Privacy Policy

Last updated: October 12, 2026

This policy explains what personal data Kilova collects, why we collect it, and the control you have over it. It covers the Kilova app (on the web at my.kilova.app, on Android, and on iPhone and iPad) and our website, kilova.app.

In short: Kilova uses your data only to run the app for you. We don’t sell it, and the app has no analytics, advertising or tracking tools. Everything you log about your health is optional, and you can export or delete your data at any time.

1. Who We Are

Kilova is run by Paloma Minino, a self-employed founder based in Spain. She is the data controller: the person responsible for your data under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

You can contact us at kilova.app@gmail.com.

2. Information We Collect

2.1 Your Account

Your name and email address.
Your password, which is handled by our login provider, Supabase Auth. We never see it.
If you sign in with Google instead, we receive your name and email address from Google.
If you sign in with Apple instead, Apple shares your email address with us. If you choose to hide your email, this is a private relay address created by Apple that forwards to your real one. Apple shares your name only the first time you sign in. See section 6.4.

2.2 Your Cycle

The start date and length of each period you log.
Your usual cycle length and period length.

2.3 Health Data You Choose to Log

Your flow on each day of your period: light, medium or heavy.
Your symptoms on each day, in 10 categories: body (such as pain or hot flashes), digestion, energy, mood, mind, sleep, cervical fluid, appetite and cravings, skin and hair, and social life and libido.

All of this is optional: we only store what you log. This is health data and, because it can include your libido, also data about your sex life. Your cycle data is health data too. The GDPR calls these “special categories” of data and protects them more strictly. Section 4 explains how we ask for your consent.

2.4 Your Routine Answers

Your Routine is an optional short questionnaire that suggests a routine for you. If you use it, we store your answers and the routine it suggests. Depending on what you answer, they may include whether you are pregnant or postpartum, your allergies and diet preferences, and the kinds of movement you prefer.

We use these answers only to suggest your routine. Some of them are health data, so we ask for your explicit consent (see section 4). They are deleted when you delete your account, and you can ask us to delete them at any time.

2.5 Tasks and Events

The tasks and events you create: title, description, date, time, category, how they repeat (including the phase presets and routines you turn on), whether a task is completed, and any reminders you set.

2.6 Preferences

Your language, your device’s time zone (so your reminders arrive at the right time), time format, first day of the week, and which reminders you want to receive.

2.7 Premium Subscription

Whether you have Premium, its dates and your subscription history, including your 2 free months of Premium. Payments on the web are processed by Stripe. In the iPhone and iPad app, purchases are made with Apple’s In-App Purchase, and in the Android app with Google Play Billing. We never receive or store your card details. We use RevenueCat to manage the purchases made through Apple and Google (see section 5).

2.8 When You Last Opened the App

The date you last opened Kilova, and on which platform (web, iPhone or iPad, or Android). We use it to know whether you are using the app, to improve Kilova, and to decide which emails about Kilova and about getting started to send you (see section 3.3).

Which features you use: we record actions such as creating an event, ticking a task or connecting a calendar, with the date and the platform (web, iPhone or iPad, or Android), never their content. We use this to improve Kilova and delete these records after 12 months.

2.9 Messages You Send Us

If you write to us through a contact form, we receive your name, email address and message.

2.10 No Tracking in the App

The Kilova app does not use analytics, advertising or tracking tools. The date you last opened the app and which features you use (section 2.8) are stored only in our own database. Our website does use some; they are described in section 12.

3. How We Use Your Information

3.1 To Run the App

To show your calendar and your cycle phases, and let you plan tasks around each phase.
To send the reminders you ask for.
To sync with Google Calendar or Outlook, or to add your Kilova calendars to Apple Calendar on your iPhone or iPad, if you choose to (see section 6).
To suggest a routine with Your Routine, if you use it.
To manage your Premium subscription.
To answer your messages.

3.2 Cycle Insights

Cycle Insights shows you statistics calculated only from your own data:

How many days you have symptoms in each phase.
Your most common symptom in each phase.
Your symptoms according to your flow.
The tasks you complete according to your flow.
Which task categories tend to be followed by fewer symptoms.
Task ideas for the days when you usually have a symptom.

This is an automatic analysis made only for you. It has no legal effects and is never shared. It is not medical advice. Kilova is not a contraceptive method or a medical device.

