with a partner or friend used to be described here as something that might arrive later. It has arrived, and it has its own section above.
Koko counts how its own features are used, so we can see which parts work and which are being given up on. An earlier version of this policy said there was none of this at all, and that promise was kept until it changed: this section was written before the feature shipped, not afterwards.
What is counted is whether something happened, never what it contained. For example:
Nothing about your cycle is ever included. No symptoms, dates, predictions, notes or anything you have shared. No name, no email address, and nothing tied to your account, so the counts cannot be traced back to you.
You can turn this off in Profile, under Usage data. It stops immediately rather than at the next time you open the app.
Two companies handle this for us as our processors: PostHog for feature counts and Sentry for crash reports. Both are configured to store the data in the European Union, so it does not leave Europe. Our lawful basis is our legitimate interest in knowing whether the app works, which is why you can object to it with a single switch.
There is still no advertising, no attribution service, and no tracking of you across other apps or websites. We do not profile you, and we do not sell or share your data.
Koko offers an optional paid subscription. Payment is handled entirely by Apple through your App Store account.
We never see or receive your card details, billing address or payment information. Apple tells us only whether an active subscription exists.
Koko is not intended for children under 13. We ask for your date of birth during setup to check this. If you are under the age at which you can consent for yourself where you live, you should have a parent or guardian’s agreement before using the app.
Under UK data protection law you have the right to access, correct, delete, restrict, object to and port your personal data, and to withdraw consent at any time.
Those rights apply to data we hold, which today is only the feedback described above. Email help.koko@outlook.com and we will respond within one month.
For everything the app stores on your phone you already have complete and immediate control without asking us: it is all visible in the app, you can edit or delete any entry, and deleting the app removes all of it. We cannot action a request about that data on your behalf, because we cannot reach it.
Your data is protected by your device’s own security: your passcode, Face ID or Touch ID, and the iOS sandbox, which stops other apps reading our database. We strongly recommend keeping a passcode set, because an unlocked phone gives anyone holding it the same access you have.
Because your health data is never transmitted, it cannot be intercepted in transit or exposed in a breach of our systems.
If we change this policy we will update the date at the top and, where the change is significant, tell you in the app before it takes effect.
Any future change that would cause health information to leave your device will be introduced as something you are asked to turn on, not something enabled on your behalf.
If you are unhappy with how we have handled your data, please tell us first at help.koko@outlook.com.