Privacy policy
Last updated 22 October 2026 · JenX AI Technologies
Draft pending legal review. This page describes how the app is built and will be reviewed by health-data counsel before launch. Every claim below is a statement about the code, not an aspiration — but it has not yet been through external audit, and we will not describe it as audited until it has.
The short version
- What you log stays on your phone, in an encrypted database.
- You do not need an account, an email address or a phone number.
- We do not sell your data. Ads are never targeted using it, and our analytics and crash reporting can only receive a fixed list of event names and counts — never what you log.
- You can export everything and delete everything, from inside the app, at any time.
What stays on your device
Your cycles, periods, symptoms and their severities, notes, medications, measurements, and any condition you have told the app about. All of it is stored locally in an SQLite database encrypted with SQLCipher. The encryption key is generated on your phone on first run and kept in the iOS Keychain or the Android Keystore. It is never transmitted and is not derived from anything we hold.
The app works with no network connection at all, from install through to producing a doctor report.
What we store, and what we can read
| What | Why | Can we read it? |
|---|---|---|
| An anonymous device identifier | So the app can talk to our server at all | Yes — it identifies a device, not a person |
| Your locale, platform and app version | Support, and knowing which builds are in use | Yes |
| Your encrypted backup, if you turn backup on | So you can restore onto a new phone | No. It is encrypted on your phone with a key wrapped by a recovery phrase only you hold |
| An encrypted doctor report, if you create a share link | So a clinician can open it in a browser | No. The decryption key travels in the link's fragment, which browsers never send to us |
| Product analytics and crash reports, from a fixed list of events | To know which screens are used and where people get stuck | Yes — they carry counts and screen names, never symptoms, severities or dates |
| An email address, only if you sign in | To attach a backup to an account | Yes |
Backups, and what losing your recovery phrase means
Backup is optional and off until you turn it on. When you do, your data is encrypted on your phone before it is uploaded, using a key wrapped by a 12-word recovery phrase that is shown to you once and never leaves your device.
That means we cannot read your backup — and also that we cannot recover it for you. If you lose the phrase and the phone, the backup is unreadable by anyone, including us. We would rather say that plainly than hold a key we could be compelled to use.
Analytics and advertising
Aali shows ads, and they are never targeted using your health data. Every ad request is marked non-personalised, so Google serves them without building a profile from anything you do in Aali. We do not sell your data. No attribution or tracking SDK is in the app — not Meta, not TikTok, not AppsFlyer, not Adjust.
Where ads appear is a deliberately short list: the Me tab only. There are no ads on Today, the calendar, the logging sheet, Insights or the doctor report, and none interrupt you while you are recording how you feel. A test in our build fails if anyone ever puts one there. Subscribers to Aali Plus see no ads at all.
Aali does use two Google services: Firebase Analytics for product metrics and Firebase Crashlytics for crash reports. Both are limited to a fixed list of events — things like "the insights screen was opened" or "a log with four entries was saved" — and that list carries counts and screen names only. It cannot carry a symptom, a severity, a date, a note or anything else you log. The list is enforced in the app and again on our own servers, and an event carrying anything else is refused rather than trimmed.
Crash reports contain stack traces and device information, which is what makes a crash fixable. They do not contain the contents of your encrypted database, because the app cannot read it into a crash report any more than our servers can read it.
We do not run ads in Aali and do not plan to.
Where data is stored
Our servers are in the regions required by the laws that apply to you, including the UAE Personal Data Protection Law, India's Digital Personal Data Protection Act 2023, the UK and EU GDPR, and United States state health-privacy laws such as Washington's My Health My Data Act. Because what we store is an anonymous account row and ciphertext, residency is a question of which bucket the bytes sit in rather than a question about your health information.
Legal requests
We will resist requests for reproductive-health data wherever the law allows, and we publish a transparency report. In practice we have very little to give: we cannot decrypt a backup or a report, and we do not hold cycle data at all.
Your choices
- Use Aali with no account. This is the default path, not a setting you have to find.
- Export everything. Me → Privacy centre → Export, as CSV or JSON. Free, complete, no limit.
- Delete everything. Me → Privacy centre → Delete everything. This erases the local database and the key that protects it, and tells our server to destroy what it holds. Anything on our side, including backups and replicas, is gone within 30 days.
- Delete without the app, for example if you no longer have the phone: see aali.life/delete-account.
Children
Aali is not intended for children under 13, and we do not knowingly collect data from them.
Changes
If this policy changes in a way that affects what we store or who can read it, we will tell you in the app before the change takes effect.
Contact
Privacy questions: privacy@aali.life. A person replies — not a bot.