Tracking disclosure updated September 15, 2026
peri is a private, offline-first symptom and treatment tracker. The app does not require an account and does not operate a server-side health database. Optional analytics is stored separately using an installation credential, without an account or health entries.
Information you enter—including symptoms, medications, treatment follow-ups, appointment questions and plans, lab results, notes, profile details, questionnaire scores, and screening dates—is stored locally on your device. The developer does not receive or have access to this information. In the native iPhone and iPad app, the health record is stored in an encrypted file using a device-bound key kept in the iOS Keychain and is not copied into WebView browser storage. The browser/PWA version uses browser local storage, which peri does not encrypt.
Apple Health connection is optional, read-only, and begins only when you select Connect Apple Health or Sync Apple Health. peri requests read access to step count, sleep analysis, and body weight. It saves only the displayed aggregate step and sleep summary and latest body-weight value in your device-local peri record. It does not write to Apple Health, read data in the background, store or expose raw samples or source/device metadata, or send Apple Health data to the developer, analytics, attribution, advertising, or subscription providers. Raw sleep samples are processed transiently on the device to calculate the displayed aggregate. Apple may not disclose whether an individual read type was denied, so unavailable values are not treated as zero. You can change Health access in iOS Settings and remove the saved summary from peri at any time.
Optional App Lock uses Apple’s local authentication interface for Face ID, Touch ID, or device-passcode fallback; peri does not receive or store biometric data. Reminder preferences and notification identifiers are stored in the iOS Keychain. Notifications are scheduled locally, use generic wording, and contain no symptoms, treatment names, or other health details. Permission is requested only when you enable and save a reminder. The Home Screen widgets receive only whether today’s check-in is complete and how many of the last seven days are confirmed. They do not receive symptom values, medications, labs, notes, profile details, or Apple Health values.
On the new native tracking runtime, analytics starts off. If you opt in, peri sends allowlisted feature-use and checkout events to its API/database, filtered product events to PostHog, and performance and sanitized errors to Expo Observe. Event context includes session, app/build, operating-system and OTA release versions. PostHog uses a provider-specific pseudonym derived from a random installation credential, not a RevenueCat account ID. This is pseudonymization, not anonymity. No health answers, readings, notes, email, or reports are included. Check-in/report feature events are excluded from PostHog.
The same optional choice permits fully masked native onboarding-preview recordings. Text, images, inputs and the root content are masked; console and network capture are disabled. The health-record WebView and other routes are not recording surfaces. Change this choice in Profile. Turning it off stops future optional traffic; a request already received by a service cannot be recalled.
Apple ATT is independent of optional analytics. Only granted Apple permission allows AppsFlyer startup and selected onboarding/paywall/checkout events. Advertising stops in the background and permission is checked again on foreground. Android advertising stays disabled. peri uses no direct Meta or TikTok SDK in this runtime; AppsFlyer partner integrations may forward approved attribution to advertising partners when configured. These services receive ordinary network connection metadata. No health entries or raw subscription account IDs are supplied by the app.
Configured production builds send sanitized crash/error diagnostics to Sentry independently of optional analytics. Error messages are replaced with safe labels; user, request, extra and breadcrumb data are discarded. Screenshots, view hierarchies, Sentry replay, tracing and profiling are disabled. Expo performance reporting follows optional analytics consent.
An active subscription remains required regardless of either privacy choice. RevenueCat processes anonymous subscription identifiers, validates purchases, and restores access. When Apple tracking permission allows, peri sets RevenueCat's AppsFlyer-generated subscriber attribute for subscription attribution; revocation clears it. RevenueCat is the sole paid-revenue source; mobile purchase-completion events only measure checkout behavior. Apple handles payment. No health entries are sent to RevenueCat.
Profile offers analytics deletion independently of your local health record. A deletion request removes first-party analytics records and pending captures and queues PostHog event/recording erasure. If offline, the device keeps the request and retries on foreground. Provider erasure is asynchronous; a minimal hashed tombstone prevents the deleted installation from submitting further events. A temporary empty pseudonymous PostHog profile is used for erasure. This control does not erase Apple's subscription records or all providers' diagnostics/advertising records. Contact us for additional provider-data requests. Product events have bounded retries; only accepted server jobs survive process termination.
Providers include Expo, PostHog, Sentry, AppsFlyer, RevenueCat, and the configured API/database host. Ordinary connection metadata may reach these services. The browser health tracker does not load native tracking SDKs. The separate download page has no ad pixel; its App Store button opens AppsFlyer OneLink. Older installed native runtimes can retain their earlier SDK behavior until updated.
If you export a backup, CSV, PDF, or clinician report, you control where that file is stored or sent. The native app can create a portable .menocompass backup encrypted with a password you choose; that password is never stored or recoverable by the developer. Plain JSON, CSV, and PDF exports may contain sensitive health information and are not encrypted by peri, so save or share them only with services and people you trust.
From Profile under Account & data, Reset onboarding restarts setup without deleting your profile answers, health logs, treatments, labs, or reports. Delete app profile & data permanently erases the complete device-local copy after a separate confirmation. Removing the app or clearing its local storage also removes the local copy. Deletion cannot be undone unless you previously created a backup, and it does not cancel an Apple subscription.
peri provides general education and self-tracking. It is not a medical device and does not diagnose, prescribe, or replace care from a qualified clinician.
For privacy questions, email kyl3kan3@gmail.com.