Build log / archive
August 2026_
80 builds logged this month.
The staff room gets the fresh-eyes walk
- The last two walks covered his side of the shop and hers; today's covered the room behind the counter — the admin page, where feedback gets triaged, badges and articles get their copy tended, and the aggregate numbers live. The walk caught something real in the act: partway through, two whole panels quietly failed to load and simply weren't there — no error, no gap, no way to tell the difference between "this failed" and "this doesn't exist". A reload brought them back, which is exactly the problem: a flaky moment was indistinguishable from a missing feature.
- So the whole page has learned some manners. Every panel that fails to load now says so, in its place, with a Try again button that means it — no more sections that vanish, no more failed reads dressed up as good news ("Nothing here. Good." over a feedback list that simply hadn't arrived). Moving a feedback item that doesn't save now says it didn't, instead of appearing to work. And the worst of them: if the page couldn't check who you are, it used to show the polite turned-away line meant for non-staff — an error wearing a denial's clothes. It now says the check itself failed, and offers the way back.
- The admin page also joins the browser-test rota at last — the door, every panel, a feedback triage move and the accessibility sweep are now walked by machine on every update, so a panel that goes quietly missing is a failed build, not a mystery for the next person who happens to look.
The site learns to travel light
- Today was spent weighing the website the way a first-time visitor's phone does, and the scales said two things. First: the pages never told browsers what was safe to remember, so every visit re-downloaded half a megabyte of app machinery that hadn't changed since the last one — and, worse, a browser guessing on its own could keep an out-of-date page past a deploy and render a broken site until its guess expired. Both ends are now stated properly: the parts of the site that never change once shipped are marked keep-this-for-a-year, and the pages themselves always check for a newer build before reusing what's cached. Repeat visits get faster; updates arrive the moment they ship. The watchdog that probes the live site every half hour now checks these promises from the outside, too — including that the server is compressing what it sends.
- Second: this changelog had quietly become the heaviest page on the site — it grows most days, and it was all delivered as one ever-longer scroll. It now opens with the newest twenty entries, and the full history lives in a month-by-month archive linked underneath — every entry still there, every month on its own page, nothing lost. If you've ever wanted to re-read what shipped in July, July now has an address.
The settings learn who they're talking to
- Yesterday's walk through the partner's side of the shop left one thing on the list: her settings still described his product. The notification panel promised a daily brief of "her status, the window, and today's top play" — she is the "her"; her brief has never contained any of that — offered to keep "her cycle out of your inbox", and explained that "her updates" can't be silenced. Today that's fixed, on the website and in the iPhone app both: on a linked partner's account every one of those lines now says what her account actually gets — a brief of her own wins and streaks, an email that carries no cycle detail because she doesn't track one, and the sharing announcements that really are impossible to silence. His settings read exactly as they always did, and hers switch back to the standard wording the moment she starts tracking a cycle of her own.
- One of the finds ran deeper than wording. The phone's Privacy screen has a row for the partner-data consent — the dated record created the moment a partner accepts a link. On her account that consent is hers: she created it by accepting, and ending the link is how she withdraws it. The note under it, written for his side of the app, told her it was "Hers, not yours" and pointed at a settings page her account doesn't have. It now tells the account whose consent it actually is: yours, dated from your acceptance, ended any time from Shared with you.
- A browser test now reads her settings page on a freshly linked account and fails if any line ever talks about "her" again.
Her side gets the fresh-eyes walk
- This morning's walk covered his side of the shop; this afternoon covered hers. A brand-new invite was sent, the email opened, an account created from it, and every page walked the way a partner actually meets them — the invite letter, the accept page, her first-day briefing, the shared log, her day-correction form, her settings, and the way out — on a desktop and again at phone width. The mail, the briefing and the shared log all held up, and her exit stood the link down cleanly from her side alone.
- One thing didn't hold up, and it's fixed on the website and in the iPhone app both: her Today page was talking to her as if she were him. It invited her to "set up partner tracking" — she is the tracked side; the cycle it proposed to track is her own, already one tap away — suggested she "add her birthday and your anniversary", offered a daily comms plan of things to say to "her", and kept a permanently empty fertile-window tile waiting for cycle data that lives in the shared log. Those panels now stand down on a linked partner's account. Her Today opens with the shared log — the thing the invite brought her there for — followed by the parts of the app that are genuinely hers to explore or ignore, exactly as her briefing promises. And if she ever starts using those features in her own right — tracking a cycle of her own, adding her own key dates — the panels come back, because then they're hers too.
- A browser test now walks the whole journey — invite to accept to her Today — so her first screen can never quietly turn back into his.
A walk through the shop with fresh eyes
- Today a brand-new account was created and every page of the website walked the way a first-time user would meet it — sign-up, the briefing, then all fourteen dashboard pages on a desktop and again on a phone-sized screen. Most of it held up. Three things didn't, and all three are fixed.
- First, a dead end at the exact moment the app should be leading you by the hand: set up partner tracking and the Today page says "Log the first day of her period to start predictions" — as plain text, with nothing to click. Every neighbouring tile offers a door; the most important first step in the product didn't. The sentence is now a link straight to the Partner page, where the log button waits. (The iPhone app already had this button — the website just caught up.)
- Second, the Comms page greeted ordinary users with a sentence written for the server's operator — instructions about environment variables and restarting services. If you don't run the server, that's noise wearing a warning's clothes. It now says the honest, useful thing — the AI writer isn't switched on yet, and the daily plan below still works without it — and keeps the operator's instructions for the operator's eyes only.
- Third, a claim that had quietly stopped being true: the Plus page said that until billing switches on, "nothing is locked." Not quite — the AI features are open to everyone, but charts still keep to the free tier's 7-day history window. The page (on web and iPhone both) now says exactly that, because a subscriptions pitch is the last place a fertility app should be imprecise.
The watchdog stops trusting the clock
- Kalcius has a watchdog: an automated probe, run from outside our own machines, that checks the live site, the API, the database backups and every safety check — and raises an alarm the moment anything is wrong. It was asked to run every half hour. Reading its actual history this morning showed it hadn't been: the scheduler it relies on quietly drops runs when it's busy, and over the last three days the "every 30 minutes" watch had really fired three to five times a day, with unwatched gaps of over ten hours. Nothing broke in those gaps — but nothing was watching either, and a watchdog that isn't running can't tell you it isn't running.
- So it no longer trusts the clock. The probe now fires automatically the moment anything that changes the product finishes — every deploy, every test run, every nightly backup, whether it succeeded or failed — so a broken update raises its alarm within a minute of failing instead of whenever the scheduler next felt like it, and every update gets checked right after it lands. The clock-driven sweep still exists for things that break on their own between updates. And the watchdog now takes its own pulse: every probe states how long the watch actually stood empty since the last one, so thin coverage shows up in the record as what it is, instead of passing for coverage.
The manners get their shakedown
- Midday's quiet hours got the treatment everything here gets the day it ships: read again the way an auditor would, and fixed the same day. The find: a push held overnight was delivered when your quiet window ended even if you'd already opened the app in the small hours and read the notification there. The morning buzz would announce something you saw eight hours ago. Now, anything you've already read releases silently when the window ends — the push exists to surface what you haven't seen, and only that still gets one.
- And the iPhone's settings panel learned the website's honesty: if saving a notification switch fails — bad signal, mid-tunnel — it now says so and puts the switch back the way the server actually has it, instead of leaving it showing a choice that never took.
Notifications learn manners
- You can now choose what Kalcius is allowed to interrupt you about. In Settings on the phone — and, for the first time, in a proper Notifications panel on the website's Profile page — each kind of push has its own switch: cycle alerts (Code Red, Code Orange, the fertile window), key-date reminders, health reminders (the retest window, the monthly two-minute check), and friend activity. Switch one off and that category goes fully quiet — no push, no bell badge — while everything else still arrives. One deliberate exception, stated right under the switches: partner-link announcements (linked, ended, sharing changed, her updates) have no off switch, because the link's honesty depends on them being impossible to silence.
- And quiet hours, at last: set a window — say 10pm to 7am, in your own timezone — and no push will light your lockscreen inside it. What fires overnight isn't lost, it's held: a Code Red that trips at 2am arrives when your window ends, still true and actually readable, and the in-app record is there the moment it happened either way. Your daily brief is the one exception — you picked its hour yourself, so that hour wins, even inside the window.
- The website catching up matters on its own: notification preferences — discreet mode, the daily brief and its hour, the weekly email — could previously only be changed from the iPhone app. Anyone using Kalcius purely in a browser, which is every Android user, had no way to reach them. Now both apps offer the same switches, described in the same words.
