Last updated: 13 October 2026
Ovora is a fertility-awareness app built around the Billings Ovulation Method. It records intimate health information, so this page says plainly what is kept, where it goes, and how to destroy it. Everything below describes what the app actually does.
On your device. Your daily observations (sensation, appearance, bleeding, intercourse, temperature, LH test results, notes), the symptoms you log, your cycle history, and your settings — including your goal, charting method, reminder time and language.
On our server (Google Firestore), for every install. A copy of your daily observations and of your profile: your name, settings, goal, cycle details, and your symptom and mood diary. It is encrypted on your phone before it is sent (AES-256), so what reaches the server is unreadable without your key. Each day is stored as its own entry named by its date. That means the server can see which days you logged, and when entries were last updated, but not what you logged. The copy is kept so that a partner can be connected at any time and see your whole chart straight away, and so that Delete everything can remove it.
This copy is not a backup. The key that reads it stays on your phone, so if you lose your phone or delete the app, the copy can't be used to restore your chart. Keep a backup file for that (see Backups).
Your encryption key. It is created on your phone and kept there, protected by the phone's secure storage (the Android Keystore or the iOS Keychain). If you never create a pairing code, it never leaves your phone.
Pairing. When you create a pairing code, a copy of your key, locked with that code, is stored on our server in a pairing record. The record also holds the code itself, your anonymous ID, your partner's anonymous ID once they connect, and when each phone was last active. Our security rules let only the two paired phones read it, so other Ovora users can't get your key. However, because the code is kept alongside the locked key, the pairing record does not stop someone with administrative access to our database (us, or our hosting provider) from unlocking your chart. We do not do this.
An anonymous identifier. Ovora signs your install in to Firebase anonymously. This produces a random identifier that names your documents. It is not linked to your name, email address, phone number, or any account you hold anywhere else.
Nothing else. Ovora does not collect your contacts, your location, your photos, your device's advertising identifier, or your browsing activity.
| What | Where it goes | Why |
|---|---|---|
| Your chart and profile, encrypted | Google Firestore | So a partner can be connected at any time and see your chart (kept for every install) |
| Your encryption key, locked with your pairing code (only if you create a pairing code) | Google Firestore | So your partner's phone can read your chart |
| Anonymous identifier | Google Firebase Authentication | Names your documents so the right phone reads them |
| Subscription status | RevenueCat | Confirms whether Ovora Plus is active |
| Optional crash diagnostics, app milestones and installation identifiers | Google Firebase Crashlytics and Google Analytics | Find crashes and improve onboarding and subscription flows, only if you allow diagnostics |
| App verification and configuration requests | Google Firebase App Check and Remote Config; Apple App Attest or Google Play Integrity | Protect the service and retrieve supported versions, app settings and feature availability |
| Questions you type to the Coach, with a one-line summary of where you are in your cycle | Google Gemini API | To generate an answer |
Questions you send to the Coach are transmitted without your identifier attached, together with a one-line summary of your current cycle phase and goal (for example “post-Peak phase, avoiding pregnancy”). Your logged days themselves are never sent. Nothing is stored by Ovora and nothing is connected back to your chart.
New versions of Ovora ask whether you want to share diagnostics. Collection is off until you allow it. You can change your choice in Settings → Privacy & data → Help improve Ovora. This choice does not affect your chart or subscription.
If allowed, Firebase receives technical crash reports (including stack traces, app version, device and operating-system information), installation identifiers, and basic interaction events: onboarding, first saved log, paywall viewing, and an active trial or paid plan observed by the app. These events do not include cycle days, symptoms, observations, your goal, names, notes, or chat messages. Ovora does not attach its Firebase Authentication identifier to analytics or crash reports. Analytics is not used for advertising or cross-app tracking.
Turning diagnostics off stops new collection, resets the local analytics identifier and deletes unsent crash reports. It does not erase reports already received by Firebase; these remain subject to the provider's retention policies. Likewise, Delete everything removes your chart/account data, not previously submitted aggregate analytics.
Remote Config retrieves public app settings, such as supported builds and feature availability. It does not change your paid entitlement or the price charged by Apple or Google. App Check uses platform attestation to verify that requests come from a registered app; it is separate from optional analytics and remains active to protect the service.
In versions with Settings → Data sources, you may choose to view steps, sleep, weight and recorded period dates from Apple Health on iOS or Health Connect on Android. Access is off until you choose categories and complete the phone's permission screen. You may decline any category and continue using Ovora.
