QiFlux · SDK disclosure

SDK · 01 of 05

RevenueCat

Validates Apple StoreKit / Google Play Billing receipts so we know which features to unlock.

Always on · purchases only

Field	Value
Sends	Anonymous UUID (device-level) · purchase receipts · subscription status
Never touches	Cycle data · constitution tags · symptoms · name · email · IP (proxied by Apple/Google)
When	At purchase · at app launch (to refresh subscription status)
Region	US-East · processed under SOC 2 Type II
Toggle	None — required for billing. The data sent is functionally within what Apple/Google can already see.

SDK · 02 of 05

Health SDK (HealthKit / Health Connect)

Two-way syncs your cycle data with Apple Health (iOS) or Health Connect (Android). A pure OS bridge — no external server, the data never leaves the operating system's health database.

Opt-in · OS sync only

Field	Value
Sends	Writes: cycle flow and start dates. Reads: existing MenstrualFlow records. Both stay inside the HealthKit / Health Connect sandbox.
Never touches	Any external server · our cloud backup endpoint (Health data is separate from the backup flow)
When	Only when you enable it in Settings → Health integration
Region	On-device only (OS-controlled)
Toggle	Settings → Health integration → toggle. Off by default.

SDK · 03 of 05

Sentry

Crash reporting. Off by default; requires the user to explicitly turn it on in Settings → Help us improve.

Opt-in · off by default

Field	Value
Sends	Call stack · device model · OS version · app version · breadcrumbs of the last 20 navigation events (screen names only, no data)
Never touches	Cycle data · symptoms · constitution · UI text content · screenshots
When	Only when a crash occurs · only when the user has opted in
Region	Hosted on Sentry.io cloud (SaaS) · opt-in
Toggle	Settings → Help us improve → toggle. Off by default on every fresh install.

SDK · 04 of 05

Sign-in-with-Apple

Used only if you opt into iCloud backup, to bind the encrypted blob to your Apple ID. We never see your email.

Opt-in · backup only

Field	Value
Sends	An opaque user identifier issued by Apple (and a Private Relay email if you choose to use one)
Never touches	Real email (proxied by Apple) · cycle data · device identifiers
When	One time — when you tap "Back up to iCloud" in Settings
Toggle	Settings → Backup → Disconnect, any time

SDK · 05 of 05

google_sign_in (Android only)

Mirrors the role of Sign-in-with-Apple on Android: used only if you opt into Google Drive backup.

Opt-in · backup only

Field	Value
Sends	An opaque user identifier issued by Google · OAuth scope limited to: drive.appdata
Never touches	Drive content outside our app sandbox · contacts · calendar · email content
When	One time — when you tap "Back up to Google Drive"
Toggle	Settings → Backup → Disconnect, any time · revoke access at myaccount.google.com

Cap policy

5 SDKs is a ceiling, not a target.

To add a 6th, we must first remove one of the existing 5. The cap is enforced by CI: scripts/sdk_whitelist_audit.sh fails the build when the network SDK count exceeds 5.