Privacy Policy

1. Who we are

Orgasmly is a personal-data tracking app operated as an independent project. The service is accessible at orgasmly.org. There is no corporate entity behind this service at this time; it is run by an individual developer. If that changes, this policy will be updated. For any privacy-related questions, contact us at privacy@orgasmly.org.

2. What we collect and why

Account data

When you sign up, we create a record containing:

• A Cognito user ID (a UUID) — this is your internal identifier
• A SHA-256 hash of your email address — used to prevent duplicate accounts and to send account-related transactional emails (e.g. verification code, password reset). We cannot reverse this hash to determine your address.
• Your email address is stored by AWS Cognito as part of their user pool service, under their own security controls. We do not copy it to our own database.
• Account creation timestamp and last-active timestamp
• Optional: age (integer, stored as-is), gender identity (from a fixed set of values you choose), and application preferences such as whether cycle-day tracking is visible

Session data

Every session you log is stored in DynamoDB under your user ID. Possible fields include:

• Timestamp of the session (supplied by you, validated server-side — future dates rejected)
• Intensity rating (1–10)
• Type (solo / partnered)
• Method tags (e.g. "manual", "vibrator") — free text, capped at 60 characters per tag, 30 tags max
• Duration and time-to-achieve in seconds
• Toy names (free text, same caps as method tags)
• Partner ID — an anonymous label you assign (not a name, not linkable to anyone)
• Mood and stress scores before/after (1–10 scales)
• Cycle day (1–28)
• Location tag (free text)
• Notes (free text, max 2,000 characters)
• Whether it was multi-orgasmic and orgasm count
• Your global analytics opt-in status at the time of logging

All free-text fields are sanitised server-side. Notes are capped at 2,000 characters. No field is required beyond intensity, timestamp, and type.

Data we do not collect

• IP addresses — CloudFront and API Gateway access logging is disabled. AWS WAF (which protects the Cognito authentication endpoint from abuse) may sample a limited number of requests for its own rate-limiting metrics, but these samples are not accessible to us and are not linked to your account or stored in our data stores.
• Location data (GPS, city, region)
• Device fingerprints or advertising IDs. The CloudFront security policy explicitly disables browser interest-cohort tracking (FLoC/Topics API).
• Browser or OS metadata beyond what AWS infrastructure inherently processes
• Real names
• Photos, audio, or any biometric data

3. How we use your data

Your data is used for exactly one purpose per category:

• Account data — authenticating you, preventing duplicate accounts, sending transactional emails you explicitly trigger (verification, password reset)
• Session data — powering your personal analytics (trends, correlations, heatmaps, history) inside the app
• Opted-in session data — if you opt in, your sessions are included in anonymised global aggregate statistics (see section 5)

We do not use your data for advertising, profiling, selling, or any purpose beyond operating the service.

4. Legal basis for processing (GDPR / Australian Privacy Act)

If you are located in the European Economic Area, the United Kingdom, or a jurisdiction with similar privacy law, we process your data under the following bases:

• Contract — processing your account and session data is necessary to provide the service you signed up for
• Legitimate interest — maintaining service security, rate-limiting abusive requests, and preventing fraud
• Consent — participation in anonymous global analytics is opt-in and requires your explicit consent. You can withdraw this at any time in Settings.

Under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), we note that this service collects sensitive information (sexual health data). Such information is collected only with your consent, used only for the purposes described in this policy, and is not disclosed to third parties.

Note on operator jurisdiction: This service is operated by an individual developer based in Australia. Data is stored in AWS's ap-southeast-2 (Sydney) region. If you are located in the EEA or UK, your data is therefore transferred to Australia. Australia is not currently deemed "adequate" under GDPR Article 45. By using this service, you consent to this transfer. If you have concerns, you can export and delete your data at any time.

5. Anonymous global analytics

If you opt in (via Settings → Global analytics), your sessions become part of a population-level data set. We apply strict protections before any aggregate is published:

• Minimum sample size of 50 — any statistic derived from fewer than 50 data points is suppressed entirely and not shown
• 90-day rolling window — only sessions from the last 90 days are included in live aggregates
• No individual records are exposed — the analytics pipeline reads session fields but publishes only computed averages, proportions, and correlations
• Retroactive — toggling opt-out removes your entire session history from the analytics pool immediately, not just future sessions
• Gender and age are optional inputs — if you have not set a gender identity or age, your sessions are still included in totals but excluded from gender/age-segmented breakdowns

The global stats page shows only published aggregates. No user-level data is accessible to other users under any circumstances.

