Second Spring is an Ardenholt program operated by Ruzylo Cloud, LLC. This sheet describes what we hold, why, and your rights over it. Privacy here is not a section of a policy — it is the architecture, and the rest of this page is mostly a description of things we arranged not to receive.
What we collect
- Your email address — only if you enter the register or subscribe. Used to write to you about Second Spring, and nothing else.
- Receipts and subscription status — if you subscribe, so that we can tell whether the app is unlocked.
- An authentication identifier — only if you choose to sign in. With Sign in with Apple we store the opaque identifier Apple gives us and never receive your real address unless you share it.
- Standard server logs — IP address, user agent, request path, kept no longer than thirty days for security and debugging.
- Payment details — handled entirely by the App Store or our payment processor. We never see or store a card number.
What we do not collect
Your symptoms. Your sleep. Your temperatures. Your cycle dates and the gaps between them. Your notes. The summary the app builds out of all of it.
That record is written on your device and stays there, protected by the phone's own encryption and, if you switch it on, by Face ID or Touch ID. There is no account holding it, no cloud copy, and no server of ours storing it — which means we cannot read it, cannot restore it for you, and cannot be made to hand it over to anyone. Records stay on the device unless you export them. If a sync feature is ever built it will be opt-in, and it will say so plainly before it moves a single entry.
The symptom check on this site
The symptom check runs entirely in your browser. The answers you give are never sent to us, never stored, and never attached to an address on the register — there is no request to intercept, because no request is made. Closing the tab is the whole of deleting it.
What we will not do
- We do not sell your data. Ever.
- We do not run third-party advertising trackers, and we ship no analytics SDK in the app.
- We do not use your record to train any model.
- We do not share your data with brokers, insurers, or employers.
- We do not operate, refer to, or take a share of any telehealth, clinic, or supplement service.
Health data, and the laws that name it
Reproductive and menopausal health data is treated as consumer health data under laws including Washington's My Health My Data Act. The strongest compliance position available to us was to arrange never to hold it, so that is the one we built: the record is on your device, and the only health-adjacent thing our servers ever see is the fact that an address asked to be told when the app ships.
Where the little of it lives
Register addresses and receipts are stored on our hosting provider's infrastructure in the United States. Apple stores App Store purchase and Sign in with Apple data under Apple's own policy, and our payment processor stores payment data under its own.
Your rights
All four go to privacy@ruzylo.dev. Because your record is not ours, an export from us will be short: an address and a receipt. Deleting the record itself is done on the device — wipe it in Settings, or remove the app — and there is no copy of it anywhere for us to delete on your behalf.
- Access — write to us and we send a copy of everything we hold on you within thirty days.
- Deletion — the same, and we delete within thirty days unless a law requires us to keep a billing record.
- Correction — the same address.
- Portability — exports come as JSON or CSV.
If we stop
The app keeps its record without a server, so it keeps working whether or not this company is still here. Your data outlives us by design. Nothing you have written goes dark because a business did.
Children
Second Spring is not intended for children under 13, or under 16 in the EU, and we do not knowingly collect data from them.
Changes
If this sheet changes materially we will update the effective date at its head and write once to anyone on the register. We will not weaken the on-device position, because it is not a setting — it is the product.
Contact
privacy@ruzylo.dev — Ruzylo Cloud, LLC, Thousand Oaks, California.