SECURITYYour data stays where it belongs. With you.
One simple principle: by default, your cycle data doesn't leave your phone. And when an option does make it transit, it's your choice — we explain everything, no blind spots.
100 % local by default
Cycles, symptoms, contraception, pregnancy: stored in the app's private space, on your device.
Zero trackers, zero ads
No Google Analytics, no Facebook Pixel, no resale.
GDPR + one-tap erasure
Reset from your profile, everything's gone.
Your cycle data: local by default
Periods, symptoms, mucus, pain, mood, contraception, pregnancy: it's all stored on your phone, in the app's private space (isolated from other apps, protected by your device's storage encryption).
By default, NEW GAME has no access to it and no server sees it pass by. That's the whole difference from Flo, Clue or Natural Cycles, who sync everything to the cloud by default, without asking. With us, if you want a backup or a transfer, you enable it (see below).
The one exception, and we own it
You can write to us in-app (bug, idea, question). Those messages — and only those — go to a server, so we can reply.
What transits then: • the content of your messages • an anonymous ID (no link to your identity) • a token to send you the reply
No account, no email, no first name asked. As long as you don't write, nothing is sent.
The idea board goes further: what you post, vote or comment there is public, under your first name (or 'Anonymous'). Only put there what you're willing to make public.
Our subprocessors, the full list
We hide nothing: • Sentry (EU) — technical errors. Receives pseudonymized traces, never your cycle data. • Supabase (US) — hosts the messaging, the idea board, the transfer relay (ciphertext only, unreadable) and the cloud backup if you enable it. Receives your messages, the anonymous ID, and — for cloud backup — an encrypted copy of your cycle data + your email. • Expo (US) — notification delivery. Receives an anonymous token.
Transfers to the US are covered by the EU's standard contractual clauses.
Zero ads, zero trackers, zero resale
We don't live by selling your attention. No Google Analytics, no Facebook Pixel, no advertising identifier. Your data is sold to no one.
Our model: a future, optional paid premium plan. It's all on our Transparency page.
Your GDPR rights, no paperwork
You hold all the classic rights (access, rectification, erasure, portability, objection). • Local erasure: Profile > Reset the app. Everything's gone, in one tap. • Cloud backup: delete it in one tap in the app (Profile > Cloud backup). • Server side (messaging): email hello@plumm-app.com, we delete within 30 days. • Export: your history exports as JSON from the profile.
Not happy? You can file a complaint with the French CNIL (cnil.fr) or your national authority.
And if you change phones?
Two options, both optional and enabled by you:
- Direct transfer — your old phone generates a code, you enter it on the new one, everything moves over. End-to-end encrypted: the server only ever sees ciphertext, unreadable by us. For anyone who wants zero readable data anywhere else.
- Cloud backup — you create an email account, your data is backed up and restorable on a new phone. Handy if you lose your phone. In full honesty: this copy is readable by the server (encrypted in transit and at rest, but not end-to-end) — that's the deliberate trade-off so we can restore it for you.
By default, neither is active.