Flody Privacy Policy
Gymwork Inc. ("Gymwork", "we", "us") provides the Flody period-tracking mobile application and related services (together, the "Service"). This Privacy Policy explains what information we process, why, where we store and transfer it, who we share it with, and the rights you can exercise.
This is the international version of our Privacy Policy. If you are in the Republic of Korea, the Korean-language version applies to you.
1. Who is responsible for your data
- Controller: Gymwork Inc.
- Representative: Juyong Kim
- Address: 24, Nambusunhwan-ro 351-gil, Gangnam-gu, Seoul, Republic of Korea
- Email: support@gymwork.pro
- Phone: +82-70-8065-0420
2. Information we process
What we process depends on the features you use and the permissions you grant.
2.1 Account and profile
- Guest account identifier and session information
- Identifiers, email address and name passed to us by Apple or Google when you sign in
- Profile information you enter or set: nickname, birth year, gender, height, average cycle length, average period length, last period start date, language, country and time zone
2.2 Period and health records (special category data)
The following records you enter in the Service are health data. We process them only with your consent and only to provide the Service.
- Period start and end dates and flow
- Symptoms, mood, notes, basal body temperature, body weight
- Birth-control pill intake and reminder time, contraception method, sexual activity, vaginal discharge
- Ovulation test and pregnancy test results
- Predictions the Service derives from these records, such as the estimated next period date and fertile window
The current version of Flody does not read from or write to the device health apps (Apple Health, Android Health Connect). If we add such an integration, we will explain it and ask for your consent on that feature's permission screen.
2.3 Payment and subscription
- Product identifier, subscription status, whether a free trial was used, purchase, renewal and restore results, and transaction identifiers
Actual payment details such as card numbers are processed by the Apple App Store or Google Play. We never receive or store them.
2.4 Device, usage and support
- Device type and model, operating system and app version, language, time zone, app installation identifiers (iOS identifier for vendor, Android app set ID), push notification token
- Access timestamps, IP address, request/response and error logs, screen navigation and feature usage records
- Support enquiries, your email address and our correspondence with you
3. How we collect information
- Directly from you during sign-up, onboarding, record entry or support contact
- Automatically generated logs and technical information produced by your device and our servers
- From third parties such as the Apple App Store, Google Play, Sign in with Apple or Google sign-in
4. Why we process your data, and our legal basis
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under Article 6 (and, for health data, Article 9) of the GDPR.
| Purpose | Legal basis |
|---|---|
| Creating and authenticating your account, keeping you signed in | Performance of a contract (Art. 6(1)(b)) |
| Storing and displaying your period records, calculating predictions such as the next period date and fertile window, and sending reminders based on your records | Your explicit consent (Art. 9(2)(a)), given when you start recording |
| Verifying purchases, providing subscription benefits, restoring purchases and support | Performance of a contract (Art. 6(1)(b)) |
| Fault detection, security, fraud prevention, quality improvement and aggregate statistics | Our legitimate interests (Art. 6(1)(f)) |
| Responding to enquiries, sending essential notices and meeting legal obligations | Legal obligation (Art. 6(1)(c)) and legitimate interests |
We do not use health information for targeted advertising, advertising profiling or data brokerage, and we do not sell it.
You may withdraw consent at any time by deleting your records or your account, or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and the related features may stop working.
5. Storing health data, and the nature of predictions
To provide multi-device use, backup and prediction, the period and health records you enter are transmitted over encrypted connections to our servers, where they are stored and processed. Flody's records therefore do not remain solely on your device.
6. Sharing and processors
We do not sell or rent your personal data. The following categories of providers process data on our behalf so we can operate the Service:
- Apple and its affiliates: Sign in with Apple, App Store payments and subscriptions, push notifications and operating system features
- Google and its affiliates: Google sign-in, Google Play payments and subscriptions, push notifications (Firebase Cloud Messaging)
- Microsoft (Azure) and cloud infrastructure providers: servers, databases, backup, security and operations
- Error monitoring provider (Sentry): app error and crash reports, including pseudonymous account and app installation identifiers. Automatic collection of direct identifying information is disabled.
Usage records (screen navigation and feature events) are processed in analytics systems operated by Gymwork itself.
We assess the privacy and security standards of processors and bind them by contract to purpose limitation, safeguards, sub-processor management, and return or deletion on termination.
