Mayla
English

Privacy policy

Last updated: 2026-10-16

Mayla is designed so that your health data stays on your phone. This policy explains what data is processed, why, and how you can access, export or delete it.

1. Data controller

Debugeo, a software development studio based in Colombia, is responsible for the Mayla app and for this website.

For any question or request about your data, write to privacidad@debugeo.com and mention that it concerns Mayla. We will never ask for your password by email.

2. Your data stays on your device

You can use Mayla without creating an account. In that case, everything you log is stored only on your phone and we never receive it.

Period, fertile window and ovulation predictions are calculated on your device and work offline. No data is sent to our servers to calculate them.

If you create an account, your data is also stored in it so you can restore it on another phone. App data is excluded from the operating system's cloud backups and phone-to-phone transfers.

3. Data we process

  • Health data you log: your period dates, symptoms, mood, flow, basal body temperature, ovulation and pregnancy tests, sexual activity, medication and contraceptive method, pregnancy and postpartum, weight, sleep, notes and the rest of your daily logs.
  • Profile: your goal (tracking your cycle, trying to conceive, tracking your pregnancy or perimenopause), your year of birth and, if needed, your month of birth, and the usual length of your cycle and your period.
  • Account, only if you create one: email, sign-in method (email and password, Google or Apple) and internal user identifier.
  • Consents: what you accepted, the version of the text and the date.
  • Health platforms, only if you connect them: the data you authorize us to read from or write to Apple Health or Health Connect.
  • Technical data: country, language, time zone, device model, app version, notification token and crash reports, without any health data.
  • IP address: our servers use it to protect the service against abuse and to limit the number of requests. We do not link it to your health data and we do not keep it in logs for longer than necessary for that protection.
  • Subscription: premium status, product, store and renewal dates. We never receive or store your card details.

4. Health data and consent

Data about your cycle, your fertility, your sex life and your health is specially protected data. We only process it with your explicit consent, which we ask for before you start using the app and which we store along with its date and version.

Without your health consent, no health data ever leaves your device.

You can withdraw your consent at any time in the settings. We will first offer to export your data; we will then delete the app data on your device and, if you have one, your account and all of its data.

5. What we use it for

  • Providing the service: storing your logs, calculating predictions on your device and sending the reminders you turn on.
  • If you have an account: keeping a copy of your data and syncing it across your devices.
  • Managing premium and recognizing purchases made in the store.
  • Protecting the service against abuse and verifying that requests come from the genuine app.
  • Detecting errors and improving the app's stability, without using health data.

We do not sell your data, we do not use it for advertising and we do not train artificial intelligence models with it.

7. Usage measurement and third parties

We measure how the app is used ourselves (for example, which screens are opened) without health data and with an identifier that changes over time and is not linked to your account. This measurement only starts after you accept the required consents.

Third-party analytics and attribution tools are turned off by default and are only turned on if you give your consent for third parties. They never receive health data and, where the GDPR applies, are never used to personalize ads. You can withdraw that consent whenever you like.

The public catalog of the events we measure will be published in this section before the app launches.

8. Service providers who help us

  • Google Firebase: authentication, account database, notifications, crash reports, app verification, remote configuration and, only with your consent, analytics.
  • Cloudflare: hosting of this website and of the app's server, and storage of the educational content.
  • RevenueCat: management of subscription status.
  • Apple App Store and Google Play: app downloads and subscription billing, under their own policies.

These providers may process data outside your country. We work with them under their data protection terms and only for the purposes described.

9. International transfers and representative

Some providers process data outside your country, as indicated in the previous section.

Information about the safeguards for these transfers and, where applicable, about our representative in the European Union and the United Kingdom is being prepared and will be published in this section before the app launches.

10. Retention and deletion

  • Data that is only on your device is kept until you delete it or uninstall the app.
  • While your account is active, we keep your data in it to provide the service.
  • If you delete your account or withdraw your health consent, we delete your account and its data from our systems within 30 days at most.
  • We may keep purchase records where the law or the stores require it.

The retention period for backups will be published in this section before the app launches.

11. Your rights

You can access, update, correct and erase your data, withdraw your consents, object to processing and obtain a copy of your data. A full export, in open formats, is always available for free in the app; you can also write to privacidad@debugeo.com.

In accordance with Colombian Law 1581 of 2012, we answer inquiries within 10 business days at most and complaints within 15 business days at most. You can also contact the Superintendencia de Industria y Comercio (Colombia's Superintendence of Industry and Commerce) or the data protection authority in your country, and exercise the rights granted to you by laws such as the GDPR or the CCPA.

12. Minimum age and minors

To use Mayla you must be at least 13 years old, or 16 if you live in the European Union, the European Economic Area or the United Kingdom. If the law of your country sets a higher age for consenting to the processing of your data, that age applies.

People under 18 can only use cycle tracking and educational content suited to their age. We apply the GDPR level of protection to all users for consents and the use of third parties.

If we learn that an account belongs to someone under the minimum age, we delete it.

13. Countries subject to international sanctions

Mayla is not published in the stores of Cuba, Iran, North Korea or Syria. If the app detects one of these countries, it does not assign you any country and only works on your device, without an account, purchases or third-party services, with the GDPR level of protection and a minimum age of 16.

14. Security

Communications are encrypted in transit, your account data can only be read by your account and the server verifies every request. On your phone, you can protect the app with a passcode or biometrics. No system is infallible: if we detect an incident that affects you, we will let you know.

15. This website

This website does not use cookies, analytics or third-party resources and does not run JavaScript. The hosting provider may log technical connection data for security purposes.

16. Changes

If we make significant changes to this policy, we will notify you in the app before they take effect and, where necessary, ask for your consent again. The date of the last update appears at the top.