This Privacy Policy explains how Kalitasha Limited handles account and learning data, and how the KoreeMoon app stores health-related logging data locally on your device and in your device calendar.
api.firstperiod.org and firstperiod.org for account, profile, course, lesson, achievement, leaderboard, and progress features.KoreeMoon is a menstrual cycle, mood, symptom, event, and learning app developed and operated by Kalitasha Limited, a company registered in Scotland, United Kingdom.
This policy governs the KoreeMoon mobile app and related account, learning, support, website, and backend services used to provide the app.
Data Controller: Kalitasha Limited
Company Director: Dr. Ndalinoshisho Liita Iyaloo Naukushu Cairney
Registered Address:
Kalitasha Limited
44/3 Frederick Street
Edinburgh EH2 1EX
Scotland, United Kingdom
Privacy Contact: Liita@Kalitasha.com
Websites: koreemoon.me and firstperiod.org
The table below separates data Kalitasha Limited receives through backend services from logging data that the current app handles locally on your device or in your device calendar. If your chosen calendar syncs with a provider such as iCloud, Google, Exchange, or another calendar service, that provider may also store or process the calendar entries under its own terms.
| Data Type | What This Includes | Where It Is Stored and Why |
|---|---|---|
| Account data | Email address, username, password or authentication credentials submitted during registration or sign-in, account identifiers, profile details, sign-in tokens, and session state. | Sent to KoreeMoon backend services to create and manage your account, sign you in, keep your session active, protect account security, and provide account-linked features. Sign-in tokens and session state are also stored locally on your device so the app can keep you signed in. |
| Menstrual cycle data | Cycle history, period dates, predicted cycle timing, and cycle-related calendar entries. | Stored locally on your device and derived from calendar logs. It is used to show cycle views, period history, pattern information, reminders, and cycle-related summaries. Kalitasha Limited does not receive this data through the current mobile app. |
| Menstrual flow data | Flow intensity selections such as no flow, light, medium, or heavy flow. | Saved as calendar event notes on the device calendar or calendar account you choose. It is used to record period days, understand flow patterns over time, and support cycle tracking features. Kalitasha Limited does not receive this data through the current mobile app. |
| Pain levels | Pain ratings such as no pain, mild, moderate, or severe pain. | Saved as calendar event notes on the device calendar or calendar account you choose. It is used to track pain alongside cycle timing and compare symptoms across days and cycles. Kalitasha Limited does not receive this data through the current mobile app. |
| Mood ratings | Mood, energy, peace, anticipation, courage, and related rating selections. | Saved as calendar event notes on the device calendar or calendar account you choose. It is used for mood logging, daily reflection, trend views, and comparisons with cycle timing. Kalitasha Limited does not receive this data through the current mobile app. |
| Symptom tags | Selected tags such as nausea, acne, headache, diarrhoea, constipation, body ache, and similar symptom labels available in the app. | Saved as calendar event notes on the device calendar or calendar account you choose. It is used to record symptoms, review symptom patterns, and understand how symptoms relate to cycle and mood logs. Kalitasha Limited does not receive this data through the current mobile app. |
| Personal thought logs | Personal notes, emotion selections, reflection text, and other thoughts you choose to record. | Saved as calendar event notes on the device calendar or calendar account you choose. It is used for journaling, reflection, mood tracking, and historical review features. Kalitasha Limited does not receive this data through the current mobile app. |
| Event logs | Event titles, dates, times, notes, locations you type into events, recurrence settings, alerts, and calendar identifiers. | Saved to the calendar you choose. It is used to create and show events, connect app activity to your calendar view, and support reminders and day summaries. Kalitasha Limited does not receive this data through the current mobile app. |
| Learning, profile, and progress data | Course lists and lesson content loaded from FirstPeriod services, course progress, lesson activity, achievements, points, streaks, leaderboard data, character/profile summaries, and related learning metadata. | Sent to or retrieved from KoreeMoon backend and website services where signed-in learning features are used, to provide course, lesson, profile, achievement, leaderboard, and progress features. |
| Lesson website and web traffic data | Lesson page requests, authentication tokens shared with the in-app lesson WebView, cookies, local storage, IP address, user agent, browser/WebView information, and request metadata. | Processed by firstperiod.org and api.firstperiod.org to load web lessons, keep you signed in, check account status, serve course images and content, protect the service, and troubleshoot issues. This does not include health logs created in the mobile logging screens. |
| Support and privacy request data | Emails, request content, account identifiers, and information needed to verify and answer your request. | Sent to Kalitasha Limited only when you contact us. It is used to respond to support, deletion, access, correction, portability, and other privacy requests. |
| Technical data | App version, platform, device or browser context, IP address, request timestamps, server logs, diagnostic information, performance information, and security logs where applicable. | May be processed by app stores, hosting providers, backend services, and support tools where enabled. It is used to operate, secure, debug, maintain, and improve KoreeMoon and its connected services. |
KoreeMoon does not use local logging data for medical diagnosis, medical treatment, emergency care, or contraception. KoreeMoon is an informational tracking and reflection app.