This connection is read-only. Readings are requested while you use the Data sources screen, held temporarily in memory, and displayed on your device. They are not written into your Ovora chart or used to change fertility predictions. They are not sent to your partner, Coach, translation services, diagnostics, analytics, advertising, or our servers; they are not included in Ovora backups. We save only your selected categories locally, not the readings. Ovora does not write or delete records in Apple Health or Health Connect.
Disconnect stops Ovora reading these sources and clears its local choices. On Android it also asks Health Connect to revoke Ovora's permissions. On iOS, revoke system permissions in Apple Health → your profile → Apps → Ovora. You can manage either platform's permissions directly in its health settings at any time. Delete everything also disables Ovora's local connection. Disconnecting or resetting Ovora does not remove the original records stored by Apple Health, Health Connect or the apps that created them.
Health records are never used for advertising, marketing, data brokerage or unrelated profiling. The health platform and source apps retain their own data under their respective policies.
Pairing is entirely your choice and is started by you sharing a code. While connected, the partner device can read your chart. You can disconnect at any time from the connection screen; the link is removed on both devices and the partner's mirrored copy stops updating.
Your partner never sees your notes to yourself, and cannot log or change anything on your chart.
When you explicitly start pregnancy tracking, Ovora stores your entered dating information, dating revisions, pregnancy history, optional outcome, and private check-ins (symptoms, mood, energy and notes) on this phone. These records are encrypted with a separate device-held key that is not shared with a partner. The private diary and outcome are not put in the shared chart mirror, sent to Coach, or included in Analytics or Crashlytics events.
A generic “cycle guidance paused” setting is included in your encrypted shared profile so a linked partner does not continue receiving cycle predictions. Sharing pregnancy weeks and an estimated due date is a separate, optional switch for the current partner link. Turning it off or disconnecting removes that summary from future syncs. A phone that is offline may retain previously received information until it reconnects; already viewed or copied information cannot be recalled.
Illustrations are artistic, not scans or predictions of appearance, development or health. A symbolic rose cradle is the default, with an optional baby illustration. We do not ask for race or infer it from your data. Your illustration preference stays in your private local records.
Pregnancy records are included in an Ovora backup you export. Starting or restoring pregnancy tracking switches automatic file backups off, so you can review the private-diary notice before enabling them again. Backups never restore permission to share your due date with a partner. Use an Ovora backup to move these private records to another phone; a device backup alone may not restore the device-bound encryption key.
Ovora can write a backup file, either when you ask or automatically to a folder you choose. That file is yours: it is written to storage you selected, and Ovora never uploads it anywhere.
Manual backups can be password-protected. Automatic backups are not encrypted — a background task cannot ask you for a password — so choose a folder only you can reach. The app says this where you pick the folder.
Settings → About & data → Delete everything. You type DELETE to confirm. This removes:
It cannot be undone and we cannot recover it. Backup files you have already saved are yours and are not touched — delete those yourself if you want them gone.
Deleting the app without using Delete everything first removes the copy on your phone. If you would like the server copy destroyed as well, use Delete everything before uninstalling, or contact us at the address below.
On iOS, Ovora works with these Apple features. None of them sends your chart to Apple.
Ovora uses three third parties, each only for the function named:
Payment is handled entirely by Apple or Google. Ovora never sees your card details.
Data on your phone stays until you delete it or remove the app. The encrypted copy on our server stays until you use Delete everything. If you remove the app without doing that, the copy stays on the server until you ask us to delete it. We do not keep backups of your chart on our side.
Ovora is not directed at children and we do not knowingly collect data from anyone under 13 (or the equivalent minimum age where you live).
Because your chart is on your device and the server copy is unreadable to us, the most complete and immediate way to access, export or erase your data is inside the app: use Download backup to export, and Delete everything to erase. If you are in a region with statutory data rights and want to exercise them through us instead, write to the address below.
Ovora supports charting. It is not a medical device, does not diagnose, and does not replace a doctor or a qualified Billings Ovulation Method tutor. No app can guarantee the prevention or achievement of pregnancy.
If this policy changes materially we will update the date at the top and note the change in the app's release notes.
Questions about this policy, about the data we hold, or a request to have the server copy destroyed — write to hi@ovora.help and we will answer.