RedCalendar Privacy Policy

Version of 6 October 2026. The previous version was in effect from 22 December 2020.

RedCalendar is a menstrual cycle calendar. What you record in it is information about your health, and the Operator treats it accordingly. This policy describes what data the Operator processes, why, where it is stored, who else receives it and how you can control it. It is written in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and applies to all versions of the RedCalendar iOS app and to the calendar.red website.

1. Who processes your data

The personal data operator is Artem Andreevich Bolotov, taxpayer ID (INN) 440123579144 (the “Operator”).

For any question about your data, write to support@calendar.red.

2. What data is processed

Account

• Email address — to sign in and for service emails (sign-in codes, confirming and changing the address).
• Phone number — only for accounts created in versions 2.x, and only to sign in. Signing in by phone number will be discontinued once users have added an email address to their accounts; the numbers will then be deleted.
• Name or how you would like to be addressed — optional. This is free text: you can use a nickname or leave it empty. It is used in the greeting and in the text of notifications.

Health information

This is a special category of personal data.

• the start and end dates of your periods, their length and flow;
• your ovulation day, if you confirmed or entered it;
• symptoms, mood and other tags you mark, including tags about your intimate life, if you use such tags;
• day notes — any text you write;
• cycle parameters: the cycle length and period length you entered or that the app calculated from your recorded cycles, and the luteal phase length calculated from confirmed ovulations.

Technical data

• the session identifier on your device, the device model, the time of the last sync;
• the push notification token, your time zone and whether you want to receive notifications;
• IP address — used only in the server's memory to limit request rates, and never stored;
• server logs — email addresses and phone numbers in them are masked, verification codes are not recorded;
• app performance data collected by AppMetrica: device model and operating system version, app version, error and crash reports, technical device identifiers. Health information is not sent to AppMetrica.

The Operator does not collect your surname, passport details, location, contacts, photos or payment details.

3. Why it is processed

• to create your account and let you sign in;
• to store your records and sync them between your devices;
• to predict periods, ovulation and the fertile window;
• to send notifications about upcoming cycle events, unless you turned them off;
• to protect your account: verification codes, the device list, notice of an email change, request rate limits;
• to answer your requests;
• to find and fix errors in the app.

The Operator does not use your data for advertising, does not sell it and does not pass it to third parties for their own purposes.

4. Legal basis

The Operator processes personal data on the basis of your consent (Art. 6(1)(1) of Law No. 152-FZ), and health information on the basis of your written consent, which you give in the app as an electronic document (consent text) (Art. 10(2)(1) of Law No. 152-FZ).

5. How and where data is stored

Processing is automated. The Operator collects, records, organises, accumulates, stores, updates (changes), retrieves, uses, transfers (provides, gives access to), blocks, deletes and destroys data to the extent needed for the purposes in section 3.

Data is stored on a server in the Russian Federation, in Yekaterinburg. A copy of your records is also kept on your device so the app works offline.

Who else receives data

The Operator uses the following services. Each receives only what it needs to do its job:

• Internet-Pro LLC (Yekaterinburg, Russia; NetAngels service) — hosting of the server and the database;
• YANDEX LLC and its affiliates (Moscow, Russia): Yandex Cloud Postbox — sending emails (email address and the email text); AppMetrica — app performance data;
• Quantek LLC (Saint Petersburg, Russia; Lancktele service) — the call that confirms your phone number when you sign in (phone number);
• Apple (USA) — delivering push notifications through Apple Push Notification service (device token, the type and day of the cycle event, and how you would like to be addressed, if you entered it);
• Google (USA) — only for versions 2.x, see section 6.

Data sent to Apple and Google is transferred across borders, as these companies are located in the USA.

6. If you use version 2.x

RedCalendar versions 2.x store data in Firebase, a service of Google LLC (USA): the account with its phone number, cycle records, notes and tags, notification tokens, and app performance data (Firebase Crashlytics, Google Analytics for Firebase, Performance Monitoring).

When you first sign in to the new version of the app, this data is copied to the Operator's server in Russia, and from then on the app works only with that server. Versions 2.x and Firebase will be shut down, after which the data in Firebase will be deleted. Until then, the data of version 2.x users continues to be stored and processed in Firebase.

7. Retention and deletion

• Data is kept for as long as your account exists.
• You can delete your account in the app: Settings → Profile → Delete account. The account is blocked immediately and signed out on all devices, and the data is destroyed permanently after 7 days. If you sign in within those 7 days, the account is restored as it was.
• After destruction, only the account's technical identifier and the deletion dates are kept — no email, phone or records. This makes sure deleted data cannot be restored from an old version of the app.
• Verification codes are valid for a few minutes. After an email change, the previous address is kept for 14 days so you can undo the change from the link in the email.
• Server logs are overwritten as they fill up.
• Database backups are kept by the hosting provider for about three weeks and then overwritten; deleted data disappears from them as they are overwritten — no later than 30 days after the account is deleted.
• If you withdraw your consent, the Operator will stop processing and destroy the data within 30 days.

8. Your rights

You can:

• get information about how your data is processed and a copy of the data itself;
• ask the Operator to correct, block or destroy data that is incomplete, outdated, inaccurate or processed unlawfully;
• withdraw your consent — by deleting your account in the app or by writing to the Operator;
• appeal against the Operator's actions to Roskomnadzor (the Russian data protection authority) or in court.

You can change your email address, how you would like to be addressed and your cycle parameters yourself in the app. Send any other request to support@calendar.red. The Operator will reply within 10 working days; if more time is needed, the Operator will tell you why, and the period will be extended by no more than 5 working days. The Operator may ask you to confirm that the request comes from the account owner — for example, by writing from the address linked to the account.

9. Children

The app is intended for users aged 14 and over. If you are under 14, you may use the app only with the consent of a parent or other legal guardian, who gives consent to the processing of data on your behalf.

If you are a parent and learn that your child under 14 uses the app without your consent, write to the Operator, who will delete the account.

10. How data is protected

• data between the app and the server is transferred only in encrypted form (HTTPS);
• only the Operator has access to the server and the database;
• sign-in codes are single-use, valid for a limited time and allow a limited number of attempts; request rates are limited;
• email addresses and phone numbers in logs are masked;
• the app shows the list of devices signed in to your account, and any session can be ended;
• the Operator notifies your previous address when your email address is changed.

The most common threat to your data is someone else getting into your phone. Protect it with a passcode, Face ID or Touch ID.

11. The calendar.red website

The website uses Yandex Metrica. It uses cookies and receives your IP address, browser details and the pages you viewed, so that the Operator can see visit statistics. You can block cookies in your browser settings.

12. Changes to this policy

A new version is published on this page with its date. The Operator will tell you about significant changes in the app. Previous versions remain available from the link at the top of this page.

13. Language

The Russian version of this policy is the primary one. If a translation differs from it, the Russian version prevails.

14. Contact

Artem Andreevich Bolotov, INN 440123579144
support@calendar.red