Are Period Tracking Apps Safe? Privacy Questions to Ask

Period tracking apps can be safe to use, but safety depends on the specific app and how it handles your data. Cycle information is sensitive health data, so it is worth checking where it is stored, who it is shared with, whether it is used for advertising or analytics, and whether you can delete it.

Quick summary: Regulators and researchers have raised real concerns about some reproductive health apps, including an FTC case in 2021 and a 2022 Mozilla review. That does not mean every app is unsafe. Use the checklist below: read the privacy label and policy, minimize what you share, use device security, and pick an app that fits your comfort level.

Disclosure: Mochi Moon publishes this article and makes a period tracker. We have kept this to documented facts and general questions, not rankings.

Why cycle data is sensitive

Your logs can reveal when you are on your period, whether you may be pregnant, symptoms, moods, sleep and sexual activity. That is intimate information. Whether you think about it as a medical record, a diary or both, you probably want to know who can see it.

What regulators and researchers have found

The 2021 FTC case

In January 2021 the FTC announced a proposed settlement with Flo Health, the maker of the Flo Period & Ovulation Tracker app. The FTC alleged that Flo disclosed health data from millions of users to third parties that provided marketing and analytics services, including the analytics divisions of Facebook and Google, after promising to keep that data private. The settlement terms included an independent review of Flo's privacy practices and getting users' consent before sharing their health information.

In June 2021 the FTC finalized the order. Among other requirements, Flo had to notify affected users and instruct third parties that received the data to destroy it, and was barred from misrepresenting how it collects, uses and protects data.

The FTC releases describe allegations and the order. They do not say whether Flo admitted or denied them. The case is also several years old, so the helpful takeaway is general: a company's promises and its actual data flows can differ, and regulators can act when they do.

Mozilla's 2022 review

In August 2022, after the US Supreme Court's decision overturning Roe v. Wade, Mozilla's *Privacy Not Included team reviewed 25 reproductive health products: ten period trackers, ten pregnancy trackers and five wearables. It put its privacy warning label on 18 of the 25, citing concerns about how some apps collect, share or protect intimate data and how they respond to law enforcement requests. Wearables fared better.

That review is from 2022, and apps change their policies, so use it as context, not a current verdict on any particular app. Mozilla's site is the place to check up-to-date ratings.

A practical privacy checklist

Before you start logging, check these.

1. Read the App Store privacy label. Apple's labels are developer-reported, and they show categories such as "data used to track you" and "data linked to you." Compare apps side by side. A longer list is not automatically bad, but you should know why each item is there.
2. Look for third-party analytics and advertising. Does the app say it shares data with analytics or marketing partners? Is health data included?
3. Find out where data lives. On your device only, in the cloud, or both? Cloud storage can make backup easy but means someone else holds a copy.
4. Check deletion. Can you delete your account and data from within the app? How long does it take?
5. See what happens with sharing. If an app lets you share with a partner, can you choose what is shared, and can you stop at any time?
6. Read the policy for how law enforcement requests are handled. Vague language is a flag.
7. Understand encryption claims. "Encrypted" can mean different things. End-to-end encryption means only you hold the key. Apple says that with two-factor authentication, Cycle Tracking data synced to iCloud is end-to-end encrypted.
8. Check who the company is. Where is it based, and how does it make money? Subscription apps and ad-funded apps have different incentives.
9. Use device security. A passcode, Face ID or Touch ID, and app locks add a layer.
10. Share less if you want to. You do not have to log everything. Logging just period dates still works for predictions.

What "private" looks like in practice

Different apps take different approaches:

• Some store data in the cloud and offer an anonymous mode that tries to separate your health data from your identity.
• Some rely on Apple's iCloud encryption.
• Some keep data on your device.

Mochi Moon's approach: data stays on your iPhone, partner sharing uses your own private iCloud (Apple CloudKit), and there are no ads, third-party analytics or tracking, or data selling. Sharing can be paused or disconnected anytime. As with any app, read the policy yourself and decide whether it meets your needs.

For a feature and privacy comparison of several apps, see best period tracker apps and Flo alternatives.

Privacy is not the only safety question

Apps are tools. They are not medical care, and predictions are estimates. If you want to know how reliable they are, read how accurate are period tracker predictions? And if you are just starting out, how to track your cycle covers the basics, including a pen-and-paper option.

Always see a doctor for severe pain, very heavy bleeding, missed periods for three months or more, or anything affecting your daily life, regardless of what an app says.