Why Local Cycle Uses No Account: A Privacy Decision Tree

1. The threat model most people don't know about

When someone searches "best period tracker," they're usually comparing prediction quality, UI, and price. They are almost never asking: where does my data physically live, who can be compelled to hand it over, and what is the worst case if it leaks?

In 2022 a woman in Nebraska was charged based partly on her Facebook messages about medication abortion. Period data - which can indicate pregnancy, pregnancy loss, and timing of intimate activity - is in the same evidentiary category.

There are two ways to respond to that: tighten security around the data you collect, or stop collecting it. Local Cycle is built around the second approach.

2. The decision tree I used

For each design question, I asked: can the user be harmed by the data this feature creates? If yes, the default is "do not collect it."

• Email signup at install? Skip. Replace with an optional, local-only nickname.
• Cloud sync so users don't lose data? Skip. Replace with encrypted local backups the user controls.
• Anonymous usage analytics to improve the app? Skip. Replace with opt-in feedback and a public changelog.
• Push notifications for cycle predictions? Allowed, scheduled locally. No remote trigger.
• Doctor report export? Allowed, generated on-device. The user picks the destination.

Notice the pattern: features that create the most sensitive data get the most isolation, and features that improve convenience get the most transparency about what they're doing.

3. What "encrypted local" actually means in code

The data sits in an SQLite database on the phone. The database file is encrypted at rest with a key derived from the user's passphrase using a memory-hard KDF (Argon2id). The app process never writes the derived key to disk. Backups are written to a user-chosen location, encrypted with a per-backup random key the user can optionally password-protect.

The Android release is built without the app-owned internet permission for the core feature set, and the app is designed so cycle entries, symptoms, and notes are not sent to a Local Cycle server.

4. The things this costs us (and you)

No cloud sync means if you lose your phone and have not made a backup, your data is gone. That is a real cost. Local Cycle chooses that tradeoff instead of placing sensitive records on an app-owned server.

No analytics means we do not know which features are working, which screens confuse people, or where they abandon onboarding. We learn from support emails and feedback people choose to send.

No social features means we can't add a "share with your partner" widget. We can build a doctor report, but you have to be the courier.

These are real product tradeoffs. They are the price of the privacy stance. I want you to see them, not just the marketing.

5. How to check whether any period app deserves your data

A short checklist that applies to Local Cycle and to anything else you might try:

1. Open the app's privacy policy. Search for "share," "partners," and "advertisers."
2. Look at the Android app permissions with a tool like Exodus Privacy. Any "Internet" + "Read phone state" combo is a flag.
3. Disconnect from Wi-Fi and use the app. If features break, the app is phoning home.
4. Read the company's funding. Free apps paid for by advertisers collect your data; that is the business model.
5. Ask whether the company has ever been subpoenaed, and how they responded. The answer tells you what your day in court would look like.

6. Try it, and tell me what I missed

Local Cycle is free to try on Google Play. If you find a place where the privacy stance creates a worse experience than necessary, please send feedback. The whole point of this project is to be useful and private.

If you read this far, you are the audience Local Cycle was built for. Thank you.