Effective: September 25, 2026
Yumena (the "app") works without an account. Everything you enter stays on your device:
This data is encrypted on-device with AES-256; the encryption key is kept in the iOS Keychain / Android Keystore. No third party — including the developer — can access it.
Only when the app crashes or hits an unexpected error, diagnostic information is sent via Firebase Crashlytics (Google LLC) to help us fix bugs.
| Collected | Crash log (code location of the error), device model, OS version, app version, app installation identifier (Crashlytics installation UUID) |
|---|---|
| Never included | Health records (cycle, mood, symptoms, notes), name, contacts, location |
| Processor | Google LLC (United States) |
| Retention | Automatically deleted 90 days after collection |
This diagnostic data is not used to identify you and never for advertising or tracking.
To improve the app, we collect only app-usage behavior data via Mixpanel, Inc. Your health records and anything you type are never included.
| Collected | App usage events such as screen views and button taps (use of customization, shop, settings), device model, OS version, app version, language, in-app settings state (notification settings, selected character), in-app currency balance range and number of owned items, approximate location at country/city level inferred from IP address, a randomly generated identifier |
|---|---|
| Never included | Health records (cycle, mood, symptoms, notes), any text you enter, name, contacts, precise location such as GPS, advertising identifiers |
| Processor | Mixpanel, Inc. (United States) |
| Retention | Deleted no later than 5 years after collection (processor's retention standard) |
These usage statistics are used only to improve features, never for advertising or tracking. In the EEA, the UK and Switzerland, collection starts only if you consent in the app on first launch, and you can turn it off or on at any time under More > Data & privacy. Elsewhere, to stop collection or request deletion, contact us at the address in Section 6.
Watching an ad is one way to collect Moon Fragments. An ad is shown through Google AdMob (Google LLC) only when you tap "Watch ad" yourself, and the data below is sent at that point. If you never watch an ad, no ad-related data is sent.
| Collected | IP address (used to estimate approximate region), advertising identifier (Android advertising ID) and device identifiers, device model, OS version, app version, ad interaction records such as impressions, views and taps, ad SDK diagnostics |
|---|---|
| Never included | Health records (cycle, mood, symptoms, notes), any text you enter, name, contacts, precise location |
| Purpose | Serving ads, measuring ad performance, fraud prevention |
| Processor / sharing | Processed by Google LLC (United States). Shared with Google and Google's advertising partners in order to serve ads. |
| Retention | Per Google's advertising data retention policy |
This app requests ads with personalized advertising turned off — no interest profile is built about you to select ads. On iOS we never ask for tracking permission (ATT), so the advertising identifier (IDFA) is not collected. On Android you can reset or delete your advertising ID at any time under Settings > Privacy > Ads.
For details on how ad data is handled, see the Google Privacy Policy. In the EEA, the UK and Switzerland, ads are requested only after you consent in Google's consent management screen; if you decline, only the watch-an-ad feature is unavailable. You can change your choice at any time under More > Data & privacy > Ad privacy settings.
Character chat uses an external AI to generate the character's replies. It is enabled only after you explicitly opt in inside the app; if you don't, everything except chat works exactly the same. Because conversations may contain health- and emotion-related content (sensitive information), we explain the following and ask for separate consent before your first chat.
| Transmitted | The message you type and part of the recent conversation (up to 12 messages), your character's name, today's cycle phase name (e.g. "luteal phase"), app language |
|---|---|
| Never included | Your raw cycle records (dates, symptoms, notes), name, contacts, location, device identifiers |
| Recipient | Fireworks.ai, Inc. by default (contact: privacy@fireworks.ai). For service reliability it may be replaced by OpenAI, LLC or Anthropic, PBC depending on operations; all three are U.S. companies |
| Country / when / how | United States · sent over an encrypted connection (TLS) each time you send a chat message |
| Purpose / retention | Used only to generate the character's reply; none of the providers use it to train AI models. Fireworks.ai processes it immediately and does not store it (zero retention). If OpenAI or Anthropic is used instead, the provider keeps it for up to 30 days for abuse monitoring, then deletes it |
| Refusal | Simply decline on the consent screen — only the chat feature becomes unavailable. You can also withdraw at any time under More > Data & privacy |
Messages pass through our relay server (Firebase, Seoul region), which does not store or log conversation content. The only place your conversations are stored is your device, where they are automatically deleted after 90 days. You can also delete the entire conversation at any time under More > Data & privacy.
