Privacy Policy

1. Who we are

Sana is a menstrual-cycle companion app made by the Sana team ("we", "us"). You can reach us at steward@arsana.cloud. Sana has no user accounts and we do not run a database of users. The data described below is processed on your device, by Apple, or by the service providers named in section 5, and only for the purposes described.

2. What stays on your iPhone

Everything you enter is stored only on your iPhone, inside Sana's private app storage:

• cycle logs: period dates, flow, symptoms, mood, energy, pregnancy and postpartum status;
• water, care, meals, food preferences, allergies, notes and doctor-visit notes;
• your name or nickname, profile photo, game progress and settings;
• Smart Sana chat history and the short profile Sana keeps about you ("what Sana knows about you").

This storage is protected by iOS data protection, which encrypts it with a key tied to your device passcode. Exports, doctor-visit notes, Sana's profile of you and your profile photo use Apple's strongest protection class, so they cannot be read while the phone is locked. You can also lock Sana with Face ID or your passcode.

Predictions, phase calculations, food suggestions and the memory search that helps Smart Sana recall things are all computed on your phone. Doctor reports are created on your phone and leave it only if you share them yourself, for example by AirDrop, Messages or Mail.

3. iCloud sync (optional, off by default)

If you turn on iCloud sync (Account → Privacy & data), Sana saves a copy of your Sana data in your own private iCloud database, using Apple CloudKit, so it can move to a new iPhone. That copy belongs to your Apple Account. Apple encrypts it in transit and on its servers, under Apple's privacy policy. We cannot see or access your private iCloud data.

Turn the switch off to stop syncing. "Delete everything" in the app also deletes the copies Sana put in iCloud.

4. Partner sharing with Arsa (optional, off by default)

You can invite a partner. Pairing uses Apple iCloud sharing (CloudKit sharing), so both of you need to be signed in to iCloud. Nothing goes through a Sana server.

• Consent per item. Your partner sees only the items you switch on, one at a time, for example your current phase, how you are feeling today, or a care tip. Every item starts switched off.
• Never your raw logs. Your partner never receives your logs, notes, chat history or doctor information. Sana sends a short, curated summary of the items you allowed.
• Things you share together. If you use the shared features (to-dos, cravings, plans, food ideas and an activity log), what either of you adds there is visible to both of you.
• Revocable. You can switch any item off at any time, or end the connection. Ending it removes the shared records from iCloud.

When the partner uses Arsa, Arsa stores their own settings and what they add on their own phone. Arsa does not track a cycle.

5. Smart Sana, the AI chat (optional, off by default)

Smart Sana is off until you turn it on and agree to the in-app notice. Everything in this section happens only while it is on, and only when you use it: when you chat, scan food or a label, attach a photo or file, or ask Sana to write up a doctor visit.

What is sent

• your message, and the earlier messages of that conversation;
• the context Sana needs to answer you: for example your cycle history and predictions, recent logs, and relevant lines from what Sana knows about you;
• any photo, image or document you attach, or a food photo you scan;
• for doctor-visit notes, the text of the visit (never the audio).

Before anything is sent, photos and images are redrawn and shrunk on your phone (at most 1024 pixels), which also removes location and other metadata. PDFs are turned into text on your phone, or the first pages are sent as small images. Your partner's data is never sent.

Who receives it

Training and retention

• Your data is not used to train AI models. Anthropic does not train its models on data sent through its commercial API, and we do not sell or license your data to anyone.
• Sana's relay does not keep your messages. The only thing it stores is an anonymous record per app install: a device key created by Apple App Attest, a counter, and how many requests were made today. It holds no name, no Apple ID and no content.
• Anthropic and TypeSafe process requests to return the answer. Under their API terms, they may keep inputs and outputs for a limited time for safety and abuse monitoring (Anthropic: generally up to 30 days), and then delete them.
• Like any internet service, the relay and the providers see the IP address of the connection while handling the request.

Your controls

Your chat history and Sana's profile of you stay on your phone. You can read the profile, delete single lines, or delete all of it. Turning Smart Sana off deletes your chat history and that profile from your phone. A daily message limit applies.

Smart Sana can make mistakes. It is not medical advice. See the Terms of Use.

