This is an English translation, provided for convenience. If it differs from the French version, the French version applies.
Last updated: August 5, 2026
This app is for tracking testicular thermal contraception. The information it records shows when you wear your ring, how your body responds, and where you are in your protocol. This is health data, and it is among the most sensitive data the law recognizes. We built this app accordingly, and this text says exactly what it does with your data.
1. Who is responsible
Moonring SAS, a société par actions simplifiée (simplified joint-stock company) registered under number 905 291 407, with its registered office at 11 rue de la Vanne, 50210 Saint-Martin-de-Cenilly, France, is the data controller for your data within the meaning of the GDPR.
For any question about your data, write to [email protected].
The Association Otoko, which runs the workshops and the research, is a separate entity. It receives none of your data, unless you authorize it, at some point, to receive it for a specific named study, under the conditions set out in section 6.
2. What the app records
Nothing is collected without your knowledge. Everything below comes either from what you enter or from your direct use of the app.
For your account
- your email address, which is used to log in and to recover a forgotten password
- a pseudonym, if you choose one. We never ask for your legal name.
- your year of birth, if you provide it
- the app language
For your tracking, this is health data
- your wearing times: start time, end time, and whether the timer was started from the app or from the lock screen
- the events you log: pain, discomfort, irritation, ring hold, sport, sex, urination, or a custom category, with an intensity from 1 to 5 and a written note if you add one
- your semen analysis results, if you enter them: date, concentration, and a free-text note
- the devices you wear: model, size, variant, and a note
- your protocol settings: target wearing time, usual start time, start date, gradual start, and whether your contraception is active
To make the app work
- your notification preferences
- the record of your consent: its date and the version of the text you accepted
- technical server connection logs, including your IP address, kept for a maximum of 30 days and never linked to your tracking
What we do not record: no photos, no location data, no contacts, no advertising identifier, no browsing profile.
3. No trackers, no analytics
The app contains no analytics tools, no advertising trackers, and no third-party data-collection SDKs. No Google Analytics, no Firebase, no Facebook, and nothing equivalent. This is not a statement of intent, it can be checked: the code is open, and the only address the app contacts is our own server.
We sell nothing, we rent nothing, we trade nothing. There is no business model attached to your data, and there never will be.
4. Why we process this data
- to provide the tracking you came for: the tally of your wearing time, your progress, your reminders, and keeping your history from one device to another
- to let you log in and recover your account
That is all. No other purpose, and in particular no profiling and no automated decision-making concerning you.
5. On what legal basis
The processing of your health data is based on your explicit consent, within the meaning of Articles 6(1)(a) and 9(2)(a) of the GDPR. This is why the app asks for your consent before giving you access to tracking, and not after.
You can withdraw this consent at any time, from Profil, then Retrait du consentement (Profile, then Withdrawal of consent) in the app. Withdrawal does not affect the lawfulness of what was already done before it, but it stops the processing and lets you delete your data. Withdrawing consent is as easy as giving it, as Article 7(3) requires.
6. Who has access to your data
No one at Otoko looks at your data individually. We have no dashboard that displays your tracking, and we do not open your account. Technical access to the database is restricted to the administration of the service, and it is controlled: each account can only read its own rows, including from the app, through a rule enforced by the database itself.
Two technical service providers are necessarily involved, solely to run the service:
| Provider | What it does | What it sees |
|---|---|---|
| Hostinger International Ltd. | hosts the server, in the European Union | hosts the data, encrypted in transit, without accessing it |
| Brevo (Sendinblue SAS, France) | sends confirmation and forgotten-password emails | your email address only, never your tracking |
If you use a test version distributed through TestFlight, Apple knows the email address you used to join the test. This gives Apple no access to your tracking.
Sharing for research purposes is separate, and it has two separate parts.
- You can agree that your data may be used for anonymous statistics. Anonymous means that no individual row leaves, only totals and averages that cannot be used to identify you. This is optional, and you can change it at any time.
- The sharing of individual data, even in pseudonymised form, never happens through a box ticked at sign-up. It can only happen study by study, in the settings, after we have told you who receives what, and for what purpose. As long as you have not agreed to anything of that kind, nothing leaves.
We do not transfer any data outside the European Union.
7. How long we keep it
Your tracking data is kept as long as your account exists, then for 3 years after your last activity, after which it is deleted. This period exists because contraception gets interrupted and resumed, and a history lost between two periods is a useless history.
You do not have to wait for this period: you can delete your account at any time from the app, and deletion is immediate and permanent. It removes your tracking, your events, your settings and your account itself.
Technical connection logs are kept for a maximum of 30 days.
8. Your rights
The GDPR gives you rights, and the app lets you exercise them without going through us:
| Right | Where | How |
|---|---|---|
| Access and portability (Arts. 15 and 20) | in the app | export of all your data as reusable CSV files |
| Rectification (Art. 16) | in the app | your wearing times, events and settings can be edited |
| Erasure (Art. 17) | in the app | account deletion, immediate and permanent |
| Withdrawal of consent (Art. 7(3)) | in the app | Profil, then Retrait du consentement (Profile, then Withdrawal of consent) |
| Objection and restriction (Arts. 18 and 21) | [email protected] | write to us |
We reply within one month at most.
If you are not satisfied with a reply, you can lodge a complaint with the CNIL (the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.
9. How your data is protected
- on your phone: tracking data stored locally is encrypted (AES-GCM), and the key is kept in the system’s secure keychain. Your login session is encrypted in the same way.
- in transit: all communication with the server goes through HTTPS.
- on the server: each account is isolated by a rule enforced by the database, not by the app’s code. One account technically cannot read another account’s rows.
- when you log out: the local cache is erased, after checking that nothing is waiting to be sent.
No system is invulnerable, and we will not claim otherwise. In the event of a personal data breach that presents a risk to you, we will inform you and notify the CNIL, as Articles 33 and 34 require.
10. Minors
The app is not intended for people under 15, and we do not seek to collect their data.
11. This is not a medical device
The app is a tracking tool. It does not diagnose anything, it does not prescribe anything, and it does not replace medical follow-up. Testicular thermal contraception requires follow-up semen analyses and the support of a healthcare professional.
12. Changes
If we change this text, the date at the top changes. If the change affects what we do with your data, we will let you know in the app and, where the law requires it, ask for your consent again.