The community is a public board where people using the same language talk to each other. It opens only after you explicitly opt in inside the app; if you don't, the community — including simply reading posts — is unavailable while everything else works as before. Because posts may contain body- and emotion-related content (sensitive information), we explain the following and ask for separate consent before you start.
| Sent and stored | Post and comment text, nickname, app language, likes/reports/blocks, a random identifier generated by the app (no email, no login), and a hash of your deletion key |
|---|---|
| Never included | The health records on your device (cycle, mood, symptoms, notes), name, contacts, location, device identifiers, advertising identifiers |
| Visibility | Posts, comments and nicknames are visible to anyone in the same-language community. Anything you post can be read and saved by others, so please don't write anything that identifies you. |
| Storage / processor | Stored on Supabase (Seoul region). Processing is entrusted to Supabase, Inc. (United States) for operations and technical support (access from outside Korea is possible) |
| Automated review | Before publishing, the text is sent to Fireworks.ai, Inc. (United States) solely to judge whether it breaks the guidelines. It is processed immediately, not stored (zero retention), and never used to train AI models |
| Retention | Deleting a post hides it from others immediately. We keep the record privately so we can investigate reports, handle disputes and restore posts deleted by mistake; if you ask us to erase it, we remove the text and its link to you irreversibly |
| Refusal | Simply decline on the consent screen — only the community becomes unavailable |
Nicknames are suggested automatically so they have nothing to do with your real name, and because there is no account we cannot tell who wrote a post. You can delete your own posts and comments at any time in the app, and even after switching devices you can delete posts written on the old device using the deletion key included in your backup file (More > Community > My activity). Only a hash of that key is kept on the server.
Moving to a new device is done only through an encrypted backup file (.yumena) that you create yourself, protected by a password you choose. It never passes through our servers. If you forget the password, the backup cannot be restored.
More > Data & privacy > Delete all data erases everything irrecoverably at any time. Uninstalling the app also removes all on-device data.
You can ask to access, correct or delete your personal data, to stop its processing, and to withdraw consent. Because your health records live only on your device, you view, edit and delete them directly in the app, and you can take a full copy with the backup export (Section 3). Consent for chat, community and usage statistics can be withdrawn at any time under More > Data & privacy. For anything the app cannot do itself (for example deleting usage statistics or crash diagnostics), write to the address in Section 6 — we reply without undue delay and within 30 days at the latest.
LGTM · yumena.help@lgtm.co.kr
If this policy changes, we will announce it in the app or on this page at least 7 days before it takes effect.
The app is intended for people aged 16 and over. We do not knowingly collect personal data from anyone under 16, and we delete such data if we learn that it was collected.
If you are in the European Economic Area, the United Kingdom or Switzerland, the following applies in addition under the GDPR, the UK GDPR and the Swiss FADP. The controller is LGTM, Republic of Korea, reachable at the address in Section 6. We have not appointed a representative in the EU; all requests go to that email.
| Processing | Legal basis |
|---|---|
| App features (on-device records, backups, notifications) | Performance of our contract with you. Health records never leave your device, so we do not process them |
| Crash diagnostics (2-1) | Our legitimate interest in keeping the app stable. You may object by contacting us (Section 6) |
| Usage analytics (2-2) | Consent, asked in the app on first launch and withdrawable at any time in settings |
| Rewarded ads (2-3) | Consent, collected through Google's consent management screen (IAB TCF) and changeable at any time in settings |
| Character chat (2-4) | Explicit consent (messages may contain health-related, special-category data). Withdrawable at any time |
| Community (2-5) | Consent and performance of a contract. Withdrawable at any time |
International transfers. The processors in Section 2 are in the United States (some in the Republic of Korea). Transfers to U.S. companies rely on their certification under the EU-U.S. Data Privacy Framework or on the European Commission's Standard Contractual Clauses; the Republic of Korea is covered by an EU adequacy decision.
Rights. In addition to Section 5 you have the rights to data portability, to restriction of processing and in relation to automated decision-making, and you may lodge a complaint with the supervisory authority of your country (for example the AEPD in Spain or the ICO in the UK). The app makes no automated decisions and does no profiling.
Retention. The periods stated in the tables of Section 2 apply; once you withdraw consent, no further data is collected.