3.3 Reminders and Emails

Reminders on your phone are local notifications: your device schedules and shows them itself, and they are not sent through our servers.
Cycle reminders by email are turned off by default. We only send them if you turn them on, and every one includes a link to unsubscribe.
Account emails: confirming your account, a code to change your password, a notice when your password has been changed, and, if your account has had no activity for almost a year, the notices before it is deleted (section 9; we can’t send them if your email was never confirmed).
Emails about Kilova and about getting started with the app, for example about your free months of Premium. To decide which ones to send, we use the date you last opened the app (section 2.8).

The app does not send marketing emails. We only send our newsletter to people who subscribe to it on our website (see section 12).

3.4 Security

To keep your account secure and prevent abuse of the service.

4. Legal Basis for Processing

Under the GDPR and the UK GDPR, we process your data on these legal bases:

Health data (your cycle, flow and symptoms, and your Your Routine answers): your explicit consent (Article 9(2)(a) GDPR), which we ask for in the app. You can withdraw it at any time by deleting that data or your account, or by writing to us.
Your account, tasks, events, reminders, connected calendars and subscription: our contract with you, because we need this data to provide the service you signed up for.
Security and preventing abuse, including keeping a hash of the email of deleted accounts so the free months of Premium are only given once: our legitimate interest in keeping Kilova safe and fair for everyone.
The date you last opened the app, which features you use, and emails about Kilova and about getting started: our legitimate interest in knowing whether and how Kilova is being used, improving it, and helping you get started.
Our newsletter, and the analytics and advertising tools on our website: your consent.

We don’t sell your data, and we don’t share it with anyone for their marketing. We use these service providers to run Kilova. They process your data only on our behalf and for these purposes:

Supabase: our database and account system. Its servers are in the United States (US West region).
Stripe: payments on the web.
Google: signing in with Google, and Google Calendar if you connect it.
Apple: Sign in with Apple, if you use it.
Microsoft: Outlook calendar sync through Microsoft Graph, if you connect it.
Resend: sending account emails and cycle reminder emails.
Apple (App Store) and Google (Google Play): distributing the apps and processing in-app purchases and subscriptions (Apple In-App Purchase and Google Play Billing), under their own terms and privacy policies.
RevenueCat: managing the purchases made through the App Store and Google Play. It receives your Kilova user ID and the purchase and subscription data from Apple and Google. It doesn’t receive your email address or any of your health data.
Netlify: hosting our website and the web app, and receiving the messages sent through the contact form on our website.

The services used only on our website are listed in section 12.

We may also disclose information if the law requires it, or to protect the rights and safety of Kilova, its users or the public.

Connecting Google Calendar is optional. If you connect it, Kilova:

Creates a calendar called “Kilova” in your Google Calendar and adds your cycle phases and your Kilova tasks and events to it.
Imports your Google Calendar events into Kilova and gives each one a category automatically, using a keyword analysis on our server.

When you disconnect Google Calendar, syncing stops.

If you sign in with Google, we only receive your name and email address.

Kilova’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6.2 Outlook (Microsoft)

Connecting your Outlook calendar is optional and part of Premium. Kilova connects through Microsoft Graph, with the permissions you approve at Microsoft. If you connect it, Kilova accesses:

The events in the “Kilova” calendar in your Outlook account, to keep your cycle phases and your Kilova tasks and events in sync in both directions.
The events in your default calendar, to import them into Kilova.
Your mailbox settings, to add color categories for your cycle phases.
Your account’s email address, to show which account is connected.

To keep syncing, we store the access and refresh tokens that Microsoft gives us. When you disconnect Outlook or delete your account, we remove them and syncing stops.

6.3 Apple Calendar on iPhone and iPad

Adding Kilova to Apple Calendar is optional and part of Premium. With your permission, Kilova creates its own calendars on your device, named “Kilova · " followed by the phase, and writes to them through the iOS Calendar. Kilova reads only its own calendars. Nothing from Apple Calendar is uploaded to our servers.

If you sign in with Apple, Apple shares your email address with us, which may be a private relay address that forwards to your real email, and your name only the first time you sign in. When you delete your account, we also ask Apple to revoke the link between your Apple ID and Kilova.