The thermometer's code meets its compiler
- Kalcius is three kinds of code: the server and website (hundreds of automated checks), the iPhone app (run through the real Swift parser since yesterday), and the firmware — the code that will live inside the Clip thermometer itself. Until today the firmware was the last layer with no machine check at all: changes shipped verified by careful reading alone. Now every change to it is fully compiled for the exact chips it runs on — the Clip's Bluetooth chip and the bench rig's — the moment it lands, by the same command-line toolchain the workshop bench uses.
- This check is actually stronger than the iPhone's: a parser only proves the code is well-formed text, but a full compile proves the types line up, the radio and sensor libraries are being called correctly, and nothing is missing — the whole program builds, ready to flash. The honest limit is stated where the check lives: it compiles the firmware, it can't run it. How the radio behaves, how the sensor reads, how long a battery lasts — those still need the physical bench.
- And like every check here, the checker is itself watched: if a firmware build ever goes red, the production watchdog raises it on the build board within the half hour.
The iPhone's code gets a proofreader
- A quirk of how Kalcius is built: the iPhone app is written in a workshop with no Apple tools in it, so until today every change to the phone's code shipped checked by careful reading alone — the website and the server have hundreds of automated checks; the phone had a proofread. Now the machinery exists: the moment any change to the iPhone code lands, the entire tree is run through the real Swift parser — the same one Apple's tools use to read the code — and a malformed file stops the line within minutes, instead of surfacing days later when the next App Store build is attempted.
- It's an honest, limited check, and the limit is stated where the check lives: it proves every file is well-formed Swift; the deeper checks still happen when the app is built for TestFlight. And it earned its keep within minutes of existing: its very first run refused to pass, because the checker was reading a slightly older dialect of Swift than the app is actually built in. That got fixed — and the exact dialect is now pinned in the project itself, so the checker and the real build can never quietly disagree — and the second run proved all 55 files of the app, today's screen-reader work included, parse clean.
- And like every other check here, the checker is itself watched: if the parse ever goes red, the production watchdog raises it on the build board within the half hour.
The iPhone learns to be read aloud
- This morning the website learned to work with a screen reader; this afternoon the iPhone app caught up with VoiceOver. Every control that spoke in emoji now speaks in words: the reaction row on the composer, the date-night log and the mood buttons announce their meaning — “Loved it”, “Frosty”, “Irritable” — not the symbol’s dictionary name. It’s the same seven-word vocabulary the website uses, defined once, so the two apps can never describe the same button differently.
- Everything that toggles now says whether it’s on. Mood and flow chips, the self-exam outcomes, the sharing-scope switches, the playbook’s rating stars, a pinned date idea — all announce their selected state instead of carrying it in a border colour VoiceOver can’t see. Glyphs that carried meaning got words too: the flow dots say “Flow 2 of 4”, a date idea’s price and effort marks say “Cost 2 of 3, effort 1 of 3”, a rated move says “Rated 4 of 5”.
- Every unlabelled button got its name: the little × that deletes a result, a key date, a play or a draft now says exactly what it removes; the + in each toolbar says what it adds; the calendar’s arrows say “Previous month” and “Next month”; the date pickers on the partner setup and shared calendar carry their captions. And the levers catalog’s “more” hint became a real button a screen reader can find — it was a bare tap zone before.
- One thing any eye can check: locked badges were dimmed to little more than half strength, the same legibility mistake the website fixed this morning. They’re now drawn hollow — dashed edge, unfilled ground — with the text at full strength, so “locked” is carried by shape, not by making the words hard to read.
The app learns to be read aloud
- Kalcius now works properly with a screen reader, and stays that way by machinery. Every form field on the site — the day editor, the test log, the key dates, the profile, all of them — now carries its label in a way assistive technology actually announces, instead of a caption that merely sits nearby. A practical win for everyone else too: clicking a field's name now focuses the field.
- The details a screen reader was guessing at now speak plainly. The emoji you tap to log her mood or rate a date night announce their meaning in words, not their symbol name; buttons that toggle — moods, productivity, self-exam outcomes, units — announce whether they're currently on; the notifications button says how many are unread; and the current page is named in the navigation. Keyboard users get a proper front door too: the first press of Tab on any dashboard page offers "Skip to content", so reaching the page never means tabbing through the whole sidebar.
- Things any eye can check got fixed as well: links inside sentences are now underlined, not distinguishable by colour alone; locked badges are drawn hollow instead of dimmed to illegibility; the faintest small print was lifted to proper contrast; and the playbook's rating stars grew to a real tap target.
- None of this relies on good intentions. The robot that walks the app before every update now runs the industry-standard accessibility audit (WCAG A and AA) on every public page and every dashboard surface — with the big forms open, not just closed — and a single violation stops the release, the same way a broken button would.
The rehearsal reaches the street door
- The day's third pass closed the robot user's last gap: the public site — the front page, the free Learn library, this changelog, the privacy page — is now walked in a real browser before every update, signed out, the way a stranger arrives. The rehearsal checks that every reviewed article in the library is actually on the shelf, opens one and reads it, follows a link inside the copy to the next article, and then takes the door into the app — confirming it lands, honestly, on the sign-in screen.
- The privacy page makes a claim most sites can't: no analytics, no cookies, no third parties. That promise is now enforced, not just stated — on every build, the robot browses the public pages and fails the update if a single request leaves for anyone else's server, if anything asks the API who you are, or if so much as one cookie lands in the jar. A tracking script can't creep in quietly; it would stop the release.
- And a page that doesn't exist now says so properly: a mistyped or long-gone article address answers with a true 404, not a soft page pretending — which is what keeps search engines from indexing ghosts. Small, but it's the difference between a library and a pile.
The rehearsal reaches the partner link
- This morning's robot user learned the one journey it couldn't yet walk — the most personal machinery in Kalcius, and the part where a mistake would cost the most trust. Before every update now, two fresh accounts in two real browsers live out the whole partner link: he sets up the profile, chooses what to share and what to hold back, and sends the invite; she opens the emailed link, reads the plain statement of exactly what she'd be accepting — including what he chose not to share, named to her before she decides — accepts, uses her view, corrects the calendar herself, and ends the link with two clicks. Every step through the actual pages, against a real copy of the system.
- Real email is part of the rehearsal now. The suite runs its own mail server, and Kalcius genuinely delivers to it — the verification email, the invite with its disclosure of what's shared. The robot clicks the same links a real inbox would carry, so a broken link in an email can't ship any more than a broken button can. That includes the gate in front of it all: invites refuse to go out until your address is proven to be yours, and the refusal — then the emailed proof, then the send — is rehearsed on every build.
- The promises under test are the ones this feature lives on. A note he keeps to himself never appears anywhere on her pages. Her own corrections land — and they cannot erase what she was never shown, so a withheld note survives her edits untouched. Her page always names what's held back, never silently shows less. And her exit is unilateral and immediate: the moment she ends the link, her side shows nothing and his side is honestly back to logging alone. Each of those is now checked, word for word and click by click, before any change reaches you.
A robot walks through the app before you do
- Kalcius already ran hundreds of automated checks on its inner machinery before any update shipped. What it didn't have was a check that uses the app the way you do — through the actual pages, clicking the actual buttons. Now it does: on every change, a real browser signs up as a fresh user, logs a semen analysis and finds it back on the doctor's copy, walks the self-exam flow (including the book-a-GP panel appearing when it must, with the written note shown back word for word), saves and clears a note on the partner calendar, and opens the Today screen checking every panel behind it answers.
- The whole rehearsal runs against a real copy of the system — real database, real API, real pages — never a simulation of one. That matters because of a failure we've been honest about before: in mid-August, four days of updates shipped a web app that asked the server questions it couldn't yet answer. Checks of each half separately said green; only using the two together would have caught it. This suite uses the two together, on every single change.
- The bug Diana reported — an edit that looked saved and quietly reverted — now has a browser test walking that exact path on every update, so that class of bug can't ship twice. And like everything else in the safety net, the rehearsal is itself watched: if it goes red, our production watchdog raises an alarm on the build board within the half hour.
The backup learns to prove itself
- Since last night's build, your data has been backed up nightly and every backup verified before it counts. Today the last honest gap in that promise closed: a backup you've never actually restored is a hope, not a backup. Once a week, automatically, the newest backup is now restored for real — loaded back into a scratch copy of the database, checked table by table that everything came back (the accounts, the logged history, the machinery that applies updates), and then the scratch copy is thrown away.
- The drill is built never to touch the live database: it restores into a separate scratch area by construction, and it refuses to run at all rather than guess if anything about the backup's format ever changes. Your actual data is only ever read — the same way the nightly backup reads it — never written.
- And like everything in the safety net, the drill is itself watched: our production watchdog now raises an alarm on the team's build board if the weekly rehearsals fail or quietly stop happening. A restore that works becomes a fact that gets re-proven every week, not an assumption that gets tested on the worst day.
