Period Tracking Apps and Privacy: What to Check Before You Trust One

A period tracker knows when you menstruate, when you might be fertile, whether you’ve logged a pregnancy, your symptoms, your mood and sometimes your sex life. That’s some of the most personal data you can hand to any app.

Many people assume that kind of information is protected by health privacy law. Usually it isn’t. Most period and fertility apps you download yourself sit outside HIPAA, which means the app’s own promises, your settings and a patchwork of federal and state rules do most of the work.

The good news: you can check an app’s privacy setup in about 15 minutes. This checklist walks through what to look for, which warning signs matter, and how to lock down or leave an app you already use.

Why period tracker privacy deserves extra care

Cycle data is unusually revealing. A missed period, a pregnancy log that suddenly stops, or a note about a procedure can tell a story about your health, relationships and decisions. In some situations, that data could be requested in legal disputes or investigations, or used for ad targeting you never agreed to.

Regulators have already acted on real cases:

• Flo Health (2021). The Federal Trade Commission alleged that the Flo Period & Ovulation Tracker shared users’ health information with outside analytics and marketing firms, including Facebook and Google, after promising to keep it private. The FTC finalized its order in June 2021, requiring Flo to get users’ affirmative consent before sharing health information and to have an independent review of its privacy practices.
• Premom (2023). The FTC and Department of Justice alleged that Easy Healthcare, maker of the Premom ovulation app, shared sensitive health data with third parties, including Google and AppsFlyer, and shared device and location data with 2 China-based firms. The proposed order announced in May 2023 included a $100,000 civil penalty under the FTC’s Health Breach Notification Rule and a ban on sharing health data for advertising.

Neither case means every period app misbehaves. They do show why you shouldn’t rely on an app’s marketing alone.

Key takeaway: Treat your period tracker like a diary that someone else holds. The right questions are where it’s kept, who else can read it, and whether you can take it back.

Is a period app covered by HIPAA?

Usually not. HIPAA applies to health plans, most healthcare providers and their business associates. An app you download from an app store and use on your own is generally outside HIPAA, even if it handles health data. Our guide on whether your health app is covered by HIPAA explains the line in detail.

What does apply:

• The FTC Act, which bars deceptive and unfair practices. If an app breaks its own privacy promises, the FTC can act.
• The FTC Health Breach Notification Rule, which requires many health apps outside HIPAA to notify users, the FTC and sometimes the media when health data is disclosed without authorization, including unauthorized sharing, not just hacks.
• State consumer health data laws. Washington’s My Health My Data Act is the broadest. According to the Washington Attorney General, it makes selling consumer health data without valid authorization unlawful and gives consumers a right to have their health data deleted. Its main obligations applied from March 31, 2024 for most companies and June 30, 2024 for small businesses. Washington residents can also sue under the state’s Consumer Protection Act. Other states have their own rules; see our guide to US state data privacy laws.

One more point: a 2024 HIPAA rule that added extra protections for reproductive health records was vacated by a federal court in Texas in June 2025, and reports say the appeal was later dismissed. That rule covered doctors and health plans, not consumer apps, but it’s a reminder that federal protections can change. Check hhs.gov for the current status. This is not legal advice.

The period tracker privacy checklist

Work through these 8 checks before you start an app, or now for the one you already use.

1. Where is your data stored?

Look for 1 of 3 setups:

• On your device only. The data never leaves your phone unless you export it. This is the most private option, but you can lose your history if you lose the phone without a backup.
• Cloud with end-to-end encryption. Data syncs between devices, but the company can’t read it. Apple, for example, says that when you use Cycle Tracking in the Health app with two-factor authentication on, health data synced to iCloud is end-to-end encrypted and Apple doesn’t have the key.
• Standard cloud account. The company stores your data on its servers and can access it. That’s common and not automatically bad, but it means the company’s policies, security and legal obligations govern your data.

2. Is it encrypted, and who holds the keys?

“Encrypted” alone isn’t enough. Nearly every app encrypts data in transit. The question is whether the company can decrypt your data on its servers. Look for the phrase “end-to-end encrypted” or “we cannot read your data,” and check whether that applies to all your logs or only some.