6. Camera, photos and files

Sana asks for the camera only when you choose to take a photo, for example to scan your plate or a food label for Smart Sana. When you choose a photo or a file, iOS lets you pick it yourself; Sana only gets the items you pick, not your whole library.

• A profile photo stays on your phone.
• Photos and files you attach or scan in Smart Sana are compressed on your phone and sent only as described in section 5.

7. Apple Health (optional)

You can import period data from Apple Health (Settings → Apple Health). Sana asks for read access to menstrual flow only and imports the last 180 days into your cycle history. It never writes to Apple Health, and it reads nothing else.

Data from Apple Health is not used for advertising or sold, and is not shared with anyone. It stays on your phone like the rest of your cycle history. It leaves the phone only through the features you turn on yourself: as part of your iCloud copy (section 3), or as cycle context in a Smart Sana request (section 5).

8. Speech and dictation

During a doctor visit, Sana turns speech into text with your iPhone's on-device speech recognition. The audio is not uploaded or saved. If your phone can't recognise speech on the device, you can type instead.

The microphone button in the chat uses Apple's speech recognition, which may send audio to Apple to turn it into text, under Apple's privacy policy. Sana does not store the audio.

9. Calendar, reminders and the widget

If you allow it, Sana adds its period predictions to Apple Calendar as all-day events. Reminders are local notifications scheduled on your phone. The Home Screen widget reads a small summary from storage shared only between Sana and its widget on your phone. You can turn all of these off in Settings or in iOS Settings.

10. Purchases

Sana Lite and Sana Pro are subscriptions sold and billed by Apple through the App Store. We never see your name, email or payment details. Sana checks on your phone, using Apple StoreKit, whether you have an active plan. Apple shares only anonymous sales reports with us.

11. No ads, no tracking, no sale

• Sana shows no ads and contains no advertising, analytics or tracking SDKs.
• Sana does not track you across other apps or websites, and does not ask for permission to.
• We do not sell, rent or share your data for advertising or data brokering.
• If you opt in to share crash reports with developers in iOS Settings, Apple may pass anonymous crash reports to us. That is controlled by Apple, not by Sana.

12. Export, delete and your rights

• Export: Account → Privacy & data → Export saves all your Sana data as a JSON file you can keep or move.
• Delete: Account → Privacy & data → Delete everything erases all Sana data from your phone, including chat history, and removes what Sana stored in iCloud and any partner connection. See Delete your data.
• Withdraw consent: switch off iCloud sync, any partner item, Smart Sana, Apple Health, Calendar or notifications at any time. This stops future processing; it does not affect what happened before.
• Uninstall: deleting the app deletes its data from your phone. Data in iCloud stays until you delete it in the app first, or remove it in iOS Settings → [your name] → iCloud → Manage.

Because we do not hold your data on our own servers, you can exercise most rights directly in the app. Depending on where you live, laws such as Indonesia's Personal Data Protection Law (UU PDP) or the EU/UK GDPR give you rights to access, correct, delete and port your data and to object or withdraw consent. We rely on your consent for health data and for the optional features above. For any request or complaint, email steward@arsana.cloud. You can also contact your local data-protection authority.

13. How long data is kept

• On your phone and in your iCloud: until you delete it.
• Partner summary and shared items: until you switch the item off, end the connection or delete everything.
• Sana's relay: no message content; the anonymous device record holds only a key, a counter and today's usage counts.
• AI providers: as described in section 5.

Requests between Sana and its relay, Apple and the AI providers are encrypted in transit (HTTPS/TLS).

14. Children

Sana is not meant for children under 13, and we do not knowingly collect data from them. If you are under 18, or under the age of digital consent where you live, please use Sana with the agreement of a parent or guardian. If you believe a child has sent us information, email us and we will delete it.

15. This website

arsana.cloud is a static site served by Cloudflare. It uses no cookies, no analytics and no third-party scripts. Cloudflare processes standard connection data such as IP addresses to deliver and protect the site.

16. Changes and contact

If we change how Sana handles data, we will update this page and the date at the top, and tell you in the app before a change that needs your consent. Questions or requests: steward@arsana.cloud.

Sana is not a medical device, does not diagnose or treat any condition, and is not birth control.