- The very first rehearsal ran today and did exactly what a drill is for: it surfaced a missing database permission loudly and stopped, rather than pretending. One one-time grant and the weekly rehearsals run on their own — and honestly, a first drill that finds the snag before the bad day does is the whole argument for drilling.
The new calendar gets its shakedown
- This morning's self-exam flow got the treatment everything here gets the day it ships: read again the way an auditor would read it, and fixed the same day. The find that mattered: checking twice on the same day — log "something's changed" in the morning, recheck after a warm shower, log "all clear" that evening — could leave the panel showing whichever answer the database happened to hand back. Your latest word now wins, always, and there's a test pinning it.
- The note you write when something felt off is now shown back to you, as promised. This morning's build stored it and included it in your data export, but no screen ever showed it again — which defeats the point of writing it down before a nervous week blurs the detail. It now appears right on the book-a-GP panel (and under a "not sure" check), word for word, still visible only ever to you.
- The one reminder each check arms now follows what you actually logged. All clear: the routine nudge when the month is up, as before. Not sure: the app said "check again in a day or two", so the reminder now lands a few days on with exactly that guidance. Something's changed: the app said "book a GP this week", so a week on the one reminder asks about exactly that — because the one man who must not receive "time for your routine check" is the one who found a lump. Still exactly one notification per logged check, never repeated, never at 3am.
- Two smaller things in the same pass: a check can no longer be logged for a future date, and the iPhone now says so plainly if saving a check fails, instead of failing in silence — your words stay in the form either way.
The check nobody shows you gets a calendar
- The Learn library has taught the two-minute testicular self-exam since it opened — the most common cancer in men roughly 15 to 40, and one of the most treatable when it's found early. Teaching it was never the hard part; remembering it every month is. My Fertility now carries the check itself: the routine condensed to four lines you read at the moment you need them (warm shower first; one side at a time; the soft ropey tube along the back is normal anatomy, not a lump), and one tap to log how it went — all clear, something's changed, or not sure.
- Log a check and Kalcius keeps the calendar: the panel shows when the next one falls due, and you get one quiet nudge when a month has passed — one notification per logged check, never repeated, never sent at 3am, and never sent at all if you've never used the feature. Your lockscreen stays discreet as always. If you're not sure what you felt, the app says what the article says: check again after a warm shower in a couple of days, and "I'm not sure about something I felt" is plenty to book a GP appointment with.
- And if something has changed, the app doesn't bury the advice in a paragraph: the panel turns over to one message — book a GP appointment this week, not someday. Say the words "I found a lump on my testicle" and you will be seen quickly; every health system takes that sentence seriously. Most changes turn out to be a cyst, a varicocele, or normal anatomy — but the ones that aren't are exactly the ones where a week matters. You can write down what you noticed while it's fresh, in your own words, shown only ever to you — it's the detail a GP will ask for and a nervous week can blur.
- On the web and the iPhone both, from today. Self-exam logs are yours like everything else here: included in your data export, gone with your account when you delete it, and now stated on the privacy page.
The safety net gets safety-checked
- Anything that ships here gets read again the next day the way an attacker or an auditor would read it, and today it was the backup system's turn. The audit found a rare path where the encryption key protecting an off-site backup could have been generated weak — in the worst case, empty — roughly one night in every 256. Nobody was ever exposed: the off-site layer hasn't sent a single backup yet (it's waiting on a key that hasn't been installed), so the hole was closed before it ever existed in the wild. The key generation is now built so that class of weakness is impossible, and the whole encrypt-and-restore pipeline was re-run end to end to prove it.
- The notification pipeline got the same treatment and one honesty fix: internally, a failure to send you a notification could previously look identical to "already sent it, skipping the duplicate" — the kind of silence that lets a breakage go unnoticed. Failures now announce themselves in our logs, loudly and distinctly, so if the nudges you rely on ever stop, we find out before you have to tell us.
- The retest window that shipped this morning was audited too, and came through clean — the 90-day arithmetic, the once-ever notification rule, and the timezone handling all held up to adversarial reading.
The three-month rule grows a clock
- Every hard sentence in Kalcius ends the same way: change the habit, wait one full production cycle, retest. The app has said it since the Learn library opened — and until today it did nothing to help you actually do it. My Fertility now shows the retest window: where you stand against the ~90 days it takes to build a full new cohort of sperm, counted from your last semen analysis, on the web and the iPhone both.
- Before the window opens, the panel is honest about why waiting matters: a test three weeks after the last one would mostly re-measure the same production run. It names what's on the clock — anything you've started or stopped on your medications and supplements ledger since that test — and counts down to the day a retest becomes meaningful.
- When one full cycle has passed, the panel turns over: every sperm in a sample today was built after your last test, so everything you've changed since is now visible to a lab. Logging the retest is one tap away, and doing it starts the next clock.
- You also get told once, the morning the window opens — one notification, at a civilised mid-morning hour in your own timezone, never repeated for the same test. The usual rules hold: your lockscreen stays discreet unless you've chosen otherwise, and tapping it on the iPhone lands you on My Fertility. Hormone panels deliberately don't reset the clock — they read today's signalling, not a 90-day production run.
Your data now survives a very bad day
- Until today, everything you logged in Kalcius lived in exactly one place. That is the honest way to run a privacy-first product — no third-party data platforms — but it also meant a disk failure or a botched update could have lost it all. As of tonight the database is backed up automatically every night, and every backup is verified before it counts: a backup that silently produced nothing would itself raise an alarm.
- The off-site copy is encrypted before it leaves our machine, to a key that only we hold offline — the service storing it keeps ciphertext it cannot read. That is the same standard we hold everyone else to on the privacy page, applied to ourselves.
- There's a second layer for the riskiest moment: every time an update changes the database's structure, a safety copy is now taken immediately before the change is applied — so even a migration gone wrong can be undone.
- One honest consequence, now stated on the privacy page: backups exist for disaster recovery, not as an archive, and they expire within 30 days. Delete your account and it is gone from the live system at once, and from every backup within a month. Our production watchdog now also checks nightly that the backup actually happened — a backup system that quietly stops is the failure everyone discovers too late, so we made it impossible to miss.
Kalcius earns a place on your home screen
- There's no Kalcius app on Android — the iPhone app covers iOS, and for everyone else the web app is the app. As of today it can act like one: open kalcius.com in Chrome on Android, choose "Add to Home Screen", and Kalcius installs properly — its own icon, its own full-screen window with no browser bars, its own entry in the app switcher. Long-press the icon and you get shortcuts straight to Today, My Fertility and the Partner page.
- The icon set was redrawn for the occasion — the same K mark at every size, including the padded variant Android crops into a circle on phones that do that — and the site now paints the phone's status bar to match. Nothing to update and nothing changes in the browser if you'd rather stay there; the install is just there for the taking now.
- Our production watchdog checks the install machinery every half hour along with everything else, so if it ever breaks, we know before you do.
Every date now means the day you picked
- A quiet bug, found by reading yesterday's printable sheet the way an auditor would: dates in Kalcius could drift by a day. Log a test on the 23rd from the iPhone and, depending on the time of year and where the sheet was later read, it could print as the 22nd — because the app was storing the moment you tapped save rather than the day you picked, and reading it back under whatever clock the viewing device happened to be on. A wrong date on a sheet a GP reads is the kind of small that isn't.
- Fixed end to end, on every date that means a day rather than a moment: test dates, the started/stopped dates on your medications and supplements ledger, and your key dates. All three now travel as the calendar day you chose, are stored as exactly that day, and read back as that day on every device, in every timezone, all year round — on screen, on the printed sheet, and on the phone's PDF alike. Existing entries were repaired the same way.
- Two neighbours fixed in the same pass: editing a key date on the web no longer opens with the date field blank, and the "Prepared" date on the doctor's copy is now your own calendar day even just after midnight in summer.
The doctor's copy reaches the iPhone
- This morning's printable summary crossed to the phone the same day. My Fertility on the iPhone now has The doctor's copy too — the document icon in the top bar, or the line at the foot of the page — and it builds the same sheet: every semen analysis and hormone panel over time against its reference point, your notes on each result, and the medications and supplements ledger. What the phone shows you is the actual PDF, page for page, and one tap hands it to the share sheet — print it, save it to Files, AirDrop it, or email it ahead of the appointment.
- It is the same document in the strict sense: the phone builds it by the same rules as the web — same column cap with older results honestly noted rather than silently dropped, same ordering, same reference labels, same blank name and date-of-birth lines to fill in by hand. A sheet handed across a GP's desk reads identically whichever device printed it, and it still says plainly what it is: a patient-kept summary transcribed from lab reports, not a laboratory document.
