Privacy Policy
Last updated: October 2026
Kesa is a cycle wellness app. Because we handle sensitive menstrual health data, this policy is specific and honest about what we collect, why, and how it's protected.
1. Who we are
Kesa is operated by Kesa Health ("we", "us"), a trading name of Stephanie Bapes Limited.
Website: meetkesa.com
Email: hello@meetkesa.com
2. What we collect
Account data
- Email address and display name — required to create an account.
Cycle and health data (you provide this voluntarily)
- Period start and end dates
- Cycle length, period length
- Symptoms, mood, and energy levels from daily check-ins
- Basal body temperature (optional, only if you enable it in Settings)
- Health conditions you disclose (e.g. PCOS, endometriosis, birth control) — used only to personalise guidance, never shared
- Notes and free text written during check-ins
Apple Health data (optional, requires your permission)
If you connect Apple Health, Kesa reads: step count, active energy, resting heart rate, heart rate variability, and sleep data. We never write to HealthKit. You can disconnect at any time in Settings → Apple Health.
Calendar data (optional, requires your permission)
If you connect Apple Calendar, Kesa reads event titles and dates on your device to notice things like travel or a busy stretch, so support can feel timely. Event details stay on your device until you connect, and this is revocable at any time in Settings → Apple Calendar.
Location (city-level, optional)
If you enable the local weather feature, we store an approximate, rounded, city-level location. We do not track your precise location or movement. Disable at any time in Settings.
Voice data
If you use voice check-ins or the Monthly Cycle Review, your audio is transcribed via AssemblyAI. Audio is not stored after transcription. The transcribed text may be stored as part of your check-in record.
Push notification token
If you allow notifications, we store a push token to deliver reminders and the weekly voice note you've opted into.
Subscription data
Managed via RevenueCat. We receive only your subscription status — never your payment card or billing details, which stay with Apple.
3. Why we collect it
| Data | Purpose |
|---|---|
| Cycle and health data | Core app function — phase calculation, ritual recommendations, insights |
| Check-in notes and symptoms | Personalised companion responses and pattern tracking |
| Apple Health data | Enriching cycle insights with body data |
| Calendar data | Contextual timing guidance in check-ins |
| Location (city) | Optional weather context in check-ins |
| Push token | Reminders and the weekly voice note |
| Voice transcription | Converting spoken check-ins to structured data |
| Subscription status | Determining access to Kesa Pro |
We do not use your health data for advertising. We do not sell your data.
4. Third parties we work with
| Service | Data shared | Purpose |
|---|---|---|
| Supabase | All stored app data | Database and authentication |
| ElevenLabs | Ritual script text | Text-to-speech for guided rituals |
| AssemblyAI | Voice audio (temporary only) | Transcription of voice check-ins |
| OpenAI | Check-in text and cycle context | AI insights and companion responses |
| Anthropic | Check-in text and cycle context | AI insights (via Supabase Edge Functions) |
| RevenueCat | App user ID, subscription events | Subscription management |
| Apple | Per Apple's own privacy policy | iOS platform, Sign in with Apple, payments |
| Per Google's own privacy policy | Sign in with Google (optional) |
We do not share personally identifiable health data with advertisers, data brokers, or analytics companies.
5. How we protect your data
- All data is encrypted in transit (TLS) and at rest
- Row-level security means only your account can read your records
- Authentication uses PKCE — your password is never stored in plain text
- In-app account deletion removes all your data immediately and permanently
6. Your rights
You have the right to:
- Access — request a copy of all data we hold
- Deletion — permanently delete everything via Settings → Delete Your Account, or by emailing hello@meetkesa.com
- Correction — update your data in-app at any time
- Portability — request your data in a readable format
- Withdraw consent — disconnect Apple Health, Calendar, or weather at any time
EU / UK users (GDPR): our lawful basis for processing sensitive health data is explicit consent, given when you enter that data. You may withdraw it at any time.
California users (CCPA): we do not sell your personal information. You have the right to know, delete, and opt out of any future sale (there is none).
7. Data retention
- Data is retained while your account is active
- Deleting your account removes all personal and health data from our systems
- Anonymised, aggregated data that cannot identify you may be kept for product improvement
8. Children
Kesa is not for children under 13. If we become aware a user is under 13, we will delete their account.
9. Changes
We'll notify you of material changes through the app or by email before they take effect.
10. Contact
hello@meetkesa.com
meetkesa.com