Your cycle stays on your phone. Back it up, and it’s locked first.
Splash keeps your cycle on your phone. No account needed, and optional sync is end-to-end encrypted, so we cannot read it.
In short: Splash is a private period tracker: everything you log stays on your phone by default and no account is needed. If you turn on sync, logs are encrypted on your phone with AES-GCM-256 before upload, so our EU server only stores a locked copy it cannot read. PIN, Face ID, decoy PIN and discreet mode are built in.
Your cycle lives on your phone. Optional sync is end-to-end encrypted.
No account needed
Open the app and start. If you never sign up, nothing about your cycle reaches us.
Encrypted backup and sharing
Sync, shares and the password-protected .splash backup file (photos included) are encrypted on your phone first. We hold the box, not the key.
Face ID, Touch ID or a PIN
Unlock with Face ID, Touch ID or your fingerprint, with your PIN as the backup. A second PIN can open a harmless decoy instead.
Wipe in one go
A panic wipe clears everything on the phone. Deleting your account deletes all server data.
Where is my period data stored?
Splash is local-first. Everything you log is stored on your phone, in the app’s own storage. No account, no email, no server copy. That is the default, not a setting you have to find.
Is sync end-to-end encrypted?
If you want your data on two devices, or a safety net, you can make an account. Before anything leaves your phone it is encrypted with AES-GCM-256 using a key that only your devices hold. Our server (Supabase, hosted in the EU) stores the locked box. We cannot open it.
What are the limits of Splash privacy?
- Someone with your unlocked phone can open the app, so set a PIN, with Face ID or Touch ID for speed.
- Browsers can clear storage when space runs low. Splash asks for persistent storage and nudges you to back up.
- Law enforcement can compel what we hold. That is ciphertext and account metadata.
Encrypted backup and partner sharing
Sync, shares and backup files are encrypted on your phone first. A backup is a password-protected .splash file that includes your photos. Your partner’s phone holds the key to what you share, and you can pause or revoke it any time.
Locks, decoys and wipes
Add a PIN, then unlock with Face ID, Touch ID or your fingerprint, with the PIN as the backup. Add a second, decoy PIN that opens an empty Splash. Turn on a panic wipe that clears everything on the phone. Delete your account and every server row goes with it.
Questions
Do I need an account?
No. Splash works fully without one. If you never sign up, nothing about your cycle reaches us.
Can Splash staff read my logs?
No. If you turn on sync, your logs are encrypted on your phone with AES-GCM-256 before upload, and we do not have the key.
What can the server see if I make an account?
Your email, when you sync and how big the sync is, which categories a partner share contains, push endpoints and the text of notifications (neutral by default).
What if I lose my phone?
With sync on, sign in on a new phone and use your recovery code. Without sync, restore from a backup file. If you lose both the device and the recovery code, we cannot recover your data.
More features
- Apps and widgetsiPhone with Apple Health, Apple Watch, widgets, Android with Health Connect, and the web.
- Partner sharingShare what you choose with a QR code. Pause or switch it off any time.
- Lock Screen timersLive Activities on iPhone: a dose countdown, your mini pill window and a contraction timer.
- PredictionsPeriod and fertile-window estimates shown as honest ranges.
- InsightsCycle history, patterns, gentle experiments and your yearly Wrapped.
- Doctor reportTurn months of logs into a tidy summary for your GP.
Compare: Splash vs Flo · Splash vs Clue · Splash vs Euki
Try privacy in ten seconds.
Your cycle lives on your phone. Optional sync is end-to-end encrypted. No sign-up: it opens in your browser.
Splash is not contraception and not a medical device. Predictions are estimates.