Are Period Tracking Apps Private?
It depends on the app. In the US, HIPAA generally does not cover health data you enter into a consumer app, so privacy rests on each company's own policy, and some trackers have shared sensitive data with analytics and ad firms. Before logging, check whether an account is required, whether data is sold or shared for ads, what the App Privacy label lists, and whether you can delete everything.
Why does period app privacy matter?
A period tracker can hold some of the most personal data on your phone: when you bleed, when you have sex, your symptoms and moods, whether you are trying to conceive, and whether you are pregnant. That information is useful to you. It can also be valuable to advertisers and data brokers. So the question is less whether period apps are private and more whether this app is, and how you can tell.
The good news is that you can check most of what matters before you log a single day.
Does HIPAA protect my period app data?
Usually not. Many people assume US health privacy law covers any health information. It does not. The US Department of Health and Human Services (HHS) explains that the HIPAA rules protect health information held by “covered entities”, meaning health plans, most health care providers and clearinghouses, and by their business associates.
HHS says the HIPAA rules generally do not protect health information accessed through or stored on your personal phone or tablet. In most cases they also do not protect data you have entered into mobile apps for your own use. The exception is an app provided to you by a covered entity or its business associate. HHS also warns that the information your apps collect may be used to show you targeted ads, or sold to data brokers.
In practice, a consumer period tracker is bound by its own privacy policy and by general consumer protection and privacy laws. HIPAA is generally not part of it. What the company promises, and whether it keeps those promises, matters a great deal.
What happened with Flo?
The best-documented case involves Flo, one of the most popular period apps. In January 2021, the Federal Trade Commission (FTC) announced a proposed settlement with Flo Health, whose app it said was used by more than 100 million people. The FTC alleged that Flo had promised to keep users’ health data private, yet shared health information with outside analytics and marketing firms. Those firms included Facebook’s and Google’s analytics divisions, Google’s Fabric service, AppsFlyer and Flurry. According to the FTC, the shared data included details such as the fact that a user was pregnant. It was sent as “app events” through tools built into the app, and the sharing continued until a news report exposed it in February 2019.
The FTC finalized the order in June 2021. It requires Flo to get users’ affirmative consent before sharing their health information, to obtain an independent review of its privacy practices, to notify affected users, and to tell the third parties that received the data to destroy it. The Register reported that Flo settled without admitting wrongdoing.
A private class action over the same data went to a jury trial in federal court in Northern California. In August 2025, The Register reported, the jury unanimously found that Meta had violated the California Invasion of Privacy Act. Google and Flurry had agreed to settle, and AppsFlyer had been dismissed from the case in 2022. Meta told The Register it “vigorously” disagreed with the outcome and was exploring its legal options.
The lesson is not that every tracker behaves this way. It is that the software development kits (SDKs) bundled inside an app, for analytics, advertising or attribution, can carry data far beyond the company you chose to trust.
What did independent reviewers find?
In August 2022, the Mozilla Foundation’s *Privacy Not Included guide reviewed 25 reproductive health apps and wearables. These included ten period trackers, ten pregnancy apps and five fertility-tracking wearables. Eighteen of the 25 earned its privacy warning label. Mozilla reported that most apps gave vague, boilerplate answers about when they would share data with US law enforcement. Eight failed to meet its minimum security standards. Only one app, Euki, which stores data locally on the device, earned a “Best Of” badge. The wearables fared better, and none of them got the warning.
Apps change their policies and code over time, so a 2022 review is a snapshot rather than a verdict on any app today. The questions Mozilla asked are still the right ones, though.
What should I check before choosing a period tracker?
Use this checklist on any app, including the one you already have.
| Question | Why it matters | Where to look |
|---|---|---|
| Can I use it without an account? | No email or name means less identifying data tied to your logs | The app’s first screens; the App Store description |
| Is my data sold, or shared for advertising? | Selling and ad sharing are how intimate data reaches companies you never chose | The privacy policy: search for “sell”, “advertis”, “third part” |
| Which analytics or ad SDKs are built in? | In the Flo case, the data went out through analytics tools inside the app | The App Privacy label; the privacy policy’s list of processors |
| What does the App Privacy label say? | It shows the data collected, whether it is linked to you, and whether it is used to track you | The App Privacy section on the App Store page |
| Is data stored on the device, in the cloud, or both? | Local storage leaves less with the company; cloud storage enables sync and backup | The privacy policy; the app’s settings or FAQ |
| Can I delete my account and all my data in the app? | Deletion should be easy and complete, not an email request | The app’s settings |
| What happens with law enforcement requests? | A clear policy tells you how the company responds | The privacy policy or a transparency page |
| Can I lock the app? | A passcode or Face ID lock protects you from someone holding your phone | The app’s settings |
No single answer makes an app safe or unsafe. Read them together.
