Privacy Policy
Short Version: Your cycle entries stay on your device. Here is the detail, including the parts that are less flattering to us.
Last Updated: October 23, 2026 · Ebb is Operated by LYF Mail (lyfmail.com).
1. What Stays On Your Device?
Everything you log (period dates, flow, symptoms, mood, notes, settings) and your identity keys are stored locally in your browser’s IndexedDB. We do not operate a database of cycle entries, and your entries are not uploaded to our servers.
2. What Our Server Handles?
- Web Requests. Like any website, our web server receives your IP address, the page requested, the time and your browser’s user-agent. These standard access logs are used for security and troubleshooting and kept only as long as needed for those purposes.
- Sign-in Session. When you create or restore a local identity, the app starts a session using one functional cookie (
ebb_session: HttpOnly, Secure, SameSite=Strict, expires after about 2 hours of inactivity). The session holds your pseudonymous ID, public key and display name so protected pages can load. - Security Log. The app records sign-in, restore and sign-out events with a timestamp, IP address and your chosen display name to help detect abuse. It does not contain cycle data.
- Partner Sync Signaling. To connect two devices, short connection-setup messages pass through our server and are discarded after roughly 30 seconds. They contain no cycle entries; shared data travels directly between devices.
3. Cookies, Analytics and Ads
This site contains no advertising and no analytics. The public pages (home, features, FAQ, legal and information pages) set no cookies. The only cookie is the functional session cookie described above.
4. Third Parties
- The public pages load nothing from third parties.
- Some in-app pages may still load styling or fonts from third-party CDNs (such as Tailwind CSS or Google Fonts), which means those providers can see your IP address when the page loads. We are moving these to our own server.
- Partner Sync uses public STUN servers (currently operated by Google) so browsers can discover how to reach each other. Those servers see your IP address when you use that feature.
5. Sharing and Sale
We do not sell, rent or trade personal information. We do not use your data for advertising or profiling. We may disclose server-side information only if legally required; because we hold no cycle entries, there are none to produce.
6. Your Choices
- Delete your data at any time in Settings, or by clearing site data in your browser.
- Export your data (PDF, CSV or QR) whenever you like.
- Choose an automatic retention period.
- Ask us about server-side logs relating to you at ebb@lyfmail.com.
7. Security
Pages are served over HTTPS with a strict Content-Security-Policy and other protective headers. No system is perfect. Please protect your device with a screen lock, since anyone with access to your unlocked device can open data stored in its browser.
8. Children
Ebb is not directed at children under 13, and we do not knowingly collect their information.
9. Changes
If we change this policy we will update the date above and, for material changes, highlight it on the site.
