MoonstrateYour data and privacy
From Learn about your cycle. General wellness information, not medical advice. Sources.
Health data about your cycle is sensitive, and where it lives matters. Since 2022 there's been real concern about period-tracking data being used against people in places where abortion is criminalized, and that concern is justified. So far, the cases that have come to light relied on text messages, emails, and search history rather than period-app data, but the reach keeps growing. In 2025, a Texas sheriff's deputy searched more than 80,000 license plate cameras across the US looking for a woman who had ended a pregnancy, and court records later showed police had considered charging her. It only takes one case to set a precedent, so it's worth treating everything you create, from your messages to your apps, as something that could be asked for.
The documented harm has been apps sharing or selling your data. One well-known period app was found handing users' data to big tech companies despite promising not to, and regulators have since cracked down on health apps doing this. Ordinary medical-privacy law usually doesn't even cover consumer period apps, though newer laws in some places are starting to close that gap.
The strongest protection is simple: keep the data on your device. An app with no account and no server has no central database that can be subpoenaed, breached, or sold. That's how Moonstrate works: what you log stays on your phone, encrypted, with no account and no server behind it. If you turn on backup, it goes to your own cloud account, encrypted before it leaves your phone. On top of that, encrypting your phone with a strong passcode, keeping less data in the first place, and using encrypted messaging all help.
How Moonstrate protects your data
Everything you log is encrypted on your phone. That means it's scrambled so that only your password can unscramble it. There's no account and no server, so there's nothing on our end to hand over, leak, or sell.
Choosing your level. When you set up Moonstrate, you pick one of three levels, and you can change it later.
- Strong: a PIN of at least six digits, plus Face ID or your fingerprint day to day. Your data is encrypted at every level, so this is the starting point, not a weak option.
- Stronger: a passphrase instead of a PIN. A passphrase is a password made of a few words, at least 15 characters long. It makes the biggest difference if someone takes your phone and tries to break in with hacking tools.
- Strongest: a passphrase you type every time, with no Face ID or fingerprint shortcut, and no spare key anywhere, not even in iCloud. It also offers a decoy (more below). The trade-off: if you forget your passphrase and lose your recovery code, no one can open your data, including us.
PIN or passphrase? A PIN is quick and easy to remember. The app makes each guess take extra time on purpose, which is why there's a short pause after you enter it. But a six-digit PIN only has so many possible combinations. Every word you add to a passphrase makes it far harder to guess, and it only costs you a few more taps. So a longer passphrase beats a short one full of symbols. Three or four random words are easier to remember than a complicated password, and much harder to crack. The US government's own password guidelines, from the National Institute of Standards and Technology, recommend at least 15 characters.
Your recovery code. When you set up the app, you get a recovery code: a spare key that also opens your data. Keep it somewhere safe, like a password manager. There's no secret way in. We can't reset your password for you, because we never have it.
The iCloud spare key. On iPhone, the Strong and Stronger levels can keep a spare key in your iCloud account, so a new iPhone can open Moonstrate. It's on unless you turn it off. Apple encrypts it end to end and doesn't hold the keys, so Apple can't read it. But it does exist outside your phone. If someone gets into your Apple account, they could reach your iCloud Keychain: this spare key, along with every password you've saved there for other apps. You can turn it off anytime, and Strongest never uses it.
Backup and sync. Backup keeps a copy of your data somewhere else, so you don't lose it with your phone. Sync keeps your data the same across your devices. Both are off until you turn them on. When you do, a copy goes to your own iCloud or Google Drive, encrypted before it leaves your phone. Only you can unlock it.
Decoy unlock. On Strongest, you can set a shorter version of your passphrase that opens a harmless decoy instead of your real data. It's meant for when someone is pressuring you to unlock the app in person. To be honest about its limits: it won't fool the specialized tools police or experts use to examine phones, and nothing can protect your data if you give someone your full passphrase.
Keeping less. You can have Moonstrate automatically delete logs older than a time you choose. Less history means less that could ever be exposed, though it also means fewer patterns for Insights to find.
The full technical details are at moonstrate.app/security.