Your numbers, ready for the doctor's desk
- The app has always ended the hard conversations the same way: that's one for a doctor. Now it hands you something to bring. My Fertility → The doctor's copy puts everything you've logged on one printable sheet — every semen analysis and hormone panel laid out over time against its reference point, your notes on each result (abstinence days, the flu that week — the context a number needs), and your medications and supplements ledger with dates. One tap prints it or saves it as a PDF, and the preview on screen is exactly what comes out.
- The ledger prints because it changes what the numbers mean: a suppressed count on TRT is mechanism, not mystery, and a GP reading the sheet should know it. There are blank Name and Date of birth lines to fill in by hand — the sheet carries no account details of yours — and it says plainly what it is: a patient-kept summary transcribed from lab reports, not a laboratory document.
- The reference points are labelled for what they are — WHO (2021) lower reference limits for semen values, common UK assay ranges for hormones, with your own lab's ranges taking precedence — and a value outside them is marked as worth discussing, never diagnosed. Same rules the app has always read your numbers by; now they travel.
The promises get written where anyone can read them
- Kalcius now has a public privacy page — kalcius.com/privacy — and it is not the usual legal wallpaper. It says, in plain words, what is stored, who else ever touches any of it (and exactly what each of them sees), what the AI features are allowed to read and only with your recorded say-so, and the controls you hold: one-tap export, immediate hard deletion, dated consents, the partner-sharing scopes. Every claim on the page describes behaviour the system actually enforces — it was written from the code, not from a template, and it changes only through the same review that ships the product.
- Some of what it puts on the record, because it was true all along but never said where a visitor could read it: nothing is sold and there are no ads, no third-party analytics and no cookies on this site at all; AI requests carry no account identity; the feedback you send is the only words of yours the team can read; and marketing email doesn't exist here — if it ever does, it will be opt-in first.
- The page is linked from the foot of every public page, from the sign-up form right where you tick the consent box, and from the iPhone's Settings → Privacy & AI. One honest caveat, stated on the page itself: this is the engineering truth, kept current — the formal legal notice with the named legal entity comes before general launch.
The new locks get their shakedown
- This week's account-security work — email verification, changing your address, sign out everywhere — got the same treatment every new lock here gets: read the way someone trying to break it would read it. One real gap turned up, and it's closed. Until today, a password-reset link already sitting in your old inbox stayed live for its remaining half hour after you moved the account to a new address — and a reset doesn't just change the password, it takes every session with it. The one inbox the move exists to leave behind could have taken the account straight back. Now, the moment an address change completes, every outstanding reset link dies with it.
- Two smaller finds closed in the same pass. Kalcius Plus receipts now always go to your current email address — upgrading in the first minutes after an address change could previously hand the payment processor the old one, which is where receipts would have pointed from then on. And every emailed link the system builds (resets, verifications, invites, the lot) now comes from one shared, tested definition of the site's address, closing off a legacy fallback that could have pointed reset links at a domain the web app left behind.
- Nothing here needs anything from you. No behaviour changes unless you were the attacker.
One move signs out every device
- You can now sign out everywhere: every session except the one you're holding ends within 15 minutes — the old phone in a drawer, the login left open on a mate's laptop, all of them. On the web it's under Profile → Sessions; on the iPhone, Settings → Sign out everywhere. Accounts with a password confirm with the password, so whoever picked up a signed-in device can't use the button to lock you out of your own account.
- Changing your password now does the same thing automatically, and so does resetting it. This closes a quiet gap: until today, a device that was already signed in stayed signed in through a password change — for up to thirty days. The heads-up emails have always said that resetting your password is the move that secures your account; as of today that's the whole truth. New password, and every session that isn't yours is dead.
- The honest details: the device you act from stays signed in — you won't be interrupted. Everyone else needs the password (or your Apple ID) to get back in. And nothing about your data changes; this is purely about who's holding a live session.
The address becomes yours to change
- You can now change your account's email address — from Profile on the web, or Settings → Email address on the iPhone. The flow is built so a typo can't strand you: nothing changes when you hit send. A confirmation link goes to the new address, and only opening it moves the account. If the link never gets clicked, everything stays exactly where it was — and because opening it proves the new inbox is really yours, the address arrives already verified.
- The careful part is what it takes to start one: your password. A signed-in device alone isn't enough to re-point where your password resets go — that would turn a borrowed phone into a stolen account. Your current address also gets a heads-up naming exactly where the account is moving, and if that ever wasn't you, one move both locks the door and cancels the pending change: reset your password. The confirmation link itself lasts an hour and works once.
- And yesterday's verification banner reached the iPhone: if your address is still unconfirmed, Today now says so — with the resend button right there — instead of leaving you to find out the day an invite refuses to send. Accounts that sign in with Apple keep their address from their Apple ID, and the app says so rather than pretending otherwise.
The address gets proven
- New accounts now get a confirmation email: click the link within a day and the address is proven yours. The quiet reason this matters: an account created with a typo'd email is a time bomb — the day you forget your password, the reset link goes to an address that doesn't exist, and the account with everything you've logged is gone. Verifying on day one is when the typo gets caught.
- Invites now require it. A partner invite or a crew invite is Kalcius putting your name and your email in someone else's inbox — so the name's address has to actually be yours first. Unverified accounts get told exactly that, in plain words, with the fix one tap away. Everything else — logging, the dashboard, the whole app — works exactly as before, verified or not.
- Nobody existing is locked out: every account created before today is treated as verified, because the rule didn't exist when you joined. Signing in with Apple counts as proof automatically — Apple has already verified the address, relay addresses included. And if the email never arrived, the dashboard banner resends it.
The front door learns the truth
- The landing page now describes the product that actually shipped. One old feature card promised goal-setting and "food, supplement and training suggestions" — none of which exist, and the supplements line contradicted the app's own levers board, which says "save your money" out loud where the trials found exactly that. That card is gone; in its place, the levers board as it really is: habits ranked by the strength of the evidence, one-tap check-ins, streaks and badges — honesty included.
- A new section speaks to the person the old page ignored: her. If you're invited to link accounts, the front page now says plainly how the link works — your own account, told exactly what's shared and what isn't before you accept, everything shared shown to you unabridged, and either side able to end it at any time. None of that is new behaviour; it's how the link has always been built. It just wasn't said where someone checking the site out could read it.
- The front page now shows three articles from the Learn library — real titles, real reading times, drawn from the same reviewed catalog as the library itself — and an honest account of the deal: what's free forever (tracking, cycle predictions, the levers board, the partner link, the whole library) and what Kalcius Plus adds.
The site learns to watch itself
- Kalcius now checks its own pulse every half hour, around the clock: the app's engine, the sign-in pages, the Learn library, the share cards — even whether the version running is actually the newest one shipped. If anything goes quiet, an alarm lands on the team's build board within the hour, with exactly what failed written down.
- This one comes from a scar. In August, a deploy quietly failed four days running: the website kept updating while the engine behind it stayed stuck on an old build, and only a person going looking found out. Every check added today is one that would have caught it — the running system now says out loud which build it is, and the watchdog compares that against what should be live.
- Nothing about your data is involved: the watchdog reads the same public pages and status line anyone can, and its alarms carry no user information — just which check went red. What you get from it is quieter: problems found by the machinery in minutes, not by a person days later.
The library speaks the search engines' language
- This morning the Learn library went public and dressed its links for sharing; this evening it learned to introduce itself to Google directly. Every public page now carries structured data — the machine-readable summary a search engine reads behind the words — so a result can show the crumb trail (Home › Learn › the article), the reading time and that it's free to read, before anyone clicks.
- The markup says exactly what the pages say and nothing more: each article is described as an article, never dressed up as a medical authority, keeping faith with the standing “not medical advice” promise. The front page and the library now also name the site to search engines as one property, which is what lets your own results group together over time.
- Same discipline as the rest of the library: the structured data is built by pinned, tested logic from the same reviewed catalog the pages render, so it can never drift from what a reader actually sees.
The library learns to introduce itself
- Send a Learn article to a mate and the link now unfurls into a proper card — the article's title, its category and reading time, and what it's about — in iMessage, WhatsApp, Slack, wherever links get pasted. This morning the library went public; this afternoon it dressed for the door. Every public page got its card: the articles, the library itself, the front page and this build log.
- The cards carry the same standing promises as the pages — free to read, not medical advice — so what a link claims and what the page delivers are the same thing.
The library opens to the street
- The Learn library is now public: every article has its own web address under kalcius.com/learn, readable without an account. Send a mate the self-exam guide or the "your results came back low" page and he can just read it — same reviewed copy the app carries, drawings included, no sign-up wall in front of the words.
- Search engines can find the library now, because the honest answer to an awkward 1am question shouldn't be locked behind a login. Only the articles are public — your dashboard and everything behind login is explicitly marked off-limits to crawlers, exactly as before.