7. International Data Transfers

Kilova is run from Spain, but some of our providers, including Supabase, Stripe, Google and Resend, process data in the United States. For these transfers we rely on the safeguards these providers offer, such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

8. Data Security

Your data is encrypted in transit (TLS) and at rest (AES-256).
Access to personal data is limited to what is needed to run Kilova.
Our database provider, Supabase, is independently audited (SOC 2 Type 2).

No system is 100% secure, but we work hard to protect your data.

9. How Long We Keep Your Data

While your account is active, we keep your data so the app can work.
When you delete your account (from the app or the web), all your data is deleted from our database immediately: your cycle, flow, symptoms, Your Routine answers, tasks, events, settings and calendar connections. If you signed in with Apple, we also ask Apple to revoke Kilova’s access.
After a deletion, we keep only a one-way hash of your email address: a code from which your email can’t be read back. We don’t keep your account ID, the reason for the deletion or any other data. We use it only to recognize if the same email signs up again, so the 2 free months of Premium aren’t given twice. We keep it for 2 years after the deletion, then it is deleted automatically.
Deleting your account doesn’t cancel an App Store or Google Play subscription. Cancel it in your Apple ID or Google Play settings.
Inactive accounts: if your account has no activity for 12 months (you don’t open Kilova or sign in), it is deleted automatically with all its data, the same way as when you delete it yourself (Kilova’s events are also removed from a connected Google or Outlook calendar). We email you 30 days before with the date, a reminder about 2 weeks before and a last one the day before, and opening Kilova before that date is enough to keep it. If you signed up with an email you never confirmed (and not with Google or Apple), we can’t reach you, so the account is deleted after 12 months without activity with no emails. This doesn’t apply to Premium accounts. After the deletion we keep nothing else, only the hash of your email described above, for 2 years. If you signed in with Apple, we can’t ask Apple to revoke Kilova’s access without you: you can remove it in your Apple ID settings.
We don’t keep separate backup copies of our database, so deleted data can’t be recovered.
Some information may be kept longer if the law requires it.

10. Your Rights

You can do most things yourself, directly in the app:

Export your data from Account, then Export data, as a CSV or PDF file. It includes your cycles, flow, symptoms, tasks and events, settings and insights. We ask for your password first, to protect your data.
Correct your information, such as your periods, tasks and events.
Delete your account at any time: in the app from Profile, then Account, then Delete Account, or on the web.

Under the GDPR and the UK GDPR you also have the right to access, correct and delete your data, to restrict or object to how we process it, to receive it in a portable format, and to withdraw your consent at any time. Withdrawing consent doesn’t affect anything we did before you withdrew it. To exercise any of these rights, email us at kilova.app@gmail.com. We’ll reply within one month.

If you think we haven’t handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es. If you’re in the UK, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. You can also contact the data protection authority of the EU country where you live.

11. Age Requirement

You must be at least 16 years old to use Kilova. We don’t knowingly collect data from anyone younger. If you believe someone under 16 has created an account, contact us and we’ll delete it.

This section applies only to our website, kilova.app. None of these tools are used in the Kilova app.

12.1 Analytics and Advertising

Our website uses:

Google Analytics, to count visits and see which pages people visit.
Hotjar, to understand how visitors use our pages, through recordings of clicks and scrolling, and heatmaps.
Meta Pixel, to measure our ads on Meta (Facebook and Instagram) and show them to people who have visited our website.

These tools use cookies and similar technologies, and collect information such as your IP address, browser, device and the pages you visit. We use them based on your consent, given through the cookie banner. You can withdraw it at any time by deleting these cookies in your browser settings.

If you subscribe to our newsletter, we use your email address to send you offers and ideas for getting the most out of Kilova. We use EmailOctopus to manage the list and send the emails. Every email includes a link to unsubscribe at any time.

12.3 Other Services on Our Website

Netlify hosts the website and receives the messages you send through its contact form.
GraphComment provides the comment section on our blog. If you leave a comment, GraphComment processes it under its own privacy policy.
Our fonts are loaded from Google Fonts and our images from Cloudinary. When your browser loads them, these providers receive your IP address.

13. Changes to This Policy

We’ll update this policy when our practices or the law change, and update the “Last updated” date above. If the changes are important, we’ll let you know by email or in the app.

14. Contact Us

For any question or request about your data, email us at kilova.app@gmail.com. We’ll reply within one month.