3. Does it share data for advertising or analytics?

Search the privacy policy for “advertising,” “third parties,” “partners,” “SDK” and “analytics.” Many apps include software kits from ad and analytics companies. The Flo and Premom cases both centered on data flowing to those kinds of partners. A good sign is a clear statement that health data is never shared for advertising.

4. Does it sell data?

Look for a plain “we do not sell your personal data” statement. Under several state privacy laws, “sale” can include sharing data for something of value, not just cash. If the policy hedges or has a “Do Not Sell or Share” link without explaining what’s shared, dig further.

5. Can you use it without an account?

Some apps work fully offline or let you skip an email sign-up. Others offer an anonymous option. Flo, for example, offers an Anonymous Mode that it says removes identifiers such as your email from your account, with the trade-off that you can’t recover data if you lose the device. Less identity attached to the data means less risk if it’s ever shared or requested.

6. Can you export and delete everything?

Check for a clear delete-account option inside the app, not just “email us.” Ideally, the policy says deletion covers backups and data held by service providers. Washington’s law, for example, gives consumers a right to deletion that extends to archived or backup systems.

7. What does it say about legal requests?

Look for a section on law enforcement or government requests. Better policies explain that the company requires valid legal process, pushes back on overly broad requests, notifies users when legally allowed, and publishes a transparency report. Apps that can’t read your data have less to hand over.

8. Who makes it, and how long has the policy been stable?

Check the developer’s name, location and history. Read the “last updated” date and any change log. Frequent, unexplained policy changes or a developer you can’t identify are warning signs.

Quick comparison of storage models

Red flags that should make you pause

Some signs are worth walking away over:

• The privacy policy is missing, vague, or only available after you sign up.
• The app asks for location, contacts or microphone access it doesn’t need to track a cycle.
• Health data is mentioned alongside “marketing partners” or “interest-based advertising.”
• There’s no in-app way to delete your account.
• The app pushes you to link social media logins for basic use.
• The developer is hard to identify or contact.

You can also limit what any app collects in your phone’s settings. Our guide on how to stop apps from tracking you covers the iPhone and Android controls.

Where to start: lock down the app you already use

If you already use a period tracker, don’t panic and don’t delete it in a rush. Do this instead:

1. Read the privacy section in 10 minutes. Use the 8 checks above and note any “no” answers.
2. Turn off what you don’t need. Disable ad tracking, location access, and optional “research” or “personalization” sharing in the app and in your phone’s settings.
3. Trim what you log. You can track a cycle without logging every detail. Skip notes or fields you’d be uncomfortable seeing outside the app.
4. Add an account lock. Use a strong phone passcode and the app’s PIN or biometric lock if it has one.
5. Export, then decide. If you plan to switch, export your history first, then use the app’s delete-account tool. Save any confirmation email.
6. Switch to a better fit. Choose an app whose storage model matches your comfort level: on-device or end-to-end encrypted if privacy matters most.

If you learn your app had a breach or shared data without permission, our guide to what to do after a health data breach explains the next steps. For other sensitive data you’ve given apps, see what happens to your DNA test data. Terms you’re unsure about are usually covered in our glossary.

The bottom line

A period tracker can be genuinely useful for spotting patterns, planning and talking with your doctor. You don’t have to give that up to protect your privacy. Pick an app that stores data on your device or encrypts it end to end, doesn’t share health data for advertising, and lets you delete everything. Then log only what you need.

This is general information, not medical advice.

Sources

• FTC: FTC Finalizes Order with Flo Health — Flo case, order terms and date
• FTC: Ovulation tracking app Premom will be barred from sharing health data for advertising — Premom allegations and $100,000 penalty
• Washington Attorney General: Protecting Washingtonians’ personal health data and privacy — My Health My Data Act rights and effective dates
• Apple Support: Track your period with Cycle Tracking — end-to-end encryption of synced cycle data
• Flo: Anonymous Mode FAQ — how Flo’s anonymous option works and its trade-offs