Privacy Policy

This Privacy Policy explains how WhealBit (“Splash”, “we”, “us” or “our”) collects, uses and protects personal data for which we are the controller. It covers people who use the Splash app at app.splash.care and the Splash apps for iPhone, Apple Watch and Android, with or without an optional account, people a Splash user shares with (partners), visitors to this website, and people who contact us. It should be read with our Terms of Use, How we process data, Cookie Policy and Sub-processors list. For the picture version, see what we can see.

1. Who we are and how to contact us

Splash is a free period, cycle, pregnancy and partner-sharing app. It is local-first: it works fully without an account, and your cycle data is kept on your device unless you choose to turn on sync or partner sharing, which are end-to-end encrypted on your device first (see sections 6 and 7). It is not a medical device and not contraception (see the medical disclaimer).

The controller responsible for the personal data described in this notice is:

• Legal entity: WhealBit
• Trading address: St Ives, Cornwall
• Data protection / privacy contact: hello@splash.care
• Phone: 01736 396654

This notice describes our data protection practices. It does not vary the Terms of Use; nothing here creates a warranty beyond those terms or beyond what data protection law requires.

2. Scope of this notice

This notice covers personal data we decide how and why to process. We are the controller for all of it: Splash is a consumer app, so there is no business customer acting as controller for your data and we do not act as anyone’s processor. See How we process data for why that matters.

It does not cover what a partner you share with does with information on their own device, or the practices of your browser maker, app store or operating system.

3. Local-first: the data we never receive

Everything you enter in Splash (periods, symptoms, moods, sex and love life, notes, test results, test photos, pregnancy details, settings, and your PIN as a one-way hash) is stored in the app’s own storage on your device (your browser’s storage on the web). If you don’t create an account, your logs don’t reach us. The one exception is reminders: if you allow notifications, the reminder details described in section 8 are stored on our server; these are readable by our server so it can send them on time, and they are not end-to-end encrypted. Turning notifications off deletes them. Everything else stays on your device: we cannot see it, back it up, or recover it, and clearing the app’s data or uninstalling deletes it.

Some features (for example When to get help, insights and predictions) run entirely on your device. Nothing you type into them is sent to us.

Voice logging: if you use the microphone to log by voice, your words are turned into text by Apple’s or Google’s speech recognition (on your device, or on their servers under their own privacy policies, depending on your device and settings). Splash receives only the text, on your device, and doesn’t keep the audio.

4. The personal data we collect

We do not collect your name (unless you add a display name), location, contacts, advertising identifiers or payment details. Splash is free and has no payments.

5. How we use your data, and our lawful basis

We do not use your data for advertising, profiling, data mining, selling, or training AI models. We do not send marketing email.

Splash does not currently show ads. If that ever changes, we will update this policy before it happens and ask for your consent before any ad-related processing of your data. Your cycle data would never be used for advertising.

6. Health data (special category data)

Information about your periods, fertility, sex life and pregnancy is special category data under Article 9 of the UK GDPR. Splash is designed so that we do not need to read it:

• On your device: when you start using Splash you give explicit consent for the app to store and process this information on your device. That processing happens on your device, not on our systems.
• If you turn on sync or sharing: your device encrypts the data with AES-GCM with 256-bit keys before upload. We store only ciphertext and hold no key, so we cannot read, analyse or disclose your health data in readable form. To the extent this encrypted copy is still special category data, we rely on your explicit consent (Art. 9(2)(a)), given when you turn on sync or sharing.
• Withdrawing consent: turn sync off or delete your account in the app and the encrypted copy is deleted. Clearing the app’s data on your device removes the local copy.

Apple Health and Apple Watch (iPhone app only): Splash only connects to Apple Health if you allow it, and you choose each type of data in the Health permission screen.

