SECURITYYour data stays where it belongs. With you.
One simple principle: by default, your cycle data doesn't leave your phone. And when an option does make it transit, it's your choice, and we explain everything, no blind spots.
100 % local by default
Cycles, symptoms, contraception, pregnancy: stored in the app's private space, on your device.
Zero trackers, zero ads
No Google Analytics, no Facebook Pixel, no resale.
GDPR + one-tap erasure
Reset from your profile, everything's gone.
Your cycle data: local by default
Periods, symptoms, mucus, pain, mood, contraception, pregnancy: it's all stored on your phone, in the app's private space (isolated from other apps, protected by your device's storage encryption).
By default, NEW GAME has no access to it and no server sees it pass by. That's the whole difference from Flo, Clue or Natural Cycles, who sync everything to the cloud by default, without asking. With us, if you want a backup, you enable it (see below).
The one exception, and we own it
You can write to us in-app (bug, idea, question). Those messages, and only those, go to a server, so we can reply.
What transits then: • the content of your messages • an anonymous ID (no link to your identity) • a token to send you the reply
No account, no email, no first name asked. As long as you don't write, nothing is sent.
The idea board goes further: what you post, vote or comment there is public, under your first name (or 'Anonymous'). Only put there what you're willing to make public.
Our subprocessors, the full list
We hide nothing: • Sentry (EU): technical errors. Receives pseudonymized traces, never your cycle data. • Supabase (US): hosts the messaging, the idea board and the cloud backup if you enable it. Receives your messages, the anonymous ID, and, for cloud backup, an encrypted copy of your cycle data + your email. Also keeps a 2-hour fingerprint of your address and your message when you write from the contact form. • Expo (US): notification delivery. Receives an anonymous token. • Resend (US): sends the cloud-backup sign-in emails (your address and the 6-digit code, never your cycle data) and the contact form messages (your first name, your address and your text). • Vercel (US): hosts this site, the waitlist form and the contact form. Receives request logs, and your address if you sign up or write to us.
Transfers to the US are covered by the EU's standard contractual clauses.
Zero ads, zero trackers, zero resale
We don't live by selling your attention. No Google Analytics, no Facebook Pixel, no advertising identifier. Your data is sold to no one.
Our model: a future, optional paid premium plan. It's all on our Transparency page.
Your GDPR rights, no paperwork
You hold all the classic rights (access, rectification, erasure, portability, objection). • Local erasure: Profile > Reset the app. Everything's gone, in one tap. • Cloud backup: delete it in one tap in the app (Profile > Cloud backup). • Server side (messaging): email hello@plumm-app.com, we delete within 30 days. • Export: your history exports as JSON from the profile.
Not happy? You can file a complaint with the French CNIL (cnil.fr) or your national authority.
And if you change phones?
That's what cloud backup is for: optional, and switched on by you alone.
You set it up with your email address, you receive a 6-digit code, and your history is backed up. On the new phone: install Plumm, enter the same address, and you get everything back. Handy too if you lose your phone.
In full honesty: this copy is readable by the server (encrypted in transit and at rest, but not end-to-end). That's the deliberate trade-off so we can restore it for you. You can delete it in one tap, at any time.
By default, it's off. Until you switch it on, nothing leaves your phone: your data stays there and nowhere else. That's the zero-server option. But remember to enable it before changing devices, or your history stays behind.