Never sold. No ads.
Your health data is stored on your phone.
Here’s exactly how it works.
Where your data lives
Your health data — symptoms, mood, period dates, journal entries — is stored in encrypted storage on your phone, not in an account on our servers. There is no account: no sign-up, no email, no phone number.
When you talk to Pinky, what you ask and the context Pinky needs to answer (such as your life stage and forecast) are sent to our hosted AI service, which answers and does not keep it. The Privacy Policy lists exactly what is sent.
The contrast
Most period trackers upload your data to their servers. Some have shared it with Facebook. Others have been caught selling data to advertisers, data brokers, and even law enforcement.
PinkyBloom never sells your data, shows no ads and works with no data brokers. What you share with a partner crosses our relay as ciphertext we cannot open.
What happens when you pair with a partner
Pair face-to-face by QR code, or remotely with a one-time code. No accounts, either way.
Both phones generate key pairs
Each device creates a Curve25519 key pair — a public key and a private key that never leaves the device.
QR codes scanned in person
You and your partner scan each other's QR codes, exchanging public keys face-to-face. Nothing but public keys is exchanged. Pairing remotely sends those same public keys through our relay.
Shared secret derived via ECDH
Using Elliptic Curve Diffie-Hellman, both phones independently compute the same shared secret — without ever transmitting it.
Stored in iOS Keychain
The shared secret is stored in the iOS Keychain, protected by the device passcode; on Android it is an Android Keystore key, hardware-backed where available. It never leaves the device.
“The trust moment happens face to face.”
How partner sharing works
PinkyBloom encrypts
Your app creates a snapshot — cycle phase, mood, and energy — and encrypts it with AES-256-GCM using the shared secret.
Encrypted blob sent
The encrypted blob is sent to our relay server. The server receives ciphertext it cannot read, decrypt, or interpret.
Blind storage
Our server holds the encrypted blob only until your partner's phone picks it up, then deletes it — after 30 days at most if that phone stays offline. It has no key and no way to determine what the data contains.
PinkyBond decrypts locally
Your partner's app (PinkyBond) downloads the blob and decrypts it on their device using the same shared secret.
“Our server is a mailbox. It passes sealed envelopes it cannot open.”
What your partner sees (and doesn’t)
Shared
Never shared
Safety Mode
One tap sends fake, neutral data to your partner:
Phase: Follicular
Mood: Good
Energy: 3 / 5
No notification is sent. No trace is left. Your partner’s app looks completely normal.
Designed for users who need it — no questions asked.
Want the legal details?
Read our full Privacy Policy →