We may also disclose personal data where permitted by law: where you have consented or requested disclosure; in response to a lawful request by a court, law-enforcement or supervisory authority; where necessary to protect the rights, property or safety of Gymwork or users or to prevent abuse; or in connection with a merger or transfer of the business, in which case we will give prior notice as required by law.
7. International transfers
Our servers run in Microsoft Azure's Japan region, and some providers process data outside your country.
| Recipient | Country | Data | Purpose | Retention |
|---|---|---|---|---|
| Microsoft Corporation (Azure) | Japan | Account, profile, period and health records, subscription and device data listed in Section 2 | Servers, databases and backups | Until account deletion or end of the processing agreement |
| Functional Software, Inc. (Sentry) | United States | App error and crash logs, pseudonymous account and app installation identifiers, device and app version | Error detection and reliability | Until the purpose is fulfilled (at most 90 days) |
| Apple Inc. / Google LLC | United States and the regions each operates in | Sign-in identifiers, subscription and transaction identifiers, push tokens | Sign-in, payments, push notifications | Per each provider's policy |
Where required, we rely on the recipient's adequacy status or on standard contractual clauses and supplementary measures. You can object to optional transfers by not using the related feature or by deleting your account; the Service may then be limited.
8. Retention
We keep personal data for as long as needed for the purposes described above. When you delete your account, sign-in connections, sessions and social sign-in identifiers are removed immediately, but the items below are kept with restricted access so we can handle support requests and disputes. For full deletion, email support@gymwork.pro; we then delete or de-identify everything except data we must keep by law.
- Account, profile, period/health records stored on our servers, and device/subscription data: while your account exists, and after deletion for as long as needed to handle support requests and disputes (deleted or de-identified on request)
- Subscription and transaction records: while your account exists, and for the periods required by law
- Support records: as needed to handle enquiries and disputes
- Security and access logs: as needed for security and abuse prevention
- Backups: retained in restricted form until the backup rotation cycle ends, then deleted
Where law requires longer retention (for example records of contracts, payments or consumer disputes under Korean e-commerce law: 5 years / 5 years / 3 years), we keep the data separately for that period only.
9. Deletion
When the retention period ends or the purpose is fulfilled, we destroy personal data using methods that make recovery impracticable. Electronic files are securely deleted; paper documents are shredded or incinerated. Data remaining in backups is deleted according to the backup cycle and is not used for ordinary purposes until then.
10. Your rights
- Confirm whether we process your data, and access it
- Correct or complete inaccurate data (you can edit profile and records directly in the app)
- Request deletion or restriction of processing
- Withdraw consent to health-data processing and opt out of notifications (notification permission can be changed in your device settings)
- Where applicable, data portability and the right to object, and the right to lodge a complaint with your supervisory authority
To exercise your rights, use the app settings or email support@gymwork.pro. We will verify your identity and respond within the time required by applicable law. We may ask an agent or legal representative to prove their authority.
11. Account and data deletion
You can delete your account directly in the app under Settings > Delete account, or request deletion by emailing support@gymwork.pro. Once deletion is complete, sign-in connections and sessions are revoked immediately, social sign-in identifiers are removed, and you can no longer access your records in the app. Period/health records, profile, and device/subscription data stored on our servers are kept with restricted access so we can handle support requests and disputes. If you ask for full deletion, we delete or de-identify that data except for data we must keep by law, and confirm the result by email.
Deleting your account does not cancel an app-store subscription. To stop a paid subscription, cancel it separately in the App Store or Google Play subscription settings.
12. Children
The Service is not directed to children under 14 (or the higher age required in your country), and we do not knowingly collect personal data from such children without parental consent. If you believe we have collected such data, please contact support@gymwork.pro and we will take appropriate action.
13. Security
- Encryption in transit (TLS) and access control
- Hashed credentials, least-privilege access and separation of secrets
- Restricted access to logs, backups and systems, with anomaly monitoring
- Minimised staff access, training and internal procedures
No transmission or storage system is completely secure. Please also keep your device locked, updated and your account protected.
14. Tracking and advertising
Flody contains no advertising SDK and does not collect advertising identifiers for advertising purposes. We process only the minimum device and usage information needed for reliability, security, subscription verification and product improvement.
15. Changes to this policy
We may update this policy to reflect changes in law, the Service or our processing. For material changes we will give advance notice in the app, on this page or by other reasonable means, stating the effective date and the reason.
16. Contact
- Data protection officer: Juyong Kim, Gymwork Inc.
- Email: support@gymwork.pro
- Phone: +82-70-8065-0420