Family Cycle — Data Retention Schedule
Effective date: November 1, 2026
This schedule covers the Family Cycle app, operated by Flood Stage LLC, Illinois, USA.
The rule all of this follows: nothing is retained indefinitely, and deletion means deletion — at our processor (Google Firebase) too, not just on your screen. The windows below are outer bounds, not typical performance: a deletion you perform in the app takes effect in the live database immediately.
| Data | Why we hold it | Kept until | Gone at the latest |
|---|---|---|---|
| Period dates and derived phases | The dashboard and forecast — the product itself | You delete the entry or profile, or the account/family is deleted | 30 days after deletion; any backup copy ages out ≤ 6 months |
| Profile names and kind (child/adult) | Showing the family whose week is whose | Profile deleted | Same as above |
| Account email + sign-in | Your access; breach notice if ever needed; the family plan's emails | Account deleted | 30 days after account deletion |
| The family plan: whether it is on, when it renews or ends, what Apple will charge when it renews, Apple's identifier for it, who started it | Every phone in the family knowing whether the plan is on | The family is deleted | 30 days after the family is deleted |
| The family plan's emails, the starting email and the two reminders before each renewal: what each said (the plan's dates and price, and how to cancel), which account it went to, Apple's identifier for the plan, and when it was sent | Proof that whoever started or pays for the plan was told its dates and how to cancel, as state renewal laws require. Holds nothing about anyone's cycle, and is kept apart from the family so that closing it does not delete the proof | — | 3 years after each email |
| Consent to the family plan's yearly renewal: every word the offer showed (its price, its renewal terms, the renewal's own switch and the line before the button), which account agreed, Apple's identifier for the purchase, and when | Proof that whoever started the plan agreed to its renewal, which California requires us to keep. Holds nothing about anyone's cycle, and is kept apart from the family so that closing it does not delete the proof | The plan ends | 3 years after the plan ends |
| A family plan still paid up when its family is deleted: Apple's identifier for it, and the date. Nothing that says whose it was | So a family set up again with the same Apple account can use what it already pays for | A family takes it up (it is then that family's plan, above), Apple tells us the plan has ended, or a year has passed since the family was deleted | 30 days after that |
| The share code: the family's code, the months it has earned and not used, when each was earned, and a record that one family typed another's code | Adding a month to the plan of the family that shared, once the family that typed its code has paid, and taking it back if that payment is refunded | Either family is deleted | 30 days after the family is deleted |
| Where important notices go — by email, or not | Reaching you with a notice such as a breach notice, the way you chose | You change it, or the account is deleted | 30 days after account deletion |
| Family and membership records | Enforcing who is in the family | Membership removed / family deleted | 30 days |
| Invitation codes | Joining a family | Used, revoked, or expired (codes expire after 7 days) | Purged 30 days after expiry or use |
| A record that a grown woman's profile was deleted by someone other than her: which profile and family, by our identifiers for them; whose account deleted it, or that our inactive-account deletion did; and when. Nothing about her cycle, and not her name | Answering her, or anyone acting for her, who asks who deleted her profile and when. Kept apart from the family so that deleting the family does not delete it | — | 2 years after the deletion |
| Consent and acknowledgment records | Proof that visibility was each person's choice — kept for legal defense, including yours. Held apart from your family's data so that deleting the family does not delete the proof; they hold no health data, only who decided, which words they read, and when, and for a signed authorization its words as signed and the name typed to sign it (2026-10-28) | Account closure | 5 years after account closure |
| Incident and breach records | Legal obligations; honesty about our own history | — | 5 years after the incident |
| Support correspondence | Answering you; pattern-spotting | — | 2 years after the thread closes |
| Operational logs at our processor | Security monitoring, abuse investigation | — | Google's fixed windows: administrative audit logs up to 400 days; access logs ≤ 30 days |
| Birth month and year (only a daughter invited to log for herself) | Knowing she is 13, and the month her profile becomes her own at 18 | Profile deleted | Same as period dates |
| What she uses — one optional line, for the shopping | So whoever shops has it to hand. Never sent anywhere, never in a notification | You clear it; the profile is deleted; or the profile is corrected from a child's to a grown woman's, which deletes it with the dates | Same as period dates |
| The App Store's identifier for a daughter's download (13–17, only where a state's app-store law applies) | Honouring her parent's withdrawal of consent, which Apple reports by this identifier alone | Her account is deleted, or her parent withdraws consent | 30 days after account deletion |
| The App Store's answer about someone's age, where the law requires the app to ask | Deciding whether someone may set up a family, join as a parent, or join at all | Used once, on the phone, at that moment | Never kept: not sent to us, not stored on the phone |
| Reminder preferences | Whether your phone buzzes | Lives only on your device, never on our servers | Removed with the app |
| That the age screen refused an invitation on this phone, and until when | That a refused invitation can't be retried on that phone with a different answer: until the month she turns 13 by the answer she gave, or a year when the App Store gave the answer | Lives only on your device, never on our servers; it holds the end date, not her birth | Kept until that date, even if the app is deleted |
| The app's offline copy of your family's dates | So the app works with no signal | Lives on your device, excluded from iCloud backup | Removed with the app, or by signing out |
Notes that keep the table honest
- Backups: the database keeps point-in-time recovery for 7 days, so a mistake that damages family data can be undone: it can be read as it stood at any moment in the last week. A delete is effective in the live database at once, and after 7 days nothing deleted can be recovered from it. We operate no other backup. If we ever add one, its cycle will fit inside the 6-month outer bound above and this schedule will be updated first.
- Inactive accounts: if nobody in a family has opened the app for 24 months, each account in it gets a notice by email where its holder chose email for important notices, and 30 days later the family and everything in it is deleted unless someone opens the app. An account nobody has opened for 24 months, in a family that is still in use, is deleted the same way while the family carries on, with one exception: a family's last parent is kept while anyone else in it still opens the app, because a family is never left without a parent. That account is noticed when the family stops being used, and goes with it. The app refreshing its reminders in the background counts as opening it. If a notice can't be delivered, the deletion still happens: sleep shouldn't become indefinite retention. Of a notice we keep only when it went, whether its email did, and the day it named, until the account is opened again or deleted.
- Whole-family deletion: deleting the last parent account deletes the family and every profile and log in it, on the account-deletion timeline. The app names exactly what will be lost before you confirm.
- Counts, never analytics: the app records no analytics events, and nothing tracks what anyone does. The only totals we look at are bare numbers with no names, accounts, devices or anyone's dates in them: the daily visit totals our website's host shows us, and the download and subscription totals the App Store reports to every developer. We use them to see whether Family Cycle is reaching families and whether our advertising works, we never try to work out who is behind a number, and we share none outside the company except as a published figure, like a transparency report's count of law-enforcement requests.
- Legal holds: if a valid legal obligation requires us to preserve specific data beyond these windows, we preserve the minimum, tell the affected person unless the law forbids it, and resume the schedule the moment the hold ends.
Contact
privacy@familycycle.app
Flood Stage LLC, Illinois, USA
Other policies: Privacy Policy, Consumer Health Data Privacy Policy, Terms of Service, Law Enforcement Request Policy