- Links between articles work on the public pages too, so a reader can follow the thread from one answer to the next; links into the app lead to the front door.
The edit that didn't take
- Fixed: clearing something from a logged day now sticks. Removing a flow, a note, or a mood used to look saved and then quietly come back on your next visit — the deletion never actually left the form. This bit both day editors — the calendar's and the one on the shared page — on the web and the phone alike. If an edit of yours ever seemed to un-happen, this was why, and it's fixed.
- Also fixed: turning "intimacy logged" off on a day no longer keeps the old detail around to reappear if the switch ever comes back on. Off now means gone.
- "My period started today" now means today by your clock. Tapped in the first hour after midnight in summer, it used to log yesterday's date — the button trusted the universal clock instead of yours. Every form that offers today's date got the same fix, including last night's sleep log and today's mood.
- The web app now has its own automatic test suite, run before every deploy, pinning exactly these rules — the same discipline the server's code has had from the start. An edit that "didn't take" can't sneak back in unnoticed.
The new desk gets shaken down
- This morning the editing desk learned to start a page; this afternoon was spent trying to break it. The promises that matter held: nothing typed at the desk can become anything but words on a page — not code, not a link that leaves the app — on the web and the phone both, and every proposal still has to pass review before it touches the library.
- Three smaller things surfaced and were fixed the same day. A behind-the-scenes naming rule could have let two differently-named pages collide and jam the review pipeline — the names can no longer collide at all. A proposal that failed halfway used to leave invisible debris behind in the review system — a failed attempt now cleans up after itself. And when the review system can't be reached, the desk now says exactly that and does nothing, instead of half-starting a proposal and failing later with a confusing reason.
- The machinery that turns a draft into a reviewable proposal is now covered by its own automatic tests, so the next change to it can't quietly break what today confirmed.
The editing desk learns to start a page
- The back office could edit any article; now it can write a new one. Same door, deliberately: the copy gates run before anything happens — honest length, the doctor rule for self-exam and testing topics, links that never leave the app — and what passes becomes a proposed change that a second pair of eyes reviews before it ships. Nothing appears in the library until then.
- Where the new article sits is part of the proposal. The library is read top to bottom by design — what matters most comes first — so the writer picks the new page's place (after a chosen article, or at the end), and the reviewer sees that choice as plainly as the words.
- What a page is about gets chosen exactly once, in the open: its address and its category are set when it's proposed, reviewed like everything else, and fixed once it ships. A page can be reworded later — it can never quietly become a different page.
The pictures reach the iPhone
- This morning's drawings were web-only for a few hours; now the phone has them too, drawn natively and telling exactly the same story. The three-month pipeline sits under your trend charts on My Fertility, the any-100-sperm strips sit above “Understanding your numbers”, and each links through to the article that tells its story in full.
- The Learn reader on the phone now shows the picture versions in the same places as the web: open the three-month rule, the semen-analysis walkthrough, the bad-results article or the everyday-questions one, and the drawing leads before the words.
- The phone also gained the one drawing the web had first: “how the window is worked out” — the count-back arithmetic behind the fertile window — now appears in the everyday-questions article, above the same day-by-day odds chart the fertile-window screen has always drawn. One curve, drawn one way, however many doors lead to it.
The picture versions arrive
- This one came straight out of the feedback box — "more infographics, more user-friendly" — and it ships the honest way: three of the app's core ideas now come drawn, not just written, and every drawing shows real numbers the app already uses. Nothing is decoration.
- The three-month lag, drawn: a timeline on My Fertility shows how a sperm cell takes about 74 days to build plus two weeks in transit — so a habit changed today reaches a test roughly three months later, and a result this morning is a photograph of the last three months. It sits right under your trend charts, where "read the direction over months" needed a why.
- The fertile window finally shows its working on the web: "How these dates are worked out" on the Partner page draws the arithmetic — count back 14 days from the next predicted period, take the five days before ovulation and the one after — then the day-by-day odds pinned to your actual predicted dates. It is not a bell curve: the peak is the two days before ovulation, and the day after is a cliff. The iPhone has shown this curve for a while; the web caught up today.
- A semen analysis has a picture at last: any 100 sperm at the WHO typical line — 42 moving, 30 swimming forward, 4 normal shape. Four in a hundred looks alarming on a lab report; drawn as dots against the typical line, it looks like what it is — normal for everyone, which is why the body makes tens of millions.
- The pictures live where the questions come up: under the opening lines of the articles that tell each story (the three-month rule, reading a semen analysis, bad results, the everyday questions) and beside the live charts they explain. Same drawing wherever you meet it, so the app never tells the same story two ways.
The library gets an editing desk — with the review step kept
- The team can now edit any Learn article from the back office: title, standfirst, the whole body. What they can't do is publish directly — every edit becomes a proposed change that a second pair of eyes reviews before it ships. Health copy has always been reviewed like code here; now editing it is easy and the review survives.
- The same automatic gates that have always guarded the library run on every proposed edit before it even reaches review: articles must stay within honest reading length, self-exam and testing articles must point you at a doctor, links can never leave the app, and nothing can be smuggled in that the reader can't render. An edit that breaks a rule is refused on the spot, with the reason in plain words.
- What an article is about doesn't move — the team can rewrite the words, never quietly repoint a page's subject. And nothing changes on the live site until a reviewed edit actually ships, so the copy you read is always copy that two people stood behind.
Feedback grows teeth
- What you drop in the feedback box now flows straight onto the team's build board — the same place the daily development actually happens — so a report can't sit in a drawer. What travels is your words and the category, never your name or email: who sent something stays inside the app, where it belongs.
- When your feedback's status moves — Received, Seen, On the list, Shipped — that move now lands on the build board too. The status you watch on your feedback page and the tracker the builders work from can't quietly disagree.
- The team can now see whether accounts are alive: a user list with a signup date, a coarse last-seen time and a count of things logged in the last month. Deliberately coarse — the time updates at most every 15 minutes and there is no log of what anyone did or looked at. Counts and dates, never content: the back office still can't open anyone's logs or words.
The locks get tested — and one gets changed
- An afternoon spent auditing the newest promises instead of making new ones. The real find: re-saving a day on the shared view echoed the full stored day back in the reply — including mood observations and notes on links where those categories are held back. The apps never displayed any of it, but the promise is that withheld content never leaves the server at all. Now it doesn't.
- With cycle tracking held back, her page no longer shows the cycle-length settings or the trying-for-a-baby flag either. "Cycle tracking is not shared" shouldn't sit directly above the very settings it claims to hold back.
- If a link's stored sharing choice is ever unreadable — a corrupted record, a repair gone wrong — the link now shares nothing and announces every category as held back, instead of quietly sharing everything. Sharing someone's log is the one direction the server must never guess in.
- The safety net that stops a future new logging field from slipping through the scopes unclassified now checks the database schema itself, so it can't drift out of date by hand.
- Your data export now includes what your link shares — the scope choice is your data too.
- The back office's bootstrap door got a proper lock: the email allowlist that seats the first admin works only until that admin exists, then goes dormant — so nobody can claim an admin seat by simply registering a listed address first.
- Reactions on drafts are now strictly the seven preset emoji, on the server and not just in the app — and the team's stats page buckets anything unexpected as "Other". Counts, never anyone's words: the rule holds even sixteen characters at a time.
The badge case gets a curator
- The team can now rename any badge or rewrite its line from the back office — no redeploy, and every badge case (web and iPhone) shows the new words on next load. What earns a badge doesn't move: the criteria stay in code, so a badge on your shelf never quietly changes its meaning.
- Each badge now shows the team how many accounts hold it — a count, never a list of names. Which badges you've earned stays yours.
- The moment-of-earning flash now uses the badge's live name too, so a renamed badge congratulates you by the right one.
Sharing scopes reach the iPhone
- The three sharing switches — cycle tracking, mood observations, your notes — now live on the phone's invite form too, under Her → Her account. All on by default, chosen before the invite goes out, and the pending-invite screen says exactly what the outstanding email shares.
- On a live link, "What she sees" shows the current deal and lets you change it from the phone — Save and tell her. She's told the categories that changed, never the content, same as on the web.
- Her side of the app now honours the scopes properly: the shared view draws only what's shared, names each held-back category in a "Not shared with you" panel, and drops the form fields she couldn't read back anyway. With cycle tracking held back, the view is read-only and shows dated observations rather than pretending at period records.
- Until today a narrowed link simply showed her less on the phone without saying so — the one state the whole feature exists to prevent. That gap is closed.
- When he widens or narrows the link, the push notification now lands you directly on the shared page — the page whose shape it announces — instead of the generic Today screen.
