FREYJA · · 6 min read
What 'On-Device' Actually Means for a Cycle App
Cycle apps like to say 'on-device' and 'private by design'. The phrase has become marketing. Here is the technical definition we hold ourselves to with Freyja, and the questions you should ask any health app that uses the same words.
A growing number of cycle and wellness apps use the phrase "on-device" or "private by design" in their App Store description. The phrase is starting to mean less because more people use it and fewer apps are pinned to a strict definition of it.
We use it about Freyja. We want to be specific about what we mean.
A Practical Definition
An app is on-device when:
- The data you log is written to storage that physically lives on your phone.
- Reading that data, displaying it, generating summaries from it, and computing predictions from it can all happen without a network request.
- Nothing about your health record is sent to a server controlled by the company that makes the app.
- There is no account that maps your health data to your identity on a backend.
If any of those four are not true, the app is doing something else. That something else may still be reasonable. It is not on-device.
This list is the test we apply to Freyja before we ship a feature.
What This Excludes
A few patterns that get described as on-device but do not pass the four-point test:
Cloud sync that is "encrypted at rest." The data still leaves your phone. Encryption protects it on the server, but the server has it. If the company is subpoenaed, the data is reachable. On-device means the data is not on a server at all.
On-device AI that uploads context to a remote model. A feature that computes a summary "on your phone" but sends the summary to a hosted AI for phrasing has moved your data to a third party. The phrasing step is the leak.
Anonymous analytics on health events. Aggregated event counts can identify a small user inside a small app. "We collect anonymous usage data" is not the same statement as "we do not collect health data."
Optional account, default off. If creating an account is the path of least resistance, most users will create one. The default decides what most data does, not the option.
Freyja avoids all four.
How Freyja Implements It
Cycle history, mood logs, hydration, UV exposure, sleep notes, and any context that a user types into the companion are written to local iPhone storage. Specifically:
- Cycle and health logs use Core Data with file protection set so the data is unreadable when the phone is locked.
- Companion conversations run against an on-device model. Prompt context, recent logs, and answers stay on the device.
- There is no Freyja account. There is no email, no password, no user ID on a PelagicLabs server.
- Backups go through the user's own iCloud backup of the device, encrypted with the user's iCloud key. PelagicLabs has no access to that backup and no key for it.
The PelagicLabs server is involved in two things: app updates through the App Store and a contact form for support. Neither carries your health data.
Why This Constrains the Product
The architecture is the limit. We cannot build a feature that needs cloud history, because there is no cloud. We cannot ship a remote AI feature, because the data does not leave the device. Cross-device sync that is not iCloud is not on the roadmap, because cross-device sync without our cloud is genuinely hard.
That has product consequences. Freyja does not have a web dashboard. Freyja does not have a "share with your doctor" link. Freyja does not have a public profile. Each of those features would require a different architecture, and the different architecture would mean a different relationship with your data.
We pick the constraint on purpose.
Questions to Ask Any "Private" Cycle App
If you are evaluating a cycle, fertility, mood, or wellness app, the following questions are short and concrete:
- Does the app create a user account on a server you do not control? If yes, your health data is associated with an identity on that server.
- Does the app sync between your phone and a tablet or web view? If yes, the data is stored somewhere central.
- Does the in-app AI run locally or as a hosted call? Hosted calls are uploads.
- What does the app's privacy policy say about subpoenas, mergers, and acquisitions? A privacy policy can be rewritten by the next owner.
- Does the app work fully in airplane mode? If a feature you use needs the network, that feature is not on-device.
These are the same five questions we ask ourselves before adding anything to Freyja.
Why It Matters Now
Cycle data has always been sensitive. The current legal climate in several countries makes that sensitivity concrete. A cycle log can be a record of a missed period, a pregnancy, a miscarriage, or a decision. None of those should live on someone else's server because the app needed a feature.
On-device is a structural answer to that problem, not a marketing one. The structure has to be built that way from the start. Bolting it on later means moving an existing user base, and that almost never happens.
Freyja was built that way from the start. That is what we mean when we use the phrase.
Related notes
FREYJA · 2 May 2026 · 6 min read
Why Your Hydration Goal Shouldn't Move With Your Cycle
A growing number of cycle apps adjust your daily water target by phase. The evidence does not support that adjustment. Here is what the literature actually says, what cycle phase does change, and why Freyja keeps the number steady.
FREYJA · 2 May 2026 · 4 min read
Freyja 2.0.5 Makes Mood Check-Ins Less Blank
Freyja 2.0.5 adds preset feelings to mood check-ins, keeps Today focused on one useful read, improves over-goal hydration progress, and tightens companion answers around your actual data.
FREYJA · 3 April 2026 · 4 min read
One App for Your Whole Body, Zero Data in the Cloud
Your cycle tracker knows more about you than your doctor. Who else has access? Freyja tracks hydration, cycle, mood, and UV exposure -- and none of it ever leaves your phone.