• Reads (if you allow): menstrual flow, spotting, cervical mucus, ovulation (LH) test results, progesterone (PdG) test results, sexual activity, symptoms (abdominal cramps, headache, bloating, breast pain, acne, lower back pain, fatigue, appetite changes, nausea, sleep changes, constipation, diarrhoea, dizziness, hot flushes, memory lapse and mood changes), basal body temperature, sleeping wrist temperature, resting heart rate, heart rate variability and sleep.
• Writes (if you allow): menstrual flow, spotting, cervical mucus, ovulation test results, sexual activity, the symptoms listed above and basal body temperature.

Apple Health data is used only to provide Splash’s features: filling in your cycle, symptoms and signs, improving your estimates, and saving what you log back to Health. It is never used for advertising or marketing, never sold, never used for data mining or profiling, and never shared with third parties. It is stored in Splash’s storage on your iPhone, and never stored in iCloud by Splash. It is treated like anything else you log: it stays on your device unless you turn on backup, sync or partner sharing, when it is encrypted on your device first and stored only as ciphertext we can’t read (see above). The Apple Watch app talks only to your iPhone. You can change Health permissions at any time in the Health app or iPhone Settings.

Health Connect (Android app only): if you allow it, Splash reads period and spotting days, basal and skin temperature, ovulation tests, cervical mucus, resting heart rate and heart rate variability from Health Connect (for example from Samsung Health, Fitbit or Oura), and can save your period, temperature, ovulation tests and cervical mucus to it. This happens on your phone and is treated exactly like Apple Health data above: never used for advertising or profiling, never sold or shared, and only uploaded end-to-end encrypted if you turn on backup. You can change or remove access at any time in Health Connect.

One exception to “we can’t read it”: notification text, if you choose to turn off discreet wording (see section 8).

7. Partner sharing

If you share with a partner, your device encrypts a snapshot of only the categories you tick, with a key that exists only in your app and the QR code or link you show them. We store the encrypted snapshot, the list of categories it includes, and a hash used to check access. Your partner’s device unlocks it. We cannot. Partner replies are encrypted the same way and deleted after 3 days. Stopping a share wipes the snapshot.

What a partner sees on their own device is then in their hands. Only share with people you trust, and see our safety page if anyone is pressuring you to share.

8. Notifications

If you allow notifications, we store your device’s push address (push token) and the text and time of upcoming reminders (up to 60 days ahead) so our server can send them on time. This is stored with Supabase in the EU (Paris, eu-west-3). If you don’t have an account, Splash creates an anonymous device identity for this, with no email, name or password, which holds only the push token and those reminder times and text. If you later create an account or sign in, these move to your account. The reminder times can show when a period is predicted.

We can read this text. By default it is neutral (for example “Reminder”). If you turn off discreet wording, it can describe your cycle, for example that a period is due. Delivery goes through Apple Push Notification service on iPhone, or your browser maker’s or Google’s push service elsewhere, which receives the push address and the message. Sent notifications are deleted after 14 days.

Turning it off: turn notifications off in Splash (More, Settings, Notifications). This deletes your push token and any reminders still queued from our server. You can also turn off notifications for Splash in your device settings. To have the anonymous device identity itself deleted, email hello@splash.care; if you have an account, deleting it removes everything at once.

9. Cookies and similar technologies

This website sets no cookies and uses no device storage, analytics or tracking, so there is no cookie banner. The app uses your device’s storage only to hold your own data and, if you sign in, your session, which is strictly necessary. Details in the Cookie Policy.

10. Sharing your data and our sub-processors

We never sell or rent personal data and never share it for advertising. We use a small number of providers to run Splash, each under a written contract and only on our instructions:

Some recipients act as independent controllers for their part: push services (Apple Push Notification service, and browser push services from Apple, Google, Mozilla and others) when you turn notifications on; Apple or Google speech recognition if you log by voice; Google, which serves some rarer emoji images from fonts.gstatic.com and so receives your IP address; and Hugging Face, which serves the optional natural read-aloud voice model as a one-off download if you turn that voice on, and so receives your IP address. No health data is sent to any of them. The full list is on the Sub-processors page.

