Mewa privacy policy
Last updated 14 november 2026.
The short version
everything you log stays on this phone. mewa has no ads, and never sells your data or shares it for marketing. mewa is made by cubeshell llc.
the one thing that will use mewa’s server is connecting your person, which comes in a later version and works only when you turn it on. the sections below say exactly what it will send and keep.
What mewa keeps on this phone
your period dates and daily logs (flow, symptoms, mood and notes), your cycle preferences, your look, your cravings, list and never items, your reminder and app lock choices, your age group (never a birth date), your care choices including the name you give your person, and where you are in setup.
it is stored encrypted, and the key is kept in your phone’s own secure storage. settings → what is stored where lists every item in plain words.
What leaves your phone
nothing, unless you choose. when you share a card, it goes through your phone’s share sheet to the app you pick, and that app’s own privacy policy applies. once shared, mewa can’t take it back. a card with your photo carries the picture only, without the photo’s location or camera details.
when you export your data, a copy goes wherever you send it. connecting a person is not available in this version yet, so mewa sends no messages.
Connecting your person (in a later version)
when you add your person, mewa’s server receives the first name you go by, your time zone, the name you call them, who they are to you and their phone number. mewa sends them nothing until they text mewa themselves to say yes.
when you tap tell, the server receives only what that one message needs: the level you chose, the tone, whether to use period wording and, if you allowed it, the day of your period (for example “day 1”). it holds the message for 60 seconds so you can undo it, waits until your quiet hours end, sends it, and then deletes what it said. a short record without the words (that a message went out, when, and whether it was delivered) is kept for 90 days, so nothing is sent twice.
the server never gets your period dates, daily logs, symptoms, moods, notes, predictions, photos, your contacts or an address. replies from your person are kept only until your phone fetches them, and for at most 30 days. a card sent as a text carries a short link to the card’s picture, which shows only the sticker and stops working after 7 days.
who helps mewa send: the server runs on supabase, and texts are sent by twilio. they process only what is needed to deliver each message, under their data processing terms, and never get your logs.
you can pause or disconnect your person any time from care, and they aren’t told why. deleting your data in settings also deletes what mewa’s server holds for you.
Your person and text messages
your person never needs mewa or an account. mewa keeps their phone number, the name you call them, and a record of when they said yes or STOP. they can stop all messages by replying STOP, and ask for their information to be removed by writing to contact@cubeshell.com.
text messaging originator opt-in data and consent will not be shared with any third parties. mobile numbers are never sold or shared for marketing or promotional purposes; the companies that deliver mewa’s messages process them only on mewa’s behalf.
the day of your period is health data. mewa’s server receives it only when you choose to tell your person, uses it only to write that one message, shares it only with the companies that deliver it, and deletes it once the message has gone. mewa does not sell health data.
What mewa never does
no analytics, no tracking, no advertising and no crash reports with your data. mewa doesn’t use your location and never stores, shows or shares an address. it never reads your contacts: when you pick your person from them, your phone hands mewa only that one contact. mewa reads your phone’s region setting to apply the age rule below and, when you add your person, to read a number written without a country code. it doesn’t keep it.
The website, heymewa.com
the app has no analytics. the website heymewa.com counts visits with google analytics, so we can see which pages help: the pages viewed, the site that sent you, your device type and your rough location. it never sees anything you log in the app, the page where your person says yes is never measured, and the page addresses it gets carry no names or links. google signals and advertising features are off.
in europe the website asks first and measures nothing until you say yes. anywhere else, choose “analytics choices” at the bottom of any page to turn it off, and a browser that sends global privacy control is treated as a no. google processes this data for cubeshell llc: policies.google.com/privacy.
Permissions
notifications: only for reminders you turn on, scheduled on this phone. face id, fingerprint or passcode: only for app lock; your phone checks it and mewa never sees it. camera: only when you choose to take a selfie for a card. photos: mewa gets only the one photo you pick in your phone’s own photo picker, and adds a card to your photos only when you choose to save it; it never reads your photo library. a photo you put on a card is drawn into it on this phone, and mewa keeps no copy of it.
Your control
export a readable copy any time from settings → my data. delete everything from the same place: it removes your records and the key that protects them. deleting the app also removes them.
your data is locked to this phone, so a phone backup can’t move it to a new phone. export first if you want a copy.
Age
mewa is for people 13 and older, and 16 and older in the european economic area and the uk. under 18, a partner, public cards and photos are off.
Changes
if this policy changes in a way that affects what leaves your phone, the date below updates and the app tells you before anything new is sent.
questions or requests? write to contact@cubeshell.com.