6. Data sharing

We share your data with the following parties:

• Amazon Web Services (AWS) — our infrastructure provider. Data is stored in AWS DynamoDB and processed by AWS Lambda in the ap-southeast-2 (Sydney) region. AWS is a data processor acting under our instructions. AWS's data processing terms are governed by their Customer Agreement.
• Amazon Cognito — handles authentication. Your email address is stored by Cognito as part of their user pool service.

We do not sell, rent, or otherwise share your data with any other party. We do not use any advertising networks, analytics platforms, or data brokers.

Share links (optional)

You can optionally create a public share link from Settings. This generates a URL that exposes a subset of your aggregate stats (not individual sessions) to anyone with the link. You control the time window, whether achievements are included, and when the link expires. You can revoke share links at any time.

7. Data retention

• Active accounts — data is retained for as long as your account exists
• Deleted accounts — deleting your account immediately purges all session records, your user record, and your Cognito identity. This is irreversible from the application layer. However, AWS DynamoDB Point-in-Time Recovery (PITR) — a backup mechanism enabled as a data-protection safeguard — may retain snapshots for up to 35 days at the infrastructure level. These backups are not accessible to us in normal operation, and we do not use them to reconstruct deleted accounts.
• Opted-out analytics — retroactively removing your data from the aggregation pool is immediate at the application level. Pre-computed aggregate snapshots may reflect your data until the next recompute cycle (triggered by new opt-in sessions, or on a scheduled 6-hourly basis).

8. Security

• All data is transmitted over HTTPS (TLS 1.2+)
• Data at rest in DynamoDB is encrypted using AWS-managed keys (AES-256)
• Point-in-time recovery (PITR) is enabled on all DynamoDB tables — this allows restoration of deleted or corrupted data within a 35-day window. This is a data-protection safeguard, not a retention mechanism; it does not override account deletion.
• Authentication tokens are short-lived JWTs issued by Cognito (access token: 60 minutes, refresh token: 90 days), stored only in the browser's local storage
• API endpoints are protected by Cognito JWT authorisation — no endpoint accepts unauthenticated requests except the global stats read and public share link read
• CloudFront and API Gateway access logging is disabled to prevent IP address collection
• Rate-limiting via AWS WAF protects the Cognito authentication endpoint against credential-stuffing and mass sign-up abuse
• Input is sanitised and bounded server-side to prevent injection and oversized payloads
• Security response headers are enforced on all responses: HSTS (2 years, preloaded), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy disabling camera, microphone, geolocation, and interest-cohort

No security system is perfect. In the event of a breach that affects your data, we will notify affected users via the email address held by Cognito within 72 hours of becoming aware of it, in line with GDPR Article 33/34 obligations.

9. Your rights

You have the following rights over your data, exercisable at any time from within the app:

• Access — Settings → Export data downloads a complete JSON file of all your session records
• Deletion — Settings → Delete account purges everything immediately
• Rectification — every session can be edited or deleted individually from the History view
• Portability — the export format is plain JSON, human-readable and machine-parseable
• Withdraw analytics consent — toggle off in Settings → Global analytics at any time
• Object to processing — contact privacy@orgasmly.org

If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection authority. In Australia, you may contact the Office of the Australian Information Commissioner (OAIC).

10. Cookies and local storage

Orgasmly does not use advertising cookies or tracking cookies. The app uses browser localStorage to store your authentication tokens and cached session data for offline support. This data never leaves your browser except when making authenticated API requests to our servers.

We do not use cookies for any purpose. CloudFront may set a session cookie for load-balancing purposes, but this is not used by us for tracking and is not accessible to our application code.

11. Age requirement

Orgasmly is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you become aware that a minor has created an account, please contact privacy@orgasmly.org and we will delete it.

The optional age field accepts values from 0–100. Sessions logged by users under 18 (where age is provided) are excluded from all aggregate analytics computations, even if the user has opted in.

12. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top and notify active users via the email address held in their Cognito account. Continued use of the service after notification constitutes acceptance of the revised policy.

13. Contact

Privacy questions, data requests, or concerns: privacy@orgasmly.org