Privacy Policy

1. Who we are

Orgasmly is a personal-data tracking app operated as an independent project. The service is accessible at orgasmly.org. There is no corporate entity behind this service at this time; it is run by an individual developer. If that changes, this policy will be updated. For any privacy-related questions, contact us at privacy@orgasmly.org.

2. What we collect and why

Account data

When you sign up, we create a record containing:

• A Cognito user ID (a UUID) — this is your internal identifier
• A SHA-256 hash of your email address — used to prevent duplicate accounts and to send account-related transactional emails (e.g. verification code, password reset). We cannot reverse this hash to determine your address.
• Your email address is stored by AWS Cognito as part of their user pool service, under their own security controls. We do not copy it to our own database.
• Account creation timestamp and last-active timestamp
• Optional: age (integer, stored as-is), gender identity (from a fixed set of values you choose), and application preferences such as whether cycle-day tracking is visible
• Optional: medication records (free-text names, start/end dates for tracking time periods). These are stored per account, excluded from global statistics and share links, included in your data export and deleted when you delete your account.

Session data

Every session you log is stored in encrypted storage under your user ID. Possible fields include:

• Timestamp of the session (supplied by you, validated server-side — future dates rejected)
• Intensity rating (1–10)
• Type (solo / partnered)
• Method tags (e.g. "manual", "vibrator") — free text, capped at 60 characters per tag, 30 tags max
• Duration and time-to-achieve in seconds
• Toy names (free text, same caps as method tags)
• Partner ID — an anonymous label you assign (not a name, not linkable to anyone)
• Mood and stress scores before/after (1–10 scales)
• Cycle day (1–28)
• Location tag (free text)
• Notes (free text, max 2,000 characters)
• Whether it was multi-orgasmic and orgasm count
• Your global analytics opt-in status at the time of logging

All free-text fields are sanitised server-side. Notes are capped at 2,000 characters. No field is required beyond intensity, timestamp, and type.

Data we do not collect

• IP addresses — CloudFront and API Gateway access logging is disabled. AWS WAF (which protects the Cognito authentication endpoint from abuse) may sample a limited number of requests for its own rate-limiting metrics, but these samples are not accessible to us and are not linked to your account or stored in our data stores.
• Location data (GPS, city, region)
• Device fingerprints or advertising IDs. The CloudFront security policy explicitly disables browser interest-cohort tracking (FLoC/Topics API).
• Browser or OS metadata beyond what AWS infrastructure inherently processes. The one exception is the mobile app's optional error reports, which include the app version and the phone's system version (section 10)
• Real names
• Photos, audio, or any biometric data

3. How we use your data

Your data is used for exactly one purpose per category:

• Account data — authenticating you, preventing duplicate accounts, sending transactional emails you explicitly trigger (verification, password reset)
• Session data — powering your personal analytics (trends, correlations, heatmaps, history) inside the app
• Opted-in session data — if you opt in, your sessions are included in anonymised global aggregate statistics (see section 5)

We do not use your data for advertising, profiling, selling, or any purpose beyond operating the service.

Trusted viewers. You can choose to give a specific person read-only access to your dashboard (Settings → Sharing → Trusted viewers). This only ever happens when you create an invite and send it to them yourself, and the person signs in with their own separate account — you never share your password. You decide how much they see (everything, sessions without your notes, or stats only), whether the access expires, and you can revoke it at any time. A trusted viewer can only look: they can never add, edit, delete, or export your data. This is a disclosure you initiate and control, not a third party we share your data with.

4. Legal basis for processing (GDPR / Australian Privacy Act)

If you are located in the European Economic Area, the United Kingdom, or a jurisdiction with similar privacy law, we process your data under the following bases:

• Contract — processing your account and session data is necessary to provide the service you signed up for
• Legitimate interest — maintaining service security, rate-limiting abusive requests, and preventing fraud
• Consent — participation in anonymous global analytics is opt-in and requires your explicit consent. You can withdraw this at any time in Settings.

Under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), we note that this service collects sensitive information (sexual health data). Such information is collected only with your consent, used only for the purposes described in this policy, and is not disclosed to third parties.

Note on operator jurisdiction: This service is operated by an individual developer based in Australia. Data is stored in AWS's ap-southeast-2 (Sydney) region. The one exception is the mobile app's optional error reports, which are held on our own server in the us-east-1 (N. Virginia) region (section 10). If you are located in the EEA or UK, your data is therefore transferred to Australia. Australia is not currently deemed "adequate" under GDPR Article 45. By using this service, you consent to this transfer. If you have concerns, you can export and delete your data at any time.

5. Anonymous global analytics

If you opt in (via Settings → Global analytics), your sessions become part of a population-level data set. We apply strict protections before any aggregate is published:

• Minimum sample size of 50 — any statistic derived from fewer than 50 data points is suppressed entirely and not shown
• 90-day rolling window — only sessions from the last 90 days are included in live aggregates
• No individual records are exposed — the analytics pipeline reads session fields but publishes only computed averages, proportions, and correlations
• Retroactive — toggling opt-out removes your entire session history from the analytics pool immediately, not just future sessions
• Gender and age are optional inputs — if you have not set a gender identity or age, your sessions are still included in totals but excluded from gender/age-segmented breakdowns

The global stats page shows only published aggregates. No user-level data is accessible to other users under any circumstances.

6. Data sharing

We share your data with the following parties:

• Amazon Web Services (AWS) — our infrastructure provider. Data is stored in AWS DynamoDB and processed by AWS Lambda in the ap-southeast-2 (Sydney) region. AWS is a data processor acting under our instructions. AWS's data processing terms are governed by their Customer Agreement.
• Amazon Cognito — handles authentication. Your email address is stored by Cognito as part of their user pool service.
• Our error tracker (mobile app, only if you switch on error reports) — an open-source tool called GlitchTip that we run ourselves, on an Amazon Lightsail server in the us-east-1 (N. Virginia) region of our own AWS account. It is ours, not a third party's, and it is the one server we run outside Sydney. See section 10 for what a report holds.

