Cycle Decoded His Portal

Privacy Policy

Effective and last updated: September 29, 2026

1. Who we are

Holistic Wellness Roots LLC ("we", "us"), based in Park Ridge, Illinois, runs Cycle Decoded His Portal (the "Portal") at hisportal.cycledecoded.com. This policy explains what we collect when you buy and use the Portal, why, who helps us, how long we keep it, and the choices and rights you have. It is also our Consumer Health Data Privacy Policy (see section 5).

The Portal is a guided self-coaching program. It isn't a medical service, and we are not a healthcare provider covered by HIPAA for your use of the Portal. We protect your information as described here.

2. Your entries, and who can read them

Your name as you enter it, journey stage, check-in answers (including heat exposure, alcohol, cannabis or tobacco use), habits, water and sleep logs, energy, mood and stress ratings, body notes, support people, practice ratings, decisions, weekly goals, reminder times and personal notes are "your entries".

How they're protected. When you create a password, the Portal creates a personal encryption key for you. Your entries are encrypted with that key (AES-256) before they're saved, both in your browser's storage on each device and in your account on our server. The key itself is stored only in a locked form that your password or recovery code can open. Your password and recovery code are never sent to us; your browser sends only a one-way value that lets us check your sign-in. We designed the Portal so that we can't read your entries and have no way to unlock them without your password or recovery code. This also means that if you lose both, we can't recover your saved entries.

On your devices. What is readable on a device depends on a choice you make when you sign in:

• "Keep me signed in" on: your browser keeps your key (in its IndexedDB storage, in a form the Portal can use but can't copy out), so the Portal opens without your password. Anyone who can open that browser on your unlocked device can see your entries.
• "Keep me signed in" off: your key is kept only while the Portal is open. When you close it, the entries on that device stay encrypted until you enter your password again. (Right after you sign in on the start page, the key is passed to the Portal in your browser's session storage for that one page load and then deleted.)

Your browser also stores, unencrypted, your email address and small technical notes about syncing (for example, whether changes are waiting to upload). If you download your data ("Download my data"), that file is not encrypted, so keep it somewhere private.

3. Information we receive

• Purchase information. When you buy access, our payment processor, Stripe, collects your email address, name, payment card and billing details. We receive your email address, the date of purchase and confirmation that you paid. We never see or store your full card number. Stripe handles payment data under its own privacy policy.
• Your account. When you create a password, we store your email address, your encrypted entries, and technical values derived from your password and recovery code that let us check your sign-in without knowing your password. We also record the date your access ends and recent failed sign-in attempts, to protect your account.
• Free demo. To start the free demo, you give your email address and agree to receive demo tips and occasional updates. Your email address goes to our email provider, MailerLite (section 7), and you can unsubscribe from any email at any time. Nothing you enter in the demo itself is sent to us. It stays only in your browser, unencrypted, and is erased automatically when the demo ends (after 3 days), or sooner if you choose "End demo and erase now". Use the demo on your own device.
• Couples Bundle. If you buy the Couples Bundle, you enter your partner's email address at checkout. We use it only to send your partner one email with a link to their portal and to confirm their access when they sign in with that address. If your partner bought the bundle for you, we received your email address from them in the same way. Each portal account is separate, and neither partner can see the other's entries.
• Sign-in emails. If you use "Email me a sign-in link," we check your email address with Stripe to confirm a purchase and send you a one-time link that works for one hour.
• One access cookie. After you sign in, we place one cookie on your device that proves you have access. It contains your email address and an expiry date, is digitally signed, and is strictly necessary for the Portal to work. There are no advertising, analytics or tracking cookies, pixels or scripts in the Portal.
• Server logs. Our web host, Hostinger, automatically records basic technical information, such as IP address, browser type, date and time and the pages requested, for security and to keep the service running. We don't use these logs to build profiles.
• Messages you send us. If you email us, we receive what you choose to write.

Fonts are hosted on our own site, so loading the Portal doesn't contact Google or other font services. "Book a call" opens Calendly, and Library articles open cycledecoded.com; those pages have their own privacy policies.

4. How we use it

• To give you access, confirm purchases, send sign-in emails and handle refunds.
• To store and sync your encrypted entries between your devices.
• To answer your messages.
• To keep the Portal secure and prevent misuse, such as repeated wrong passwords or shared access.
• To meet legal, tax and accounting obligations.

We only send you emails you ask for (such as sign-in links) and messages about your purchase or important changes to the Portal. We won't add you to a newsletter or send marketing emails unless you separately choose to sign up. If you start the free demo, you agree to receive demo tips and occasional updates; every one of those emails has an unsubscribe link.