KoreeMoon uses locally stored app data and backend account data for the following purposes:
Before you log health data for the first time, KoreeMoon asks for separate health data consent. This is separate from accepting any terms of use.
The consent prompt explains that KoreeMoon stores menstrual cycle data, symptoms, mood, and personal notes on your device and in your device calendar to help you understand cycle patterns over time. It gives you a genuine choice to agree or decline. If you decline, basic non-health parts of the app remain available, but health logging features may not save health information.
You can withdraw consent for future health logging by stopping use of the health logging features and deleting any local health logs you no longer want stored. Because the current mobile app does not send health logs to Kalitasha Limited, contacting us or deleting your account will not remove health logs that exist only on your device or in your calendar. You can delete those logs in the app where available, delete the calendar events from your calendar, clear local app storage, remove the relevant calendar account from your device, or uninstall the app. You can delete your account from Settings, and you can contact us at Liita@Kalitasha.com for account data and privacy rights requests.
KoreeMoon uses the following storage and service locations:
api.firstperiod.org and firstperiod.org for account, profile, course, lesson, progress, achievement, leaderboard, content, and web lesson features. The current mobile app code does not send health logs to these services.Data sent between the app, website, and backend services is protected in transit using HTTPS/TLS. Local device and calendar data is protected by the security features of your device operating system and calendar account. Backend data is protected using reasonable technical and organisational controls and the security controls provided by our managed infrastructure providers.
No internet or database system can be guaranteed to be completely secure. We take reasonable technical and organisational measures to protect personal data and health data against unauthorised access, loss, misuse, alteration, or disclosure.
We do not sell your personal data or health data. We do not share your data with advertisers or data brokers. We do not use your data for cross-app or cross-site advertising tracking.
We may share or make data available to the following recipients only where needed to operate KoreeMoon. Where a third-party provider processes personal data for us, we expect that provider to protect the data consistently with this policy and applicable privacy law.
| Recipient or Processor | What They Handle | Why |
|---|---|---|
| KoreeMoon and FirstPeriod services | Account, authentication, profile, course, lesson, progress, achievement, leaderboard, content, web lesson, and related technical request data processed by api.firstperiod.org and firstperiod.org. Health logs are not sent to these services by the current mobile app code. |
To provide signed-in account and learning features. |
| Backend hosting, database, email, and infrastructure providers | Account-linked backend data, learning progress data, website data, server logs, support emails, and infrastructure security data handled on behalf of Kalitasha Limited. | To host, store, secure, deliver, and support KoreeMoon and FirstPeriod services. |
| Calendar providers selected by you | Calendar events and event notes if you save logs to a device calendar that syncs with a provider such as iCloud, Google, Exchange, or another calendar account. | To store the calendar entries you choose to create and make them available through your calendar account. |
| Apple and app stores | App Store distribution data, device permission prompts, operating-system calendar access, local notification delivery, and app-store diagnostics or analytics where provided by the platform. | To distribute the app and support operating-system features such as permissions, local calendar access, and notifications. |
| Recipients chosen by you | Export files, screenshots, emails, or other information you choose to send using your device share sheet, email app, calendar app, or another service. | To complete sharing or support actions that you initiate. |
| Legal, regulatory, or safety recipients | Information required by law, court order, regulator, or valid legal process. | To comply with legal obligations and protect rights, safety, and security. |
The KoreeMoon mobile app does not use advertising cookies, does not use the Apple advertising identifier, and does not track you across apps or websites owned by other companies for advertising or advertising measurement.
