On your device when it can be.
Anonymous shapes when it can't.
Kriva writes your daily read using AI.
Here's exactly how.
Most apps say "we care about your privacy" and hope you don't read the fine print. This is the fine print, written like a magazine feature, because if you can't understand what your hormone-tracking app does with your data, you shouldn't be using it.
1. On-device (when your iPhone supports it)
If your iPhone runs Apple Intelligence, iOS 18.1 or later on iPhone 15 Pro, iPhone 16, and newer, Kriva uses Apple's on-device Foundation Models framework to write your daily read.
Nothing leaves your device. No network call, no server, no third party. The model runs on the same chip that decrypts your Face ID. If you want to see this happen, put your iPhone in airplane mode after enabling Apple Intelligence, Kriva's daily read still lands.
2. Cloud (when it can't run locally)
Older iPhones and iPads can't run a large language model. When on-device isn't available, Kriva sends an anonymous payload to its own server (kriva-api.fly.dev), which forwards it to Anthropic's Claude API. The response returns the same way.
Kriva's server strips your IP address at the edge before forwarding. Anthropic sees the payload but not who sent it. Kriva sees who sent it (your device's anonymous subscription entitlement token) but doesn't log the payload itself.
3. What actually leaves the device
Here's a real example of a cloud request payload. Nothing more, nothing less:
{ "life_stage": "perimenopause", "cycle_phase": "luteal", "cycle_day": 24, "sleep_hours_last_night": 6.4, "sleep_avg_last_7d": 7.1, "hrv_last_night": 42, "hrv_avg_last_7d": 48, "symptoms_last_30d": [ "cramps", "brain_fog", "breast_tender" ], "mood_avg_last_7d": 5.8, "weather": { "season": "autumn", "temp_c": 14 }, "hrt_regimen": null, "conditions": ["pms"], "latest_lab_values": { "Estradiol": "58 pg/mL", "TSH": "2.4 mIU/L", "Ferritin": "22 ng/mL" }, "latest_report_date": "2026-06-14", "custom_note": "vegetarian, night shifts" }
Notice what's not there: no name, no email, no device identifier, no IP address, no exact GPS coordinates, no raw Apple Health blob.
- Cycle phase + day
- Sleep hours (last night + 7-day avg)
- HRV (last night + 7-day avg)
- Symptom labels (last 30 days)
- Mood average
- Weather context (season, temp)
- Life stage
- Flagged conditions
- HRT regimen shape (if any)
- Sanitized lab biomarkers from latest report (if any)
- Custom note (auto-scrubbed for PII first)
- Your name
- Email or phone (Kriva never asks)
- Device ID or advertising ID
- IP address (stripped at the edge)
- Exact GPS coordinates
- Raw Apple Health data
- Photo library, contacts, calendar
- Anything you haven't chosen to log
Nothing.
- The payload is forgotten the moment your read returns.
- Kriva's server logs that a read was generated (for billing), not what was in it.
- Anthropic's default terms prohibit training on API data. Kriva has never opted in.
4. The PII scrubber
The custom_note field is the only place a user's free text travels to the model. Kriva runs an on-device scrubber over that field before the payload is built. If you accidentally paste an email, phone number, credit-card number, US SSN, Aadhaar, or PAN into your custom note, it's replaced with a placeholder token ([email removed], [phone removed], and so on) before the request leaves your iPhone.
You'll also see live warning chips in the app when the scrubber detects any of these patterns, so you know before you save.
The scrubber catches obvious identifiers, emails, phones, IDs. It can't reliably detect names, home addresses, or free-form location mentions without on-device machine learning that Kriva chose not to add (adding an ML model just to police your text felt worse than trusting you).
So the rule holds: in the custom-note field, write what you'd want an anonymous AI to see. "I work night shifts, vegetarian, don't drink alcohol", great. Names, addresses, and IDs, skip them yourself.
5. What's stored on Kriva's servers
Nothing about the payload. The kriva-api service logs that a request happened (timestamp, subscription entitlement, HTTP status) so we can monitor uptime and bill correctly. It does not log the request body, the response body, or anything you'd recognise as your data.
If you delete Kriva from your iPhone tomorrow, there's nothing on our end to remove, because there was nothing there to begin with.
6. Per-feature privacy, every surface, plainly
The paragraphs above cover the AI daily read specifically. But Kriva does many things beyond the daily read, logging, syncing, importing lab PDFs, generating visit-prep exports. Each of those touches data differently. Here's the honest per-feature accounting.
Legend: on device means the data never leaves your iPhone. your iCloud means it syncs across your own Apple devices via CloudKit, Kriva can't read it. sent to AI means an anonymous payload goes to Anthropic Claude, is used to generate the response, and is forgotten. never stored means the payload has no lifetime on Kriva's servers, logged as "a request happened," never as "here's what was in it."
| Feature | Data flow |
|---|---|
| Daily read Kriva writes your morning card. |
on device when supported sent to AI when not never stored |
| Cycle log Periods, symptoms, mood, flow. |
on device your iCloud |
| HRT tracker Dose, site, application, side effects. |
on device your iCloud |
| Ask Kriva Freeform questions. |
sent to AI never stored |
| Lab report import Photo, PDF, or manual entry. OCR runs on-device via Vision. |
source file on device only |
| Lab values in daily read + Ask Kriva Sanitized biomarker names and values from the most recent report. |
sent to AI never stored |
| Biomarker trend charts Per-biomarker history across reports (Kriva+ feature). |
on device your iCloud |
| Visit prep PDF Doctor-ready 2-page export. |
on device only |
| Patterns & insights Correlations, weekly shifts. |
on device only |
| Preventive care schedule Screening dates, guideline citations. |
on device your iCloud |
| Widgets Home + lock screen daily read. |
on device (App Group container, same phone) |
| Subscription Kriva+ billing. |
Apple handles. Kriva sees a token that says "this device paid", no email, no name, no card. |
Notice what's not in this table: analytics that identify you, ads, third-party trackers, marketing pixels. None of it exists in Kriva.
7. Where the code lives
Kriva's mobile app is closed-source, but the prompt-building code (including this scrubber) is auditable on request. If you want to see the exact structure of the payload for your subscription tier, DM @kriva_ai, we'll share the current version of the AIPrompts source.
8. What changes when you subscribe
Nothing about privacy. Paying for Kriva+ doesn't create an account. Apple handles the subscription entirely, Kriva receives an anonymous entitlement token that says "this device paid," nothing more. No email, no billing address, no card number ever touches Kriva.
The point of writing this out
Most apps say "we care about your privacy" and hope you don't read the fine print. Kriva writes the fine print like a magazine feature, because if you can't understand what your hormone-tracking app does with your data, you shouldn't be using it.
Questions? DM @kriva_ai or read the full Privacy Policy.