You choose what the link shares — she always knows what it doesn't
- Inviting her to link accounts used to be all or nothing. Now the invite has three switches — cycle tracking, the mood observations you log, your written notes — and you pick before it goes out. All three start on, so nothing changes unless you choose it.
- What you hold back, she is told you hold back. Her page names the category — "mood observations are not shared" — never the content, and her invite email says the same before she accepts. Control for you, no secrecy from her: a link she can't see the shape of isn't transparency, and that promise is the reason the link is worth accepting at all.
- You can widen or narrow a live link from Her account at any time, and she's told what changed — the categories, the same way the link's ending is announced: stated, never negotiated, never explained.
- With cycle tracking held back, her view is read-only — there's no period to log or day to correct — and the log drops its cycle framing entirely, because a date with a mood on it is an observation, not a period record.
- Every link that already exists keeps sharing everything. That was the deal both of you accepted, and it stands until you change it yourself.
- The filtering happens on the server, not in the app: a category you've held back is stripped before it's sent, and can't be written to either. Coming next: the same three surfaces on the iPhone.
The briefing gets a replay button
- The first-day welcome briefing can now be run again any time: Settings → Welcome briefing on the web, and "Replay the app tour" in the iPhone's Settings. Nothing is reset or wiped — steps you skip write nothing, and anything you do log lands like normal.
The brief learns the play — and four days of features actually arrive
- The daily brief now ends with today's top play from your comms plan — the exact text to send, the question to ask, the move to make. Her status, the window, yesterday's wins, and one concrete thing to do about it, in the same push.
- The silence rule holds: a day with no real signal still sends nothing. The no-occasion filler play never wakes your phone on its own — the play line only rides when it's grounded in something (her code, a key date, your playbook) or the brief already had news.
- If you've already worked today's plan — every play sent or dismissed — the brief doesn't repeat it back at you. And discreet mode is untouched: the lockscreen still says nothing.
- The honest one: a wiring fault in the server had quietly failed every API deploy since 12 August. The safety check that guards your data caught it each time and refused to touch the live server — so nothing broke, but nothing new arrived either: her account link, the weekly insight, Privacy & AI, Plus on the iPhone and the feedback pipeline were announced here without being reachable. Fixed today; everything since 12 August is now genuinely live.
The back office opens: your feedback can finally move
- The feedback page has promised a pipeline — Received, Seen, On the list, Shipped — since the box first opened, but nothing behind the curtain could actually move a status. Now the team can. What you send gets triaged, and the status you watch is a real answer, not a permanent "Received".
- The people building Kalcius can now tune the AI writer — which model runs each feature, how it's prompted — live, without redeploying the app. That means the register of your drafts and daily plays can improve week by week. The safety rails don't move with it: the rules that bin a play mentioning the fertile window to her face, or an insight that overpromises, live in code and apply whatever the prompt says.
- Whether the tuning works is measured the same way everything here is: honestly and namelessly. Reactions and binned-draft tallies are counted — "Too cheesy ×4" — but a dismissal reason typed in your own words is only ever counted, never read.
- The health of the AI writer (speed, failure rate) now shows on a usage log that stores no user id and none of your text. Metadata only, by design — there is nothing on the admin page that can read anyone's logs, notes or messages.
The Clip chart learns to look back — and Plus gets a door where free stops
- The Clip's temperature chart now looks back 30 and 90 days, on the web and on the phone — 90 days being one full sperm production cycle, so the whole story of a habit change fits on one screen. Both charts were capped at 7 days for everyone; the "full history" Plus keeps finally has somewhere to be seen.
- Long windows draw as hourly or 3-hourly averages, and the chart says so — "720 points · 3h means" — instead of pretending they're raw readings. Averaged server-side, so the recent readings can never be crowded out by the old ones.
- Where free's 7-day history stops, the chart now says so plainly and Kalcius Plus is one tap away. Same on the phone's weight and sleep charts, which used to name-drop Plus and leave you to go hunting for it.
- The iPhone's delete-account page stopped pointing at the web for your data export — the export has lived on the phone since the last build (Settings → Privacy & AI), and the page now says so.
- Under the hood: the web framework moved up a major version (Next.js 16), clearing the last published security advisories in the old line. No behaviour change — fewer open doors.
Polish inside the new shape: taps that land, privacy in plain sight
- Tapping a notification on the iPhone now lands on the screen it's about — a code change or the window opening takes you to Her, a key-date heads-up to the dates list, a mate's suggestion to Friends. Until today every tap just opened the app wherever you left it. Discreet mode is untouched: the lockscreen still says nothing.
- The Today tiles are real doors now. Tests, sleep and heat all open their screens directly — the heat tile used to do nothing at all — and coming back to Today shows what you just logged without a pull.
- Settings grew a Privacy & AI page: the one findable place that says what travels to the AI writer when you've said yes (labels and weekly averages — never your notes), flips that consent on or off, and states the standing consents — health data, partner data, marketing — as plain facts.
- Your data export now happens on the phone: one tap builds the full JSON document — the same one the web's "Download my data" saves — and hands it to the share sheet. No more "go to the web dashboard" note.
- Badges got connected to where you earn them: a streak on the levers board links to the case, and sending a mate a suggestion that earns one links straight to it.
- Suggesting something to a mate now opens a proper compose sheet instead of unfolding inside the list, and a one-time note on Today explains the new map for anyone landing in the rearranged app.
The app finds its shape: Her, You, and a Settings that's just settings
- The iPhone tab bar now matches what the app became: Today, Calendar, Her, You, Settings. Most of the product had piled up as a sixteen-row list behind the Settings gear; everything now lives where you'd look for it, at most two taps from launch.
- Her is everything about her and the relationship: her status and the fertile window up top, then key dates, comms — the composer and the daily plan both — the playbook, date night, and her account link. Cycle setup finally has a second door here instead of living only on the Today tile.
- You is everything about you: My Fertility leads — it spent months filed under Settings — then the levers board, heat logging and the Clip reunited side by side, the context ledger, and the crew: friends, badges, and Learn.
- The calendar keeps its own tab on purpose: it's the one surface that belongs to both of you — her cycle and your days on the same grid. It also gained a door to the day-by-day fertile-window odds, which used to open only from Today.
- Settings is finally just settings: account, units, height, Kalcius Plus, notifications, email, password, feedback and the exits. If your account is someone's linked partner, "Shared with you" stays put here too.
- Nothing was removed and no screen changed inside — every feature kept its face and moved home. Signposts around the app ("the Levers tab", "the Today tab") were re-pointed to the new map.
Plus goes native: subscribe from the phone
- Kalcius Plus can now be bought on the iPhone, through the App Store — Apple's rails, your Apple ID, and Kalcius never sees the payment. Settings → Kalcius Plus: what's included, the price, one tap to subscribe, and manage-or-cancel right there on the same page. The web keeps its card checkout; both roads lead to the same Plus.
- Restore purchases works the way it should: new phone, reinstall, whatever — if this Apple ID bought Plus, one tap brings it back.
- Trust runs in the right direction: the app never grants itself anything. Every App Store purchase is reported to the server, which checks Apple's cryptographic signature all the way down to Apple's own root certificate before Plus switches on — and one App Store purchase can only ever unlock one Kalcius account.
- Renewals, cancellations, failed payments and refunds flow straight from Apple to Kalcius from then on. Same grace as the web: a failed card keeps Plus on while the App Store retries it, and cancelling keeps Plus until the period you paid for ends. Nothing is ever deleted either way.
- The Plus page (web and phone) now tells the truth about trajectories: they shipped — the page had still been promising them as 'coming next'.
The writer asks first: consent reaches the composer
- The AI writer now asks before it reads. Drafting a card, note, text or apology sends what you type — the situation, the details, her first name if you've set one — to the AI service, and that now needs the same recorded say-so as the weekly insight. The composer explains exactly what travels, and nothing else rides along: not your logs, not her cycle, not your notes.
- The daily plan follows the same rule. Without your consent it runs on the built-in rules engine — a designed state, not a punishment — and the AI register, which sends labels only (cycle code, mood words, key-date names), switches on only after you've said yes. The plan says which one you're looking at, and what would change it.
- One switch, everywhere: grant it in the composer or on the weekly insight card, revoke it from either — one tap, right where you turned it on, dated both ways in the consent trail. On the web and on the phone alike.
- Enforced in code, not just promised in copy: the server refuses to run a draft without an active consent, and new tests pin the gate on both paths — including that nothing is sent to the model on the way to a refusal.
One honest sentence a week: the Plus insight arrives
- The Body section ends with a new card, on the web and on the phone: once a week, one sentence read out of your own numbers — the kind of pattern that hides in the charts, like "your best-logged weeks this month all followed 7h+ sleep". Generated once per week, cached, and always phrased as an observed association — never a promise, never advice.