We do not sell, rent, or otherwise share your data with any other party. We do not use any advertising networks, analytics platforms, or data brokers.

Share links (optional)

You can optionally create a public share link from Settings. This generates a URL that exposes a subset of your aggregate stats (not individual sessions) to anyone with the link. You control the time window, whether achievements are included, and when the link expires. You can revoke share links at any time.

7. Data retention

• Active accounts — data is retained for as long as your account exists
• Deleted accounts — deleting your account immediately purges your session records, saved analysis, share links, delegated-access grants and invites, feedback entries, your user record, and your Cognito identity. This is irreversible from the application layer. However, AWS DynamoDB Point-in-Time Recovery (PITR) — a backup mechanism enabled as a data-protection safeguard — may retain snapshots for up to 35 days at the infrastructure level. These backups are not accessible to us in normal operation, and we do not use them to reconstruct deleted accounts.
• Opted-out analytics — retroactively removing your data from the aggregation pool is immediate at the application level. Pre-computed aggregate snapshots may reflect your data until the next recompute cycle (triggered by new opt-in sessions, or on a scheduled 6-hourly basis).

8. Security

• All data is transmitted over HTTPS (TLS 1.2+)
• Data at rest in DynamoDB is encrypted using AWS-managed keys (AES-256)
• Point-in-time recovery (PITR) is enabled on all DynamoDB tables — this allows restoration of deleted or corrupted data within a 35-day window. This is a data-protection safeguard, not a retention mechanism; it does not override account deletion.
• Authentication tokens are short-lived JWTs issued by Cognito (access token: 60 minutes, refresh token: 90 days), stored only in the browser's local storage on the website, and in the phone's secure storage (the iOS Keychain or Android Keystore) in the app
• API endpoints are protected by Cognito JWT authorisation — no endpoint accepts unauthenticated requests except the global stats read and public share link read
• CloudFront and API Gateway access logging is disabled to prevent IP address collection
• Rate-limiting via AWS WAF protects the Cognito authentication endpoint against credential-stuffing and mass sign-up abuse
• Input is sanitised and bounded server-side to prevent injection and oversized payloads
• Security response headers are enforced on all responses: HSTS (2 years, preloaded), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy disabling camera, microphone, geolocation, and interest-cohort

No security system is perfect. In the event of a breach that affects your data, we will notify affected users via the email address held by Cognito within 72 hours of becoming aware of it, in line with GDPR Article 33/34 obligations.

9. Your rights

You have the following rights over your data, exercisable at any time from within the app:

• Access — Settings → Security → Export your data downloads a complete JSON file of all your session records
• Deletion — Settings → Security → Delete account purges everything immediately
• Rectification — every session can be edited or deleted individually from the History view
• Portability — the export format is plain JSON, human-readable and machine-parseable
• Withdraw analytics consent — toggle off in Settings → Global analytics at any time
• Object to processing — contact privacy@orgasmly.org

If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection authority. In Australia, you may contact the Office of the Australian Information Commissioner (OAIC).

10. Cookies and local storage

Orgasmly does not use advertising cookies or tracking cookies. The app uses browser localStorage to store your authentication tokens and cached session data for offline support. This data never leaves your browser except when making authenticated API requests to our servers.

We do not use cookies for any purpose. CloudFront may set a session cookie for load-balancing purposes, but this is not used by us for tracking and is not accessible to our application code.

The mobile app. The app does not use cookies. It keeps your sign-in in the phone's secure storage and a cache of your recent sessions on the device, and signing out clears both. If you turn on streak reminders, they are scheduled on your phone itself: nothing is sent to our servers or to any push service, and a reminder never says what you logged. Widgets and the Lock Screen timer on iPhone are off until you turn them on. While one is on, we store your phone's Apple push token with a random id the app makes for that install (not a hardware identifier) and which of the two switches is on. When your data changes we ask Apple to send your phone a blank nudge, a few minutes later and at most one every 15 minutes, so the widgets can refresh. The nudge carries nothing, but Apple can see that one was sent. Turning both switches off, signing out and deleting your account remove the token, and one that is never used again expires after 90 days. If you turn on app lock, your phone's Face ID or fingerprint check does the unlocking, and Orgasmly never receives your face or fingerprint. The app contains no advertising or analytics code.

Error reports (mobile app). Off until you turn on Send error reports in Settings. If the app then hits an error, it sends a short report so the error can be fixed. The report holds the error message (shortened, with emails, ids, links, IP addresses and long numbers removed), which part of the app failed, and your app and phone system versions. It holds nothing from your entries or your account, and it is not linked to your account, so deleting your account has no reports to delete. Your IP address is not kept: the server removes it before the report is processed, and we checked that none is stored. Reports go to a server we run in the us-east-1 region (United States) and are deleted after 90 days. Turning the switch off, or signing out, stops reports straight away, and signing out also turns the switch off. Only errors in the app's own code are reported, at most 20 per launch. The app uses an open-source error-reporting library for this, which does nothing while the switch is off.

11. Age requirement

Orgasmly is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you become aware that a minor has created an account, please contact privacy@orgasmly.org and we will delete it.

The optional age field accepts values from 0–100. Sessions logged by users under 18 (where age is provided) are excluded from all aggregate analytics computations, even if the user has opted in.

12. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top and notify active users via the email address held in their Cognito account. Continued use of the service after notification constitutes acceptance of the revised policy.

13. Contact

Privacy questions, data requests, or concerns: privacy@orgasmly.org