Diboru is built so that your most personal data stays on your phone. We don’t show ads, we don’t sell data, and we don’t use analytics or advertising SDKs in the app. This policy explains exactly what is processed, where, and what you can do about it.
1. Who we are
Diboru (the Android app, its Wear OS companion and this website) is provided by BFA Inc., Jyväskylä, 40700, Finland (“we”, “us”). We are the data controller for the personal data described here. Contact: admin@diboru.app.
2. The short version
- Guest mode: if you continue without an account, your data stays on your device and nothing is sent to us.
- Account: if you create one, Google Firebase Authentication stores your email address, first name and a user ID so you can sign in.
- Health and cycle data (periods, symptoms, mood, notes, steps, heart rate, sleep, journeys) are stored on your device in an encrypted database. We do not upload them to our servers.
- Payments are handled by Google Play. We never see your card details.
- You can delete your account in the app at any time, or by following our account deletion page.
3. What data we process, and why
3.1 Account data (only if you create an account)
You can sign up with Google or with email and password. We use Google Firebase Authentication (provided by Google) to run sign-in. It stores:
- your email address and whether it is verified;
- your first name (with Google sign-in, the name on your Google account);
- a unique user ID and which sign-in method(s) you linked;
- your password, which is stored by Firebase in hashed form — we never see it.
Firebase also processes technical data such as your IP address, device and app information to provide sign-in, send verification and password-reset emails, and protect accounts against abuse. Purpose: to create and secure your account. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)) and our legitimate interest in keeping the service secure (Art. 6(1)(f)).
3.2 Age check (birth date)
Before an account can be created, Diboru asks for your date of birth to confirm you are at least 13. The date is stored only on your device to apply the age rule and teen-friendly defaults. It is never uploaded. If the check shows you are under 13, the date is discarded, no account is created, and any just-created account is deleted immediately. Legal basis: legal obligation and legitimate interest in protecting children (Art. 6(1)(c) and (f)).
3.3 Health and cycle data (special category data)
Health data is a “special category” of personal data under GDPR Article 9. Diboru processes it only with your explicit consent (Art. 9(2)(a) and 6(1)(a)), which you give by choosing trackers, logging data and granting Health Connect permissions. You can withdraw consent at any time by revoking permissions or deleting the data.
- Cycle log: period days and flow, symptoms, mood, notes, and the predictions calculated from them (next period, fertile window, ovulation estimate). These are calculated on your device.
- From Health Connect, with your permission: steps, heart rate, sleep and menstruation records — only for the trackers you picked. If you allow it, Diboru can also write your logged period flow to Health Connect.
- Achievements: which badges you unlocked and when.
Where it is stored: on your device, in a database encrypted with SQLCipher. Its random key is protected by a non-exportable Android Keystore key. Android cloud backup of app data is turned off, so this data is not copied to backups. We do not upload your health or cycle data to our servers and cannot see it.
Doctor report (Diboru Plus): if you create a PDF report, it is generated on your device and only leaves it if you share it yourself, for example by email.
Health Connect: Diboru’s use of information received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements. We never use Health Connect data for advertising, never sell it, and never share it with third parties except as needed to provide the features you use or as required by law.
3.4 Location and journeys
When you record a journey, Diboru uses your device’s precise location only while recording, started from the visible Record screen (a foreground service with a visible notification). Diboru does not request background location. Your route, distance, climb, times and journey title are stored on your device.
Maps are displayed with map tiles from OpenFreeMap, based on OpenStreetMap data. To show the map, your device requests tiles from OpenFreeMap’s servers, which receive your IP address and which map areas are being loaded. Your recorded route itself is not sent. Legal basis: your consent to location access (Art. 6(1)(a)) and performance of the service (Art. 6(1)(b)).
3.5 Purchases (Diboru Plus)
Subscriptions are sold and billed through Google Play. Google processes your payment details under its own privacy policy. We receive information needed to provide your subscription: the product and plan, purchase token, order ID, purchase and renewal status. Your Plus status is cached on your device so it works offline, and the app re-checks it with Google Play. Legal basis: contract (Art. 6(1)(b)) and legal obligations such as accounting (Art. 6(1)(c)).
3.6 Student offer
If you ask for the student offer, we process the university email address you enter to send a single-use verification link and to confirm your eligibility (one offer per account). We keep it only as long as needed for verification and to prevent repeated use of the offer. Legal basis: contract (Art. 6(1)(b)).
3.7 Settings on your device
Your language, chosen trackers, step goal, “Less motion” setting and similar preferences are stored on your device.
3.8 What we don’t do
- No advertising, no advertising IDs, no ad networks.
- No analytics or crash-reporting SDKs in the current version of the app.
- No selling or renting of personal data, ever.
- No public sharing of cycle data — it is always “only me”.
