Period tracking apps collect some of the most sensitive health data imaginable: menstrual dates, pregnancy attempts, sexual activity, health conditions, and symptoms. What happens to that data varies enormously between apps — from strong protection to active selling to third parties. Here's the current state.
Flo Health was charged by the FTC for sharing users' reproductive health data with Facebook, Google, Flurry (Verizon subsidiary), and AppsFlyer — despite explicitly promising users it would not. The shared data included period dates and information about pregnancy attempts, linked to device identifiers that could be connected back to individual users.
Flo settled the charges and has since updated its practices and privacy policy. However, the track record is factual history. Flo's current privacy stance has improved but continues to use third-party analytics and advertising SDKs. Read their current privacy policy carefully — particularly the data sharing section.
Ovia's parent company Labcorp sells aggregated reproductive health data to self-insured employers. The company markets this service as a "benefit" — employers can access population-level pregnancy and health data about their workforce. Even aggregated data about a small workforce can effectively be re-identified. The potential for discrimination — in hiring, promotion, or insurance — is obvious.
Ovia's individual user data is described as de-identified before sharing, but the employer data selling model creates a structural conflict of interest between Ovia and its users.
Period Tracker by GP Apps was subject to privacy complaints after it was reported that user data was accessible to the app's developer and potentially shared. It was flagged in multiple privacy reviews as having inadequate protections for health data.
WomensPal does not sell user health data to any third party — not advertisers, not employers, not data brokers. It is GDPR-compliant. The business model is not dependent on monetizing user data. Privacy policy: womenspal.com/privacy.
Clue is based in Germany and subject to GDPR enforcement — one of the strongest privacy legal regimes in the world. Clue has publicly committed to not selling user data and has been consistently rated well in privacy reviews from Mozilla and others. Uses limited analytics but with significantly more disclosure than US-based apps.
The most private option: open source, no account required, no server connection. Data is stored only on-device and never transmitted. If you are most concerned about privacy above all else, this is the choice.
Read the "How We Share Information" or "Data Sharing" section of the privacy policy specifically — not the introductory paragraph that says "we care about your privacy." Look for: who they share with, whether "business partners" or "analytics providers" are listed, whether they use advertising SDKs, and how they handle law enforcement requests.
📝 From The Paper Shop by WomensPal
Flow & Glow — Cycle Tracker Journal
Log your cycle, symptoms, mood & energy in one beautiful printable PDF. Print at home, fill forever. On sale for $4.89.
Get it — $4.89 →Try WomensPal — 100% Free, Forever
No subscription. No data selling. Works for irregular cycles, PCOS, perimenopause, and TTC.
Download Free →