We may also disclose data where the law requires it (section 17), or to a buyer if Splash is ever sold, in which case this notice continues to apply and we will tell you first.

11. Where your data is stored, and international transfers

Your account and encrypted backups are stored in the EU, in Supabase’s Paris, France region (eu-west-3). Transfers from the UK to the EU/EEA are covered by the UK’s adequacy regulations for the EEA, so no extra safeguard is needed for that storage.

Vercel serves app and website files from a global network, so technical request data (such as your IP address) may be processed in the US and elsewhere. Supabase, Inc. and Vercel, Inc. are US companies. Where any personal data is transferred to or accessed from a country without UK adequacy regulations, we rely on an Article 46 safeguard offered by the provider, such as the ICO International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified. Your logged health data only leaves your device as ciphertext. Reminder text and times (section 8) are the exception.

12. How long we keep your data

• Account data and encrypted backups: until you delete your account in the app. Deletion removes your account, backups, shares and notification records from our database at once.
• Partner replies: 3 days. Stopped shares: the snapshot is wiped when you stop.
• Sent notifications: 14 days.
• Provider backups and logs: our providers keep short-lived backups and request logs for resilience and security; deleted data drops out of them on their normal cycle.
• Correspondence: as long as needed to deal with your message, then up to 2 years in case it comes up again.

13. Your rights

Under the UK GDPR (and the EU GDPR if you are in the EU) you have the right to access, correct, delete and port your personal data, to restrict or object to processing, and to withdraw consent at any time without affecting earlier processing. Most of this you can do yourself in the app: export a backup file, edit or delete entries, turn sync, sharing or notifications off, or delete your account (how to delete your account and cloud data).

For anything else, email hello@splash.care. We reply within one month. We may need to confirm the request comes from the account holder. Because your health data is encrypted with keys we do not hold, we can only give it to you as ciphertext; your app can show it to you in readable form.

14. Predictions and automated processing

Splash estimates periods, fertile days and other patterns on your device. These are estimates for your own information, not decisions about you, and they have no legal or similarly significant effect. We carry out no automated decision-making or profiling within the meaning of Article 22.

15. Security

End-to-end encryption (AES-GCM with 256-bit keys, a fresh random 12-byte IV for every encryption), keys derived on your device (PBKDF2-SHA256, 310,000 iterations, random 16-byte salt), a recovery code only you hold, row-level security on every table, and TLS in transit. More on our security page and in How we process data. If a personal data breach is likely to put you at high risk, we will tell you without undue delay.

16. Children

Splash can be used without an account, so a young person can use it without giving us any personal data. Accounts are for people aged 13 and over. If you think a child under 13 has created an account, contact us and we will delete it.

17. Requests from authorities

If we receive a legally binding request, we can only provide what we hold: account data, encrypted copies we cannot decrypt, share metadata, and notification text and times. We will challenge requests that are unlawful or too broad, and tell you first where the law allows.

18. US state health privacy laws

Some US states (for example Washington’s My Health My Data Act, Nevada and Connecticut) give extra rights over consumer health data. We do not sell consumer health data, do not share it for advertising, and collect only what is needed for the features you turn on. You can access or delete your data as described in section 13.

19. Complaints

Please contact us first and we will try to put things right. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk (0303 123 1113), or to the data protection authority where you live in the EU.

20. Changes to this notice

We will post any change here with a new date, note it on the changelog, and ask you to review it in the app before significant changes apply to you.

21. How to contact us

WhealBit, St Ives, Cornwall. hello@splash.care · 01736 396654.

Related legal documents

• Terms of Use The agreement for using the free Splash app and this website.
• How we process data Our data-processing schedule: the encrypted-backup service, security measures and breach handling.
• Cookie Policy No cookies on this site, and what the app keeps on your device.
• Sub-processors The third parties that help us run Splash, and where.
• Acceptable Use Policy What you may not do with Splash, including using sharing to monitor someone.
• Medical disclaimer Not a medical device, not contraception, and when to get help.

Questions about any of these? Email hello@splash.care.