KoreeMoon opens lesson pages from firstperiod.org in an in-app WebView. These pages may use strictly necessary cookies, local storage, authentication storage, or similar technologies to keep you signed in, load lessons, protect the service, and remember essential settings. Web traffic may also create ordinary server logs such as IP address, user agent, request time, and requested URL. This data is used for app functionality, security, and service reliability, not to sell health data or target advertising.
We retain data for specific periods so you can understand what happens to KoreeMoon data:
| Data Category | Retention Period |
|---|---|
| Account, profile, learning, progress, achievement, leaderboard, and related backend data | Retained while your account is active. After account deletion, deleted or anonymised within 30 days, unless a longer period is required for legal, security, fraud-prevention, or dispute records. |
| Health logs, including cycle data, menstrual flow data, pain levels, mood ratings, symptom tags, personal thought logs, and event logs stored on your device or in your device calendar | Retained until you delete the relevant calendar events, use available in-app deletion tools, clear app storage, remove the calendar account data from your device, or uninstall the app. KoreeMoon cannot delete data from your calendar after the app is removed, and calendar providers may keep synced entries according to their own settings and policies. |
| Local app data on your device | Retained on your device until you delete it in the app where available, clear app storage, clear temporary cache, remove calendar entries, or uninstall the app. |
| Backend backups | Backend backups of account and learning data are deleted or overwritten within 90 days after the primary data is deleted, unless required for legal or security reasons. |
| Support and privacy request records | Retained for up to 24 months after the request is resolved, so we can evidence how we responded. |
| Security, server, diagnostic, and support logs | Retained for up to 12 months where kept by us or our service providers, unless a specific issue requires longer retention for security investigation or legal compliance. |
If you are signed in, you can delete your KoreeMoon account in the app from Settings > Delete Account. The app asks you to enter your current password before sending the deletion request to KoreeMoon backend services.
You can also request deletion of your KoreeMoon account and backend account-linked data by emailing Liita@Kalitasha.com with the subject line KoreeMoon Data Deletion Request. Please include the email address or username connected to your account. We may ask for information needed to verify that you control the account before deleting data.
After we verify your request, we will delete or anonymise account-linked backend personal data within 30 days, except where we must keep limited records for legal, security, fraud-prevention, or dispute-resolution reasons.
Health logs, mood logs, thought logs, and event logs that are stored only on your device or in your calendar must be deleted from your device or calendar by you. The app includes tools for deleting calendar events by date range where available, and you can also delete calendar events directly from your calendar app. Deleting your account does not delete calendar-only logs that were never sent to Kalitasha Limited.
Kalitasha Limited is based in the United Kingdom, so KoreeMoon is subject to UK GDPR where it applies.
Depending on your location and the data involved, you may have the right to:
To exercise these rights, email Liita@Kalitasha.com. We will respond within the timeframe required by applicable law.
KoreeMoon is intended for users aged 9 and older. Because younger users may use the app, users who are below the age at which they can consent to personal data processing in their country should use KoreeMoon only with parent or guardian involvement and consent.
Users can use local cycle and logging features without creating an account. If a child creates an account or provides personal data in a way that requires parental consent or removal under applicable law, a parent or guardian can contact us at Liita@Kalitasha.com and we will review the request.
Some service providers may process data outside the United Kingdom. Where UK GDPR requires safeguards for international transfers, we rely on appropriate safeguards such as adequacy regulations, standard contractual clauses, processor terms, and equivalent legal mechanisms provided by our service providers.
We may update this Privacy Policy from time to time to reflect changes to KoreeMoon, our service providers, or legal requirements.
When we update the policy, we will revise the "Last Updated" date at the top of this page. If a change materially affects how we use health data, we may provide additional notice or request renewed consent where required.
If you have questions, deletion requests, access requests, correction requests, portability requests, consent withdrawal requests, or other privacy requests, contact:
Email: Liita@Kalitasha.com
Suggested Subject Line: KoreeMoon Privacy Request
Postal Address:
Dr. Ndalinoshisho Liita Iyaloo Naukushu Cairney
Kalitasha Limited
44/3 Frederick Street
Edinburgh EH2 1EX
Scotland, United Kingdom
KoreeMoon
Copyright 2026 Kalitasha Limited. All rights reserved.