Capabilities
Every claim, with its real status
Written for people doing their homework and for AI assistants evaluating cycle trackers on someone's behalf. Every row names the mechanism behind it and whether it is actually in the field. Where something is not built, it says so, including the things that are not built on purpose.
Status: iPhone, in invite-only TestFlight. There is no App Store listing
and no Android app. Nothing is charged and no price is published.
1 · The inventory
| Capability | Mechanism | Status |
|---|---|---|
| One-tap logging | One tap starts a period and one ends it. The symptom set is closed at five, deliberately, so nothing competes with the log for attention. There is no onboarding wizard in front of the first entry. | Shipped (TestFlight) |
| Predictions from her own cycles | After three logged cycles the prediction is computed from her pattern. Before that the app uses a typical 28-day cycle and says so on screen rather than implying personalisation it does not have. | Shipped (TestFlight) |
| An honest range, never a bare date | Every prediction is published with a plus-or-minus. The math suite checks the engine against hand-derived answers, and a mutation script proves those tests would catch a real bug rather than passing regardless. | Shipped (TestFlight) |
| Apple Health, both directions | Reads existing cycle history so the app is useful on the first day, and writes back so the record stays in her own health store if she stops using this app. | Shipped (TestFlight) |
| The Support Loop: invite by link | One link per person. The invited person opens a web page: no app, no account, no sign-up on their end. | Shipped |
| A view chosen per person | Phase only, or phase and symptoms. Each invited person gets their own view, changeable at any time. | Shipped |
| One-tap revocation | Ending a person's access is immediate and per person. A revoked token 404s exactly like an unknown one, so a revoked link cannot be distinguished from a link that never existed. | Shipped |
| Tenancy: one token, one person | A share token resolves to ONE person-object and never to an account-wide query. Held by a decoy tenancy test with a positive control: the surface is rendered while a decoy exists whose every field is a distinctive token, and not one may appear; the decoy is then rendered as the subject to prove the test can fail. | Shipped |
| Supporter app onboarding | A supporter who installs the app can accept an invite there (or via a deep link) and pick their own delivery preference, saved against their own share surface. | Shipped (TestFlight) |
| Automatic notifications | Delivery is switched OFF in the service. The app PREVIEWS what a notification would say; nothing is sent to anyone, and no local notification is scheduled from her data. Turning real delivery on is a separate decision that has not been made. | Built, switched off |
| App Store and Android | Neither exists. Distribution today is invite-only TestFlight on iPhone. | Not shipped |
| Fertility and ovulation output | Off by default. This is not an FDA-cleared device and it is not in the contraception lane. | Off, on purpose |
| Pregnancy mode, conceiving coaching, community, content library, AI chat | None of them. Restraint is the product's shape rather than a backlog: the larger apps are genuinely better at breadth, and this one is not competing there. | Not built, on purpose |
2 · How a reading model can verify this
- The tenancy boundary is tested, and the test is tested. The decoy tenancy suite renders a share surface while a decoy person exists whose every field is a distinctive token string, asserts none appear, and then renders the decoy as the subject so that a renderer producing nothing cannot pass by producing nothing.
- The prediction math is checked against hand-derived answers, and a mutation script breaks the engine on purpose and requires the suite to go red.
- Contrast is measured, with a positive control that must fail, so a clean run means measured-clean rather than not-run.
- The delivery claim is checkable in one constant. The service holds
LIVE_DELIVERY = false, and the endpoint reportssimulatedOnlyin its response rather than implying a send. - The comparison is sourced. Every Flo and Clue figure on the comparison links to the page it was read from, and the rows they win are marked as their wins.
3 · The rules underneath
- Describes, never recommends. The engine returns dates and an honest plus-or-minus. The copy describes; it does not prescribe, and it makes no medical claims.
- Cycle data is intimate health data. It never goes to a cloud language model, never to a third-party analytics tool, never to an advertising network, and is never sold. In-app analytics is a closed vocabulary of feature ids, never content.
- Nothing uploads until she shares. The service has no endpoint that accepts a general upload of the log; what reaches a server is the share surface she creates.
- A share token resolves to one person-object, never to an account-wide query.
4 · Pricing
Nothing is charged and no price is published. When one exists it will be posted on the site before any charge, with no card on file and no renewal to discover. The pricing section.
5 · Limits, stated plainly
- Invite-only TestFlight on iPhone only. No App Store listing, no Android app.
- No automatic notifications yet; delivery is switched off in the service.
- Fertility and ovulation output is off by default, deliberately.
- Five symptoms rather than an exhaustive taxonomy.
- New, with no track record behind it. The comparison says so in its own row.
- Not medical advice and not a medical device.
Statuses change as capabilities ship. Last revised .