- It's off until you turn it on. The insight works by sending your weekly averages and mood labels to the AI writer, and that now requires your recorded say-so — a real consent, dated when you grant it, dated when you revoke it, switchable from the card itself in one tap.
- What leaves the server is enforced in code, not just promised in copy: weekly aggregate numbers and mood words from the app's own fixed vocabulary. Your notes never travel. Custom context-ledger entries — the ones in your own words — never travel either.
- What comes back is guarded the same way: a sentence that promises ("you will…"), diagnoses, or prescribes is binned before you ever see it. And when there aren't enough logged weeks to say anything honest, the card says so plainly — silence beats an invented pattern.
- Thin data, free tier, or the writer unavailable each get their own honest state — the card never fakes an insight it doesn't have.
A welcome of her own, and sleep on the sitrep
- Accepting a link invite now lands on a briefing written for her — what the link means, what she can see, how she holds the pen, and how to leave — instead of the setup flow built for him. The old flow asked her to "arm partner tracking" on herself; that's gone.
- Her web dashboard now leads the same way her phone does: a "Shared with you" panel at the top of Today, one tap from the full log. The men's-fertility tiles below are hers to explore or ignore — the briefing says so plainly.
- Sleep gets its sitrep tile, on the web and on the phone: your latest weekly average, which way it's heading, and — when you've logged enough nights — how many of your recent nights hit 7h+. Counted night by night, same as the chart: no zone, no countdown, no nagging when there's nothing logged.
- Under the hood: the web framework was updated to patch a set of published security vulnerabilities, including a critical one. No behaviour change — just fewer open doors.
Partner accounts reach the iPhone
- The account link now lives on the phone too. Settings → "Her account": invite her by email, watch the pending invite (resend or cancel it), and once she accepts, see the live link — and end it — from the same place as everything else.
- Her side is native as well. If your account is someone's linked partner, your Today screen leads with "Shared with you": the full log about you — every date, every mood observation, every note, nothing held back — right at the top, before anything else.
- From that shared view she can log "my period started today" with one tap, or add and correct any day — flow, how she actually felt, a note. Same rules as the web: her period start updates his Code status, and he gets a discreet heads-up that the shared calendar moved, never the detail on his lock screen.
- Ending the link works from the phone too, either side, with the same posture: immediate, unilateral, announced to the other person — never explained.
- Same deal as the web version shipped earlier today: the invite email says plainly what exists before it asks anything, the link in it works once and dies after 7 days, and declining is silent.
Her side of the story: partner accounts arrive
- You can now invite her to link accounts, from the Partner page. She gets an email that says plainly what exists — that you keep a log to better support her — and what linking means, before it asks anything of her.
- If she accepts, she gets her own Kalcius account and a "Shared with you" page showing everything logged about her: every date, every mood observation, every note. Nothing is held back — a transparency page that hides the uncomfortable parts wouldn't be one.
- She can correct the record or add to it directly — log her period the day it starts, say how she actually felt. Her logging a period start updates your Code status the same as if you'd logged it, and you get a discreet heads-up that the shared calendar moved.
- Either of you can end the link, unilaterally, at any time. The other is told the link ended — never why. She keeps her account; you keep what you wrote; she stops appearing in the shared view.
- The invite link lives in her email only, works once, and dies after 7 days — or the moment you cancel it. Declining is silent: ignore the email and nothing changes, and you aren't told.
- If she'd rather not, nothing changes: solo logging works exactly as before.
Sleep joins the Body section, and mood gets its strip
- My Fertility's Body section now charts your sleep: nights averaged into weekly points, with the 7h+ band drawn in — on the web and on the phone. The iPhone app fills it from Apple Health automatically, importing up to a year of nights the first time so the chart tells your story from day one; on the web you can log last night's hours by hand.
- The band is framed the way the SLEEP lever always has been: observational evidence associating chronic short sleep with worse parameters and lower testosterone. A guide, not a nightly exam — one rough night moves nothing, the maths takes the median trend, and there is deliberately no "ETA to sleeping well". Sleep gets a band, never a countdown.
- When you've logged enough recent nights, the chart tells you plainly how many of your last nights hit 7h+ — counted night by night, so two long lie-ins can't average away a short week.
- Under the charts sits the mood strip: the days you've logged, colour-coded, on the same time axis as the weight and sleep lines — so "the weeks I slept and the weeks I felt flat" becomes something you can see for yourself. No mood zones, no mood trends claimed: it's context, not a score. Log today with one tap right under the strip on the web, or from the Calendar tab on iPhone.
- The weight chart, sleep chart and mood strip now share one time axis, so the weeks line up as you read down the page.
- Under the hood: a night whose total grows as your watch finishes syncing now revises its stored row instead of sitting beside it — sleep history can't double-count, however many times it re-syncs.
The Body chart reaches iPhone — with a year of history on day one
- My Fertility on iOS now has the Body section: your weigh-ins averaged into weekly points, your personal zone drawn as dashed bounds, the dotted projection when you're heading for it, and your context-ledger markers — the same chart, the same honest framing, as the web.
- The Apple Health connection got serious about history. It used to read only your latest weigh-in; now the first sync imports up to twelve months of weight history, so the chart tells the story of the weight you've already lost the moment it first draws. After that it quietly picks up each new weigh-in.
- Re-syncs can't double your history: the server now recognises weigh-ins it has already stored and skips them, however many times a reinstall or a replayed sync sends them again.
- Your height lives in iOS Settings now too (with a ft/in translation as you type) — same rule as the web: optional, used for exactly one thing, clear it and the zone goes.
- Log a weigh-in straight from the Body card on the phone, in kg, lb or stone — whichever you've set.
Your weight gets a direction: the Body chart arrives
- My Fertility has a Body section: every weigh-in you've logged, averaged into weekly points and charted. Weigh in right there, or keep using the levers board — same log either way.
- Add your height in your profile (optional, used for nothing else) and the chart draws your personal zone — the weight band where studies find semen parameters at their best. Drawn honestly: it's an association, not a switch, BMI misreads muscular builds, and you can hide the band with one tap.
- Outside the zone and moving toward it? The chart projects your arrival — "if the last 8 weeks continue, you enter the zone around mid-October". A projection, not a promise: it says nothing when the trend is flat or the data thin, caps at "6+ months", and one wild weigh-in can't bend the line (the maths takes the median trend, not the average).
- Moving away from the zone gets a calm pointer at the levers board — never red, never a countdown. Shame isn't a feature.
- Losing faster than about a kilo a week raises a caution, not a cheer — crash dieting is itself a fertility lever pulled the wrong way. On a GLP-1 per your ledger, the framing flips: fast loss is expected, and the note points at keeping muscle instead. Creatine? The chart tells you the early step up is water, not fat.
- Your sitrep gets a Body tile: current weight, direction, and the zone ETA when you're on track.
- Free shows the last 7 days and where you stand; the trajectory needs months of history, which is what Plus keeps.
Kalcius Plus gets a till: billing arrives
- There's a Plus page now (also reachable from the sidebar box): what the subscription includes, an upgrade button, and — just as prominent — a two-click cancel through the billing portal. Nobody argues with you on the way out.
- Payments run through Stripe Checkout. Kalcius never sees your card number, and the page says so where you'd want to read it.
- Cancelling keeps Plus until the period you paid for ends, and nothing is ever deleted — your history is kept and unlocks again if you come back. A failed card payment doesn't yank features either: Plus stays on while the retry runs.
- The free/paid boundary is now real in the code: full reading and vitals history plus the AI writer and the AI daily-plan register are Plus; the rules-based daily plan, partner tracking and everything else stay free. Until billing is switched on server-side, nothing is locked — the AI features remain open to everyone.
- App Store subscriptions for iPhone come separately — Apple requires its own payment rails.
Parity complete: Date Night reaches iOS
- The date night planner is on the phone — the full idea deck, filterable by setting (at home, out, big swing) and budget, with the same "assign me a mission" roll when you can't decide.
- Pins sync with the web: mark the keepers and they float to the top of the deck on both platforms.
- Log a date from iOS — when, what you did, her reaction, and what worked — into the same history the web shows. Your first logged date still earns the Quality Time badge, and the app now tells you on the spot.
- That was the last item on the parity list: everything you can do on kalcius.com you can now do from the phone. Next up on the roadmap: Kalcius Plus billing.
Parity push, part four: the crew and the badge case reach iOS
- Friends is on the phone: invite a mate by email, accept or decline what comes in — decline-and-block included, with the same quiet privacy stance as the web: he's never told, and invites answer the same whatever actually happened.
- Suggestions travel both ways from iOS too: pick a topic — date idea, article, gear, habit — write it, send it. What mates send you lands highlighted until you tap "Got it", and your own sent history sits in a fold-away section.
