Privacy Policy

1. Who we are

Cykl (the iOS and Android apps, the web app at app.cykl.io and this website) is operated by Ludmila Sevcenco, Republic of Moldova, and developed by Piotr Sevcenco (“we”, “us”). The operator is the controller of the personal data described here. Questions go to [email protected].

Cykl was called MasteryOS until 30 September 2026, at masteryos.app. It is the same app, the same operator and the same data; only the name and the addresses changed. Anything you agreed to or received under the old name applies to Cykl.

2. What we collect

Your account

• Email address and password, if you sign up with email. The password is handled by Firebase Authentication; we never see it.
• Sign in with Apple or Google: the identifier and email address the provider shares with us, and your name if you choose to share it.
• Profile: the name you enter, an optional profile photo (stored as a small image in your account), and an optional birth date, which the app uses to place your lifetime cycle.

What you write in the app

Your cycles (days, weeks, months and beyond), actions, projects, habits, metrics and scores, targets, check-ins, reflections, vision exercises, domains, settings and cover choices. This is the content of the app, and it is synced to your account so every device you sign in on has the same copy.

Health and fitness data you choose to log

If you track health metrics — such as weight, sleep and wake times, steps, exercise minutes, heart rate, HRV, blood pressure or body fat — the values you enter are stored with the rest of your content. Logging them is entirely optional.

The app does not read Apple Health, Google Fit, sensors or wearables itself. If you choose to connect one, an app or script you set up (such as Health Auto Export) can send readings — for example sleep, steps, resting heart rate or weight — to your account using an access token you create in Settings → Integrations. We store each reading with its date and the name of the source that sent it, and use it to fill the matching day. You can remove the token at any time, and the connection stops.

We never sell health data, use it for advertising, or share it with anyone except the service providers listed below when you use a feature that needs it (for example, when Ask Cykl reads your sleep to answer a question about energy) and the apps you connect yourself.

Voice check-ins

If you use voice entry, speech is turned into text by your device’s speech recognition service (Apple’s on iOS, Google’s on Android, your browser’s on the web), under that provider’s terms. We never receive or store the audio. The resulting text is sent to our server to be organised into your check-in, as described under AI features. The app asks for microphone access only when you start a voice entry, and you can refuse or revoke it at any time.

Purchases

When subscriptions are available, the App Store, Google Play or our web checkout provider handles payment. We never see your card details. We receive your subscription status (plan, trial, renewal and expiry dates) so the app knows what you have access to.

Usage and technical data

• AI usage: how much of your AI allowance your account has used in the current day and month (measured by the estimated cost of each request), so we can apply fair-use limits. The content of your requests is not part of this record.
• Server logs: when your device talks to our servers, our hosting provider records technical details such as IP address, time, the address requested and the response. These are used to keep the service running and secure.
• Agent access: if you create access tokens for an external assistant or app in Settings → Integrations, we keep the tokens’ names and scopes and a log of the changes made with them, so you can see and undo them.

What we do not collect

No advertising identifiers, no location, no contacts, no third-party analytics or tracking SDKs. Reminders are scheduled on your device; we do not send push notifications and hold no push token.

3. How we use it

• To provide the app — sign you in, store and sync your data across your devices, and compute your scores. (Legal basis: performance of our contract with you.)
• To run AI features you ask for — see below. (Contract.)
• To manage your subscription — trial, access and restoring purchases. (Contract.)
• To keep the service safe and fair — rate limits, AI allowances, abuse prevention and debugging. (Our legitimate interest in operating a secure service.)
• To contact you about your account — email verification, password resets and important changes to the service. We do not send marketing email.

We do not sell your personal data, share it for advertising, or use it to build advertising profiles.

4. AI features

Suggestions, summaries, drafts and voice check-ins. These send the relevant part of your content (for example, the cycle you are planning or the text of your check-in) from our server to Anthropic, which runs the Claude model that writes the suggestion. Every result comes back to you as a proposal you accept or discard; nothing is written to your data without your action.

Ask Cykl. When you ask it a question, our server reads your synced record — cycles, reflections, metrics (including health values), projects and vision — and sends Claude the parts it needs to answer: an overview of where you are now, then the periods, reflections, projects and numbers it looks up along the way, which can span years. It reads your record and changes nothing. Your questions and its answers are not saved to your account; a conversation lasts only while the app is open. To answer follow-up questions quickly, our server may keep a working copy of your record in memory for up to 10 minutes; it is never written to disk.

Your email address and account identifiers are not sent to Anthropic, though the content itself may identify you if it names you. Anthropic processes this data on our behalf and does not use data sent through its API to train its models.

AI features only run when you use them. Everything else in the app works without them, and you can simply not use them.

5. Who processes it for us

We use a small number of service providers. Those that process your data on our behalf are bound by data-processing terms and may use it only to provide their service to us:

Apps and assistants you connect. An access token you create in Settings → Integrations lets whatever holds it read your data, and — if you give it the write scope — make changes to it. That app or assistant (for example an AI assistant on your computer, or a health export app) is chosen and run by you, not by us, and handles what it reads under its own terms. You can see every change it made, undo it, and delete the token at any time.

We may disclose data if the law requires it, or to protect the rights and safety of our users or the service. If Cykl is ever sold or transferred, your data would move with it under this policy, and we would tell you first.

6. Where it is stored

Your account data is stored in Google Cloud’s United States multi-region, and a full copy lives on each device you sign in on so the app works offline. If you are in the EU, UK or Switzerland, transfers to the United States rely on our providers’ certification under the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

7. How long we keep it

• Your account and content: for as long as you keep your account. Deleting your account erases it from our servers immediately; residual copies in our providers’ backups expire within their standard backup cycles.
• Deleted items: when you delete a single record, a small marker is kept so your other devices learn it was deleted.
• Data on your devices: stays until you sign out, delete the account, or uninstall the app.
• Server logs: kept for up to 30 days.
• Purchase records: kept as long as the law requires for tax and accounting.

8. Your rights and choices

Wherever you live, you can:

• Export all your data at any time: Settings → Data → Export.
• Correct anything you have entered, directly in the app.
• Delete your account and all its data: Settings → Account → Delete account, on any platform (step by step). If you signed in with Apple, deleting also revokes the app’s access to your Apple ID.
• Revoke permissions such as microphone or notifications in your device settings.

If the GDPR, UK GDPR or a similar law applies to you, you also have the right to access, rectify, erase, restrict or object to processing of your data, and to data portability. You can exercise any of these by writing to [email protected]; we answer within 30 days. You may also complain to your local data protection authority.

California residents: we do not sell or share personal information as those terms are defined in the CCPA/CPRA.

9. Security

Data is encrypted in transit (HTTPS) and at rest on our providers’ infrastructure. Access to your data on our servers is limited to your own signed-in account and the access tokens you create; database rules enforce it. Tokens are stored only as hashes. AI calls go through our server so no provider keys live in the app. No system is perfectly secure, and if a breach affects your data we will tell you and the relevant authorities as the law requires.

10. Children

Cykl is intended for adults and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, write to us and we will delete it.

11. Changes to this policy

When we change this policy we update the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.

12. Contact

Ludmila Sevcenco (operator), Cykl, Republic of Moldova — [email protected]