If you have allowed it in Android, Google Play may give us aggregated, de-identified app statistics and crash reports (Android vitals). This is controlled by Google and your device settings.
3.9 Coming features
Sharing features such as photo and video moments, Cheers and profiles are planned. Before they launch we will update this policy, explain what is uploaded and to whom it is visible, and sharing will be opt-in.
3.10 This website and cookies
This website (diboru.app) is hosted by Hostinger (Hostinger International Ltd., Cyprus). When you visit, the server processes technical data such as your IP address, browser and the pages requested, and keeps it in server logs for security and troubleshooting. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f)).
Cookies and similar storage. When you first visit, a banner asks whether you allow statistics cookies. Accept and Reject are equally easy, and nothing is pre-selected. Until you accept, no analytics script is loaded and no analytics cookies are set (Google Consent Mode is also set to “denied” for analytics and advertising).
- Strictly necessary — your cookie choice: stored in your browser’s local storage as “diboru-consent” so we don’t ask on every page. Kept for about 6 months, then we ask again. It is never sent to us.
- Strictly necessary — hosting security: our host’s network (Hostinger CDN) may set a session cookie called hcdn after a short automatic browser check that protects the site from bots. It is deleted when you close your browser.
- Your light/dark mode choice: stored in local storage as “diboru-theme” only if you switch modes. Never sent to us.
- Statistics — only if you accept: this website uses Google Analytics, added through Google’s Site Kit plugin, to understand in aggregate how visitors use the site. Google Analytics sets the cookies _ga and _ga_XXXXXXXX (expire after up to 2 years) and processes your IP address, device and browser information and the pages you view. Analytics data is kept in Google Analytics for the retention period configured there (at most 14 months). We don’t use the website for advertising, and advertising storage and personalisation stay denied.
Legal basis: your consent (Art. 6(1)(a) GDPR and the Finnish Act on Electronic Communications Services). Withdrawing consent: open “Cookie settings” at the bottom of any page and choose Reject. We then stop Google Analytics on this site and delete its _ga cookies from your browser. You can also block or delete cookies in your browser settings. Withdrawing doesn’t affect processing that took place before.
The site loads its fonts and animation code from our own server.
4. Who receives data
We use these service providers (processors or independent controllers) only to run Diboru:
- Google — Firebase Authentication (sign-in), Google Play (distribution and billing), Credential Manager / Google Sign-In. Health Connect runs on your device under Android.
- OpenFreeMap — map tiles (technical request data only).
- Hostinger — hosting of this website.
- Google Analytics (Google) — statistics for this website (not the app).
We may disclose data if required by law or to protect rights and safety. We never sell personal data.
5. International transfers
Google (and, for some services, Hostinger) may process data outside the European Economic Area, including in the United States. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, and/or on the European Commission’s Standard Contractual Clauses.
6. How long we keep data
- Account data: until you delete your account. Deleting it removes your Firebase account; residual copies in provider backups are removed on their normal schedules.
- Data on your device: until you delete it, delete your account (which also wipes the app’s database and preferences on that phone), or uninstall the app.
- Health Connect: records Diboru wrote to Health Connect stay there until you delete them in Health Connect.
- Purchase records: kept by Google Play under its policies; we keep transaction records only as long as accounting and tax laws require.
- Student verification: only as long as needed to verify eligibility and prevent repeated use.
7. Security
Encryption of the on-device database (SQLCipher with an Android Keystore-protected key), no Android cloud backup of app data, encrypted connections (TLS) to the services above, email verification, and re-authentication before account deletion. No method is 100% secure, but we design Diboru to keep the most sensitive data out of the cloud entirely.
8. Your rights
Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting earlier lawful processing). Because most of your data is stored only on your device, you control it directly in the app. For anything we hold (account data), contact admin@diboru.app; we answer within one month.
You also have the right to lodge a complaint with a supervisory authority — in Finland the Office of the Data Protection Ombudsman (tietosuoja.fi), or the authority in your country of residence.
9. Children
Diboru is for people aged 13 and over. Accounts can’t be created by anyone under 13. If you are below the age of digital consent in your country (between 13 and 16 in the EU), please use Diboru with the permission of a parent or guardian. If you believe a child under 13 has given us personal data, contact us and we will delete it.
10. Deleting your account and data
In the app: Profile → Account & sign-in → Delete account. If Firebase asks, you’ll confirm with your password or Google first. This deletes your account and wipes Diboru’s data on that phone. You can also request deletion by email — see the account deletion page. Deleting your account does not cancel a Google Play subscription; cancel it in Google Play.
11. Changes to this policy
We’ll update this policy when Diboru changes, and show the new date at the top. For significant changes we will tell you in the app before they take effect.
12. Contact
BFA Inc. · Jyväskylä, 40700, Finland · admin@diboru.app