Privacy Policy
Last updated 2 October 2026
1. Who we are
FlowState is provided by Pevah Tech Solution ("we", "us"), a company based in Kenya. We are the data controller for the limited personal data described in this policy. This policy explains what data the app handles, why, where it is kept, and the choices and rights you have. It applies to the FlowState mobile app and to support you receive from us.
2. The short version
Your cycle and health data is encrypted on your phone before it is backed up, and only your device holds the key. We cannot read it, we do not sell it, we do not share it with advertisers, and we do not use it to profile you. The free version shows non-personalised ads that are never based on your health data. You can use the app without an email address and delete everything at any time.
3. Health data you enter
When you use the app you may record: period start dates, cycle and period length, flow, symptoms, moods, notes, water, sleep, temperature, weight, sexual activity, contraception details and reminders, ovulation and pregnancy test results, physical activity, your goal (such as tracking, trying to conceive, pregnancy, after birth or perimenopause), due date and baby's birth date, and an optional first name. Under the Data Protection Act, 2019 this is sensitive personal data. We process it only because you choose to enter it (your explicit consent), and only to provide the app's features to you.
4. How your health data is protected
Before anything leaves your phone, it is encrypted with AES-256-GCM using a random key created on your device and kept in its secure storage (Android Keystore or iOS Keychain). Our cloud provider stores only the encrypted result. Even the identifiers of your daily logs are disguised so that the dates you logged cannot be read. We, our providers and anyone who gains access to our servers see only unreadable data.
5. Account data
By default the app signs you in anonymously with a random ID, with no name, email or phone number. If you choose to create an account, we store your email address so you can sign in, and a copy of your encryption key that is itself encrypted with a key derived from your password (PBKDF2). This lets you restore your data on a new phone. We never receive or store your password; sign-in is handled by Firebase Authentication.
6. What stays only on your phone
Your app lock PIN is never stored, only a salted hash of it, kept on your device. Fingerprint and face unlock are handled by your phone; the app never receives your biometric data. Reminders are scheduled on your phone and work without our servers. Insights, charts, ovulation detection, the health check and downloadable reports are all calculated on your phone. Health check answers are not saved anywhere.
7. Home-screen widget and notifications
If you add the widget, it shows only a day count (for example, days until your period or weeks of pregnancy). While app lock is on, or when you are signed out, it shows no details. Notifications are set to hide their content on the lock screen, but how they appear also depends on your phone's settings.
8. Sharing you choose to do
The app never shares your health data on its own. If you use "Share a summary" or download a report, the app prepares the text or PDF on your phone and either saves it where you choose or hands it to the app you pick (such as WhatsApp or email). What happens next is controlled by you and that app, not by us. You can protect a report with a password; the file is then encrypted (AES-256) and the password is never stored, so we cannot open the file or recover a forgotten password.
9. Payments
Premium subscriptions are processed by Google Play or the App Store and managed by RevenueCat, Inc. They receive your random account ID and purchase details (product, price, dates and status). They never receive your health data. We do not see or store your card or mobile money details.
10. Advertising
The free version of FlowState shows ads provided by Google AdMob (Google LLC). All ads are non-personalised: they are not chosen based on your interests, your activity in other apps, or anything you enter in FlowState. We never send your health or cycle data, your name, email or account ID to AdMob. To deliver ads, count views and prevent fraud, Google's ads software collects limited technical information, such as your device's advertising ID, IP address, device model and operating system, and whether you tap an ad. Google explains how it uses this information at policies.google.com/technologies/ads. Where the law requires consent (such as in the European Economic Area, the United Kingdom and Switzerland), the app asks for it before any ad is shown. You can reset or delete your advertising ID in your phone's settings. Watching a rewarded ad is always your choice. Premium users see no ads.
11. Service providers and where data is stored
We use Google Firebase (Google LLC) for sign-in and encrypted backup, RevenueCat for subscriptions, and Google AdMob for ads in the free version. Their servers may be outside Kenya, including in the United States or the European Union. We rely on their contractual and security safeguards for these transfers, and your health data leaves your phone only in encrypted form and is never shared with AdMob. We do not use analytics or tracking tools in the app.
12. How long we keep data
Your encrypted data is kept for as long as you have an account. When you delete your account in the app, your profile, logs and wrapped key are deleted from our database immediately and your sign-in account is removed. Copies in our providers' routine backups are overwritten on their normal schedule. Purchase records may be kept by the app stores and RevenueCat as required for accounting and tax law. Emails you send us are kept only as long as needed to help you.
13. Important: keeping your data recoverable
Because only your device holds the key, we cannot recover your data for you. If you use the app without an email and uninstall it, lose your phone, or clear its data, your data cannot be restored. If you reset a forgotten password, data backed up with the old password cannot be unlocked. Add an email in Profile to keep a restorable backup.
14. Your rights
Under the Data Protection Act, 2019 you have the right to be informed about how your data is used, to access it, to correct it, to object to processing, to withdraw consent, to data portability, and to have your data deleted. You can view and correct everything in the app, with Premium, download it as a PDF report, and delete it instantly from Profile → Delete account and data. For any other request, email info@pevahtech.co.ke. We will respond within the time the law requires. Because your data is encrypted, some requests can only be carried out from your phone.
15. Complaints
If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.
16. Children and teenagers
The app is intended for people who have started having periods. If you are under 18, please use the app with the knowledge and consent of a parent or guardian. We do not knowingly collect data that identifies a child, and by default the app collects no identifying information at all.
17. Security incidents
We take reasonable technical and organisational measures to protect the service. If a breach affected your personal data, we would notify the Data Protection Commissioner and, where required, you, as the law requires. Because your health data is encrypted with a key only your device holds, it would remain unreadable.
18. Changes to this policy
We may update this policy when the app or the law changes. We will show the date of the latest version at the top of this page and, for important changes, tell you in the app before they take effect.
19. Contact
Questions about privacy or your data? Email support@pevahtech.co.ke, data requests to info@pevahtech.co.ke, or call / WhatsApp +254 714 497 853. FlowState is provided by Pevah Tech Solution.