Most app design assumes the user has a private phone in a private home. Most of the world is not like that. Phones are shared, screens are checked, lock codes are known, and the visibility of an app on the home screen can be its own risk.
Stealth Mode is the part of mylune designed for that reality.
What Stealth Mode does
When Stealth Mode is on, mylune changes shape on the user's home screen. The icon becomes a calculator or a generic utility. The name in the app library changes. The notifications no longer mention periods, symptoms, or cycles. The widget, if installed, becomes generic.
Inside the app, everything still works. The user opens what looks like a calculator, enters a private PIN, and the real app appears. To anyone watching, it is a calculator. To her, it is her cycle tracker, untouched.
The mechanism is simple. The implementation matters because the small details are what make it work in real life, not just in a demo.
What it is for
Stealth Mode exists for several different kinds of users, who have very different threats but a common need.
- Women in controlling relationships, where a partner checks her phone for evidence of what he considers unauthorised activity.
- Adolescents and young women in households where speaking about menstruation openly is not safe, expected, or welcome.
- Women in shared living situations, where roommates, in laws, or extended family members have access to the phone.
- Anyone in a country, region, or workplace where reproductive autonomy is socially or legally constrained, and where evidence of cycle tracking might be used against them.
- Anyone who simply does not want a health app to appear in screenshots, app store recommendations, or quick switcher previews.
Some of those users face mild discomfort. Some face genuine danger. Stealth Mode is designed for the most serious of those cases, because the same mechanism then covers all of the rest.
What it deliberately does not do
Stealth Mode is not a security feature in the cryptographic sense. It does not protect data from forensic device extraction. It does not hide the app from a determined adversary with physical access and time. It does not survive an unlocked device in someone else's hands.
It is, instead, a friction layer for the kinds of casual inspection that account for the majority of unwanted disclosures. A glance at the home screen. A scroll through the app drawer. A push notification preview on the lock screen. A screen share during a video call. A child handing the phone to a parent who scrolls through it. The mechanism is built around those moments, because those are the moments where most disclosures happen.
For the harder threat model, where someone hostile has time, access, and motivation, no app feature alone is enough. mylune's broader architecture, where the data never leaves the device, plus the device's own encryption, plus Stealth Mode, plus optional auto deletion under Legal Protection Mode, are all parts of an overall posture. None of them is the whole answer.
Why we built it into V1
It would have been easy to defer Stealth Mode. It is a feature most users will never enable. It does not show up in App Store screenshots well. It complicates QA. It adds support cases.
We built it for V1 anyway, because the women who need it cannot wait for a v1.5 release schedule. They are using a tracker today, or choosing not to track at all because the existing trackers are too visible. The presence of Stealth Mode at launch is what makes mylune usable for them. We did not want a product that was usable by everyone except the people who needed it most.
How to turn it on
Stealth Mode lives inside Settings, under Privacy. You pick the icon disguise, set a separate Stealth PIN if you want one, and the app shifts.
To leave Stealth Mode, you do the same thing in reverse from inside the app. There is no automatic "phone home" trigger to enable or disable it. The state is controlled entirely by you.
That is the design intent throughout mylune. The user owns the controls because the user owns the risk.