Ovumcy

Follow-up remediations from the external audit: privacy and medical copy now match actual behavior (opt-in egress, no diagnostic certainty), day-save feedback explains the pregnancy-test pause, and a logged future period entry renders as a recorded fact instead of a projection. No database migrations; no breaking changes.

Changed

• Privacy copy matches actual egress behavior. Onboarding and privacy-policy strings in all six locales no longer claim data “never” leaves the server: data leaves only through integrations the owner enables (webhook reminders, OIDC sign-in). The rights section states the real export scope (day-level health records; account profile and settings stay viewable in Settings) instead of promising a “full copy”. docs/security/data-handling.md is now the canonical egress statement; README and docs/gdpr.md defer to it. docs/gdpr.md also states the positioning explicitly: built for personal and household self-hosting, not a turnkey GDPR solution for a public multi-user service. (#260)
• Implantation-bleeding hint softened with red-flag guidance. The dashboard hint no longer asserts a cause from timing alone and directs to medical care on pain, dizziness, or heavy flow. All six locales. (#260)
• Saving a day under a pregnancy-test pause explains the pause. With a positive pregnancy test as the latest fertility signal, the day-save feedback says predictions are paused and carries red-flag guidance, instead of a routine self-care/fertile message. (#260)
• Prediction docs disclose the full heuristics. docs/cycle-prediction.md documents the cervical-mucus “+1 day” ovulation rule and adds a BBT sensitivity caveat (indicative, not diagnostic). (#260)

Fixed

• A logged period entry dated in the future renders as a recorded fact, not a projection. Auto-fill never writes rows past today, so every future period row is a manual log; the “projected period (auto-filled)” calendar style, legend entry, and locale key described a state no real data could produce and are removed. (#260)