- The badge case is in Settings: every badge in the catalog, earned ones lit with their date, locked ones dimmed with the criteria still readable. Your first suggestion to a mate still earns Good Friend — and now the app tells you on the spot.
- One parity item left on the list: the date night planner.
Parity push, part three: Learn and the feedback box reach iOS
- The Learn library is on the phone: all the straight-answer articles, with category filters, honest reading times, and a native reader for the house markdown — headings, lists, quotes and the links between articles all work, and tapping a link swaps the article in place just like the web.
- Related reading follows each article, and the context ledger now links through: if you've flagged TRT, steroids or the supplement stack, “Read the straight version” takes you to the relevant article in one tap.
- The feedback box is in Settings: bug, idea, confusing, or other — straight to the people building Kalcius, with the same status pipeline as the web so you can watch “Received” become “Shipped”.
Parity push, part two: the composer reaches iOS
- The comms composer is on the phone: cards, love notes, texts and apologies, with tone presets and the same eight one-tap starting points as the web — from "Just because" to "I messed up".
- Past drafts live under the form. Log how each one was received with a reaction, or bin it with a reason — same loop as the web, and every reaction teaches the writer what works for her.
- The Today screen's comms panel is now always the way in: even on a day with no plays, the composer is one tap away. Also reachable from Settings.
- If the AI writer isn't switched on server-side, the composer says so plainly instead of failing silently.
Parity push: My Fertility and the playbook reach iOS
- My Fertility is on the phone: log semen analyses and hormone panels, see every metric charted over time with the typical lab bounds drawn in and your context-ledger changes marked, delete what's wrong, and read the same honest reference explainers as the web. The sitrep gets a latest-results tile.
- On TRT or steroids per your ledger? The iOS page carries the same reframing the web does — suppressed counts read as expected mechanism, not a mystery.
- The playbook comes to where the moment happens: log a move from your phone — during, not after — with the situation preselected from her current code status. Rate it now or leave it "waiting on a verdict" and star it when the dust settles.
- Both live one tap from the Today screen and from Settings.
First test-drive feedback, actioned
- Weight units are now yours to choose: kg, lb, or stone and pounds — in your profile on the web, in Settings on iOS, synced across both. Display only; everything stays in kg underneath.
- Key dates can now be managed on iOS: add her birthday, your anniversary and the rest — with the heads-up lead time — from the Today screen or Settings. No more "do it on the web".
- The comms plan starts learning from your dismissals: every play you bin (and why) feeds the next day's generation, so "too cheesy" actually changes tomorrow.
- A hard tone rule for the plan, enforced in code, not just asked of the AI: words meant for her never mention the fertile window, the cycle or timing. Romance that reads as scheduled is worse than silence — any play that breaks the rule is dropped before you ever see it.
- Fixed: the context ledger's add form on iOS could open with an empty catalog, leaving only "Something else…" in the list.
The app starts catching up
- The daily comms plan lands on iOS: the top play on your sitrep, and the full plan a tap away — copy the words, mark plays sent, said or done, dismiss with a reason. Same plan as the web, same rule: every play says why it's there.
- The context ledger arrives in the iOS app too, under Settings: log medications and supplements with dates, with the same straight-talk context notes — and the same hard rule that it never feeds recommendations.
- Still web-first for now: fertility trend charts, the playbook, Learn and Friends. They're on the parity list.
The playbook
- On the Partner page: log what you actually did during PMS, her period, a conflict, a low stretch or the fertile window — and rate how it landed, 1 to 5. Two moments of honesty that build your own personal manual.
- Rate it later if you don't know yet. Moves logged in the heat of the moment sit as "waiting on a verdict" until the dust settles and you do.
- Here's the payoff: anything you rated 4 or 5 comes back through your daily plan the next time the same situation rolls around — "Run back what worked", quoting your own move and your own rating. Your evidence outranks our guesses.
- A 2/5 is a lesson, not a recommendation — poorly rated and unrated moves never get suggested back to you.
- The log-a-move form already knows the situation: open it during Code Red and it defaults to the right context.
- Private by design: playbook entries never pass through the AI writer — the "run it back" play is built word-for-word from what you wrote, by rules, not by a model reading your history.
The daily comms plan
- The sitrep now answers its own question. Up to five concrete plays a day — a text to send (words ready to copy), a thing to say tonight, a question to ask, a move to make — built from her cycle status and logged moods, upcoming key dates, the fertile window if you're trying, and even the day of the week (weekend plans get asked about on Thursday, not discovered on Saturday).
- Every play says why it's there — "Code Orange — a low-pressure text lands best in this window", "Anniversary in 9 days". No unexplained mind-reading, ever.
- Mark a play sent, said or done, or dismiss it — dismissing the lot is a fine outcome, and a thin-signal day gets a short plan, never filler. Fresh plan every morning.
- Works out of the box on built-in rules; when the AI writer is configured the same signals produce plays in a more personal register — labels only, never your notes.
- The top play sits on your sitrep, one glance from done.
The context ledger
- Log what you're taking — GLP-1s, TRT, finasteride, creatine, the usual supplement stack, or anything else — with dates, in your profile. Kalcius uses it for exactly one thing: explaining your own numbers.
- Your test trend charts now carry dated markers for every ledger change. Sperm made today were built over the last three months, so "started CoQ10" three months before a motility uptick is a story you can actually read.
- Each catalog entry comes with straight talk about what it means for your fertility data — including the TRT mechanism, told honestly, with the app reframing low counts as expected rather than mysterious while you're on it.
- Hard rule, stated in the app: the ledger never feeds product recommendations, and nothing in it is advice to start or stop anything — that conversation belongs with a doctor.
The long game, and a direct line
- Streak badges: seven days straight on a lever earns Locked In, thirty earns Iron Month, and ninety earns Full Cycle — ninety days being one complete sperm production cycle, so every sperm you're making by then was built under the new habit. Long-standing streaks collect what they've already earned the next time you log.
- A feedback page, in the sidebar: bug, idea, confusion or anything else, sent straight to the people building Kalcius. You can see everything you've sent and watch its status move from Received to Shipped.
My Fertility grows up
- Trend charts on My Fertility: log two or more tests and every metric gets its own chart — your numbers over time, with the typical lab bounds drawn in, and the change since your last test. This is the question the whole product exists to answer: which way are things moving?
- Hormone panels can now be logged on the web: testosterone, FSH and LH, with honest reference ranges and plain-English explanations of what each signal actually means.
- DNA fragmentation joins the semen analysis form, with the caveat it needs — cut-offs differ between assays, so your own lab's threshold is the one that counts.
- Notes on test results: record abstinence days, illness, or anything else the numbers need context for, right on the result.
The crew arrives
- Friends is live on the web — the last placeholder page is gone. Invite a mate by email; if he's not on Kalcius yet, he gets a proper invitation email instead.
- Suggestions between friends: send a date idea, an article, or gear that works straight to a mate's app — the "Jeff suggested…" loop. First one sent earns the Good Friend badge.
- Invites are built to respect a no: decline is silent, and decline-and-block makes every future invite from that account disappear without a trace — the sender can't even tell.
- The invite endpoint answers identically whether or not an email has an account, and carries its own tight rate limit, so it can't be used to probe who's on Kalcius.
The Learn library opens — and this page exists
- Learn is live: eleven articles covering the questions men actually have — how to do a self-exam, how to read a semen analysis, heat exposure, the three-month rule, testing routes, supplements, training and steroids, nutrition, the 1am questions, and how to talk about it. Written straight, with clear pointers on when a doctor should be involved.
- This changelog. Kalcius ships most days, and from now on every build is logged here, dated, back to the start.
- Web push notifications now carry the Kalcius icon instead of a broken image placeholder.
- Under the hood: the web app is now type-checked before every deploy, so a broken build can't reach the site.
Your data, your exit
- Full data export: download everything Kalcius holds about you as a single JSON document, from your profile settings.
- Hard account deletion: when you leave, your data actually goes. Not deactivated — deleted.
- The levers board arrives on the web, matching the iOS app: evidence-ranked fertility commitments with daily tracking.
- More tests pin the streak arithmetic and the levers catalog's promises, so they can't quietly regress.
Hardening week
- Rate limiting across the API: per-IP budgets, tightest on sign-in and password reset, where brute force lives.
- The core calculation logic — cycle maths, abstinence windows, timezone handling — now has a unit-test suite that runs before every deploy.
Notifications, even mid-scroll
- iOS notifications now show while the app is open in the foreground, instead of arriving silently.
Push delivery you can trust
- Push delivery failures had been invisible. They now surface properly, so a silent outage can't quietly eat your briefs.
- A test button for the daily brief: fire one on demand and see exactly what it would say, with the reasons behind each line.