How do I read the App Privacy label?
Apple requires an App Privacy section on the App Store product page of new apps and app updates. Apple says it shows the data types an app may collect, and whether that data is linked to you or used to track you. Health data and “sensitive info”, which includes pregnancy and childbirth information, are separate categories.
Two details help when you read one. First, the label covers the practices of the app’s third-party partners, including analytics tools, ad networks and other SDKs, not just the developer’s own code. Second, the developer writes the label, and Apple holds the developer responsible for keeping it accurate. Treat it as the company’s own declaration. Compare it with the privacy policy, and be wary if the two do not match.
Apple defines “tracking” as linking data from the app with data from other companies’ apps and websites for targeted ads or ad measurement, or sharing it with a data broker. If health or sensitive info appears under tracking, that is a strong reason to look elsewhere.
Is storing data on my phone always more private?
Not always, but it does keep less in someone else’s hands. Data that never leaves your device is not “collected” in Apple’s terms. A cloud account has real benefits: your history survives a lost or replaced phone, and you can use more than one device. What matters is what the company does with the copy it holds. Ask whether it is sold, shared with advertisers or used for ads, and whether you can delete it completely.
Lunation, the app behind this site, takes the cloud route and is open about it. It works without an account, in guest mode. Your health records are stored in your account on Google Firebase so they can sync, and they are never sold, never shared with advertisers and never used for ads. The app does use a privacy-limited measurement of which ads brought someone to it: install and trial-start events, with no health data. You can delete your account and all your data from inside the app. That is a different promise from “nothing ever leaves your phone”, and it is worth knowing the difference for any app you use.
What can I do today with the app I already use?
- Open its App Privacy label and compare it with what you expected.
- Turn off cross-app tracking. HHS points iPhone users to Settings, then Privacy, then Tracking, where you can switch off “Allow Apps to Request to Track”.
- Limit location access to apps that truly need it. HHS notes that many apps that resell data to brokers do not need your location.
- Delete what you no longer want stored, or the whole account, if you decide to switch.
You do not need to stop tracking your cycle to protect your privacy. You just need an app whose promises you have checked.
Frequently asked questions
Does HIPAA protect my period tracker data?
Usually not. HHS says HIPAA generally does not protect data you enter into mobile apps for personal use, unless the app is provided by a covered entity such as your health plan or provider, or by one of its business associates.
Did Flo share users' period data?
The FTC alleged that Flo shared users' health information, including pregnancy details, with analytics firms such as Facebook's and Google's after promising to keep it private. Flo settled with the FTC in 2021, and the final order requires users' affirmative consent before Flo shares their health data.
Can the police get data from my period app?
Any company that holds your data can receive legal requests, and its privacy policy should explain how it handles them. In 2022 Mozilla found that most reproductive health apps it reviewed gave no clear guidance on when they would share data with US law enforcement, so look for a clear statement in the privacy policy.
Is a period tracker that stores data only on my phone more private?
It leaves less data with the company, which reduces exposure. The trade-off is that you may lose your history if you lose or replace your phone without a backup, so weigh it against what a cloud account offers.
How do I check what a period app does with my data?
Read the App Privacy section on the app's App Store page, which shows the data types it collects, whether they are linked to you and whether they are used to track you. Then check the privacy policy for selling, advertising and deletion.
Sources
- Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone or Tablet. US Department of Health and Human Services (HHS).
- Developer of Popular Women's Fertility-Tracking App Settles FTC Allegations that It Misled Consumers About the Disclosure of their Health Data (January 13, 2021). Federal Trade Commission (FTC).
- FTC Finalizes Order with Flo Health, a Fertility-Tracking App that Shared Sensitive Health Data with Facebook, Google, and Others (June 22, 2021). Federal Trade Commission (FTC).
- Meta used Flo menstruation app data to sell ads, jury finds (August 5, 2025). The Register.
- In Post Roe v. Wade Era, Mozilla Labels 18 of 25 Popular Period and Pregnancy Tracking Tech With *Privacy Not Included Warning (August 17, 2022). Mozilla Foundation.
- App privacy details on the App Store. Apple Developer.
Published · Last updated · Written by the Lunation editorial team.
Medical disclaimer. This article is general wellness information, not medical advice. It does not diagnose or treat any condition. If something about your cycle or your health worries you, talk to a doctor or midwife.