1. Parental Gate on Adult Content Adult-specific screens (Symptoms Checker, Perimenopause, Menopause) are now protected by a parental gate using an arithmetic challenge, implemented per Apple Human Interface Guidelines. Users must correctly solve a randomised addition problem before accessing these screens. Gate clearance is stored securely in Keychain. 2. Age Rating We are resubmitting for a 12+ age rating. Adult health content is now gated as described above. 3. In-App Review Prompt SKStoreReviewController is triggered once after a user completes their first cycle log. Apple's 365-day cooldown is respected and the prompt fires a maximum of once per install. 4. Push Notification Re-engagement Re-engagement notifications are scheduled locally at 7, 14, and 30 days of inactivity. No external push infrastructure is used — all notifications are scheduled on-device via UNUserNotificationCenter. 5. Doctor-ready PDF Export (Premium Feature) Premium subscribers can export the last 6 months of cycle data as a formatted PDF report for sharing with healthcare providers. Generated entirely on-device using PDFKit — no data leaves the device. 6. Updated Subscription Pricing Three subscription tiers are now available — Annual ($49.99), Monthly ($5.99), and Weekly ($2.99) — each with a 90-day free trial granting full access to all features. Pricing is managed via RevenueCat and App Store Connect. 7. Onboarding Flow Onboarding has been updated to collect goal selection and last period date upfront, enabling personalised cycle predictions to be shown before any account creation is requested. 8. Privacy Positioning The app's core anonymous mode feature is now prominently communicated throughout the app and store listing. No email or name is required at any point. All health data remains on the user's device.

Thank you for reviewing Flovulation. We are resubmitting version 1.1.0 (Build 3) which includes the following significant updates: Security Hardening: 1. API Key Protection — All RevenueCat API keys have been removed from hardcoded source code and moved to a secure local configuration file (Config.swift) which is excluded from version control via .gitignore. Git history has been fully cleaned of any previously exposed keys using git filter-repo. 2. Rate Limiting — A SecurityManager class has been implemented across the app that enforces client-side rate limiting (maximum 10 requests per 60-second window) on all sensitive operations including purchase attempts and API calls. 3. Input Validation — Strict input validation has been added for all user-facing fields including age (10–60), weight (20–300kg), height (50–300cm), sleep hours (0–24), water intake (0–20L), baby kick counts (0–200), nickname fields (1–30 chars, alphanumeric only), notes fields (max 500 chars), payment fields (card number, CVV, expiry date), and all text inputs are sanitised to prevent XSS and injection attacks. 4. Network Security — A NetworkSecurity class enforces TLS 1.2 minimum, disables cookie storage and caching, enforces HTTPS on all connections and validates SSL certificates on all network requests. 5. App Transport Security — NSAppTransportSecurity has been configured in Info.plist with NSAllowsArbitraryLoads set to false, ensuring all network connections are HTTPS only. 6. Jailbreak Detection — The app now detects compromised devices and logs security events appropriately. 7. Secure Logging — All security events are logged in DEBUG builds only and never exposed in production builds. 8. iOS 26 SDK Compliance — This build has been compiled with Xcode 26.5 and the iOS 26 SDK as required by Apple's updated submission requirements. The app continues to use Firebase for analytics and RevenueCat for subscription management, both of which handle their own server-side security. All sensitive health data (cycle tracking, pregnancy logs, wellness data) is stored locally on device using SwiftData and is never transmitted to any external server.