Privacy policy

1. Who we are

PCOS girly is made and operated by Divine Light Labs LLC (“we,” “us,” or “our”). This policy covers the PCOS girly mobile app, pcosgirly.com, and our associated launch and checkout website. We are responsible for the personal information we process to provide these services. Questions and privacy requests can be sent to bilal@divinelightlabs.com.

2. Information in the app

The current app does not require an account. Information you enter during onboarding—such as eating preferences, goals, health-related answers, birth year, height, and weight—is saved locally on your device to personalize the experience. Calculated profile estimates are also stored locally. The full onboarding profile is not sent with a meal-grading request.

When you grade a meal, the app saves a local copy of the photo and its result, including the grade, explanation, suggested swaps, estimated nutrients, and time. Recent meal history is stored on the device. Your device’s backup settings may include this app data.

Camera access lets you take a meal photo. Photo-library access or the system photo picker lets you choose an existing photo. You control these permissions in your device’s Settings. The app does not upload your entire photo library.

3. How photo grading uses AI

Photo grading requires an internet connection. The selected photo, your selected eating goal, and whether your onboarding answer indicates GLP-1 use are transmitted to our grading service, which runs on Cloudflare Workers and passes that information to Anthropic’s Claude API to generate the grade and explanation. This can include health-related information. A photo may also reveal personal details in its background; choose images carefully.

We use this information to respond to your grading request. We do not intentionally save meal-photo uploads or a copy of your full profile in our server database. That does not mean the processing is entirely on-device or that providers retain nothing. Infrastructure providers process network information such as IP addresses and may keep operational or security logs. Our grading service logs timing, model usage, and grade information; troubleshooting logs may include limited error or response text.

Anthropic’s published standard API policy provides for deletion of inputs and outputs within 30 days, with exceptions such as legal requirements, safety enforcement, or a separate agreement. We do not promise zero retention. See Anthropic’s API retention policy and Cloudflare’s privacy policy.

We do not use your meal photos or health-related answers to train our own AI models or for advertising. To avoid cloud processing, do not submit a photo for grading. You may continue viewing results already saved on your device.

4. Website, launch list, and payments

Website quiz: answers stay in the page’s memory. We do not submit them to our server, attach them to an email address, save them in browser storage, or send them to an ad platform. Refreshing or closing the page clears them. Website meal screens are illustrative samples and do not upload your personal photos.

Launch list: if you join, we collect your email, consent choice and version, signup timestamps, and a protected unsubscribe token. We use these to maintain the list and send beta and founder-enrollment availability updates. Signup is optional and separate from a purchase. You can unsubscribe using the provided link or by contacting us.

Founder orders: Stripe processes payment information and your receipt email. We keep order and payment identifiers, email, payment and refund status, purchase time, accepted offer terms, and activation dates to fulfill your purchase, support you, and honor refunds. We do not receive your full card number. Stripe may send payment and refund receipts. See Stripe’s privacy policy.

Hosting: the public website uses GitHub Pages. Our signup, checkout, and order service uses OpenAI Sites and Cloudflare infrastructure. Providers process website requests and may keep security and operational logs. Form protection uses a time-limited hash derived from the request IP address; the launch-list database does not store the raw IP address.

Support: if you email us or give feedback, we receive your address and the content you send. Please avoid sending medical records or other unnecessary sensitive information. We use correspondence to answer your request and improve the service.

5. Sharing and advertising

We share information with the service providers described above as needed to run the service, process a requested grade or payment, send service messages, and protect against abuse. Providers may also have their own legal obligations. We may disclose information when required by law or to protect legal rights, and in a business transfer subject to applicable privacy protections.

We do not sell personal information, share it for cross-context behavioral advertising, or target ads using health information. The current app has no advertising or third-party analytics SDK, and the website has no advertising pixel, session recording, or advertising cookie. Hosting and payment services may use their own essential security mechanisms.

6. Retention, deletion, and your choices

On your device: app information stays until you clear it or remove the app, subject to device backups. “Start over” clears the saved profile, onboarding answers, and history records. In the current version, saved photo files can remain in the app’s private storage after this reset; deleting the app removes its local storage. Offloading the app may preserve its data. You can separately manage device backups and original photos in Apple’s settings and Photos app.

On our services: we retain launch-list details while needed for the updates you requested or until you unsubscribe or ask for removal. Order information may need to remain for fulfillment, accounting, refunds, fraud prevention, and disputes. Support correspondence is retained as needed to resolve your request and related issues. Provider logs and AI processing records follow the applicable provider retention rules; a local reset does not delete those records.

You can request access, correction, deletion, or a copy of information we hold about you by emailing bilal@divinelightlabs.com. Depending on where you live, you may also have rights to restrict or object to processing, withdraw consent, appeal a privacy decision, or complain to a privacy regulator. We will respond under applicable law, may need to verify your request, and will explain any information we must keep. We will not discriminate against you for exercising a privacy right. Because app history is local and no app account is required, we cannot retrieve that history from your device.

7. Security and international processing

We use encrypted network connections and access controls appropriate to the service. No method of storage or transmission is completely secure. Protect your device and keep private order links confidential. Our providers may process information in the United States and other countries where they operate, whose privacy laws may differ from those where you live. Where required, applicable contractual safeguards govern these transfers.

Where a legal basis is required, we process information to provide the service you request, with consent where required for sensitive information or optional communications, to meet legal duties, and for legitimate service-security and support purposes where permitted.

8. Age and changes

PCOS girly is intended for adults aged 18 and over. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information to our service.

We may update this policy as the product changes. The effective date will show the latest revision. We will provide additional notice and request consent when required before materially changing how we use your information.