5. Consumer health data

Some US states, including Washington (My Health My Data Act), Nevada and Connecticut, protect "consumer health data." Because the Portal is a fertility-focused program, we treat the following as consumer health data: your entries, and the fact that you bought the Portal (or received it through a Couples Bundle) together with your email address, and the fact that you started the free demo together with your email address.

• What we collect and where from: your entries come from you, and are encrypted so that we can't read them. Your email address and purchase confirmation come from you through Stripe, or, for a Couples Bundle, from the partner who bought it. If you start the free demo, your email address comes from you.
• Why: only to provide the Portal to you, keep it secure and meet legal obligations, as listed in section 4.
• Who we share it with: only the service providers in section 7, who process it on our behalf and under contract. We don't share it with anyone else unless the law requires us to, and we will not sell it.
• Your consent: we collect it with your consent when you buy the Portal, when you set up your account, and when you start the free demo. You can withdraw consent at any time by deleting your account (section 8) or, for demo emails, by unsubscribing.
• Location: we don't collect precise location and don't use geofencing.
• Your rights: you can confirm whether we collect, share or sell your consumer health data (we don't sell it), get a list of the third parties we share it with, access it, and have it deleted, as described in section 8.

6. What we don't do

• We don't sell or rent your personal information.
• We don't share it for targeted or cross-context advertising.
• We don't use analytics, advertising or social-media tracking in the Portal.
• We can't read the entries saved to your account, and we never receive your password or recovery code.
• Because we don't sell or share your information for advertising, there's nothing to opt out of. We still respect Global Privacy Control signals.

7. Service providers

• Stripe: payments.
• MailerLite: sending demo emails and other emails you've signed up for.
• Hostinger: website hosting, storing your account and encrypted entries, and sending sign-in emails.

These providers may process information in the United States or other countries where they operate, with protections required by their contracts and the law. We may also disclose information if the law requires it, for example in response to a valid court order. Because your entries are encrypted, we could only ever provide them in their encrypted form.

8. Your choices and rights

In the Portal, at any time (My Profile):

• Download my data: a copy of your entries.
• Erase all my entries: clears your entries on every device.
• Delete my account: permanently removes your account and saved entries from our server and from that device.

By email. Depending on where you live, you may have the right to know what personal information we hold about you and get a copy, to correct it, to delete it, to withdraw consent, and to appeal our decision. You can use these rights whatever state you live in. To make a request, email hello@cycledecoded.com from the email address you used to buy the Portal, so we can confirm it's you. An authorized agent can make a request for you with your signed permission. We'll respond within 45 days (or tell you if we need up to 45 more days, as the law allows), and we won't charge you or treat you differently for asking.

Appeals. If we decline your request, you can appeal by replying to our answer with "Appeal" in the subject line. We'll respond within 45 days. If you're not satisfied, you can contact your state's Attorney General.

Some records, such as purchase records we must keep for tax purposes, may be kept after a deletion request where the law allows.

9. How long we keep it

• Your account and encrypted entries: until you delete them, or automatically 12 months after your access ends (so you can pick up where you left off if you renew).
• Entries on a device: until you erase them or sign out on that device.
• Purchase records: for as long as tax and accounting law requires, usually up to 7 years.
• Sign-in links: expire after 1 hour. Your access cookie expires when your access ends.
• Server logs: kept by Hostinger for a limited period for security and operations.
• Emails you send us: as long as needed to help you, and no longer than 2 years after our last exchange.

10. Security

The Portal uses encrypted connections (HTTPS), encryption of your entries before they're saved on your device or sent to us, signed access cookies, one-hour sign-in links, and a 15-minute pause after repeated wrong passwords. Your password is never sent to us. No system is perfectly secure; on a device where you stay signed in, your entries are only as private as that device, so use a screen lock and sign out on shared devices. If a security incident affects your personal information, we'll notify you and the authorities as the law requires.

11. Children

The Portal is for adults 18 and older. We don't knowingly collect information from anyone under 18. If you believe a minor has used the Portal, contact us and we'll delete the information.

12. Where the Portal is offered

The Portal is offered to adults in the United States.

13. Changes to this policy

If we make a material change, we'll tell you by email or in the Portal before it takes effect, and update the date at the top. We won't use your consumer health data in a new way without your consent.

14. Contact

Holistic Wellness Roots LLC
1301 W Touhy Ave
Park Ridge, IL 60068
Email: hello@cycledecoded.com

← Back to Cycle Decoded His Portal