When you log your period in a tracking app, you’re not just recording a date. You’re disclosing your reproductive cycle, fertility window, pregnancy attempts, emotional state, sexual activity, and in many apps, your physical symptoms, medications, and mood patterns. That data, in aggregate, tells a remarkably detailed story about your body and your life.
For most of the period-tracking industry, that story is a commercial asset.
The apps that record your cycle often operate with the same data economy as social media platforms: free to use, with the cost paid in the value your data generates for advertisers, analytics companies, and platform partners. The difference is that the data being sold is more intimate than your shopping habits or browsing history. It’s information about your reproductive health.
The Flo Investigation That Changed Everything
Flo is one of the most widely used period tracking apps in the world, with more than 300 million users. In 2021, the Federal Trade Commission charged the company with sharing users’ menstrual cycle and fertility data with Facebook and Google — despite explicitly promising users that their health data would be kept private.
The FTC found that Flo disclosed this data to third parties “for marketing analytics purposes.” Users who had logged sensitive information about their cycles, fertility treatment, and pregnancy status saw that data transmitted to platforms that used it for targeting. The settlement included an order for independent privacy audits and a prohibition on the specific data-sharing practices at issue.
Then, in 2025, a class action lawsuit alleged that Flo had continued to transmit reproductive data to Meta through embedded tracking tools. A San Francisco jury ruled that Meta violated the California Invasion of Privacy Act by intercepting sensitive Flo user data without valid consent. The jury’s finding confirmed what the FTC investigation had pointed toward years earlier: period tracking data was flowing to advertising infrastructure, and users hadn’t meaningfully consented.
Flo has since updated its practices and introduced an Anonymous Mode that strips identifying information. But the case established a pattern that extends well beyond one app.
What These Apps Actually Collect
The data profile a period tracking app builds is more extensive than most users realise. Across the major apps, typical data collection includes:
- Cycle dates and length: when your period starts and ends
- Symptom logging: pain, bloating, mood, energy, sleep
- Sexual activity: whether intercourse occurred, whether contraception was used
- Fertility status: whether you’re trying to conceive, and ovulation predictions based on your cycle
- Pregnancy tracking: if you log a positive test, pregnancy progression is tracked week by week
- Medications and supplements: many apps allow logging of contraceptive methods, prenatal vitamins, or fertility medications
- Emotional state: apps like Clue and Flo include detailed mood and mental health logging
Each of these fields generates health data about the user. Taken together, the app has a detailed longitudinal record of your reproductive life over months or years.
Why This Data Is Different
Health data has always attracted regulatory scrutiny, but reproductive health data occupies a specific category of risk that has sharpened significantly since the US Supreme Court’s 2022 decision in Dobbs v. Jackson Women’s Health Organization.
The decision eliminated the federal constitutional right to abortion, enabling individual states to criminalise the procedure. Since then, law enforcement in multiple states has sought digital evidence — including menstrual data, search history, and private messages — in abortion-related investigations.
The pattern has already produced documented cases. In Nebraska, law enforcement used Facebook private messages to build a case against a woman and her mother who sought an abortion. In the United Kingdom, authorities used a woman’s Google search history as evidence to prosecute her for taking abortion pills past the legal limit. These cases used data that was never collected with criminal investigation in mind.
A period tracking app can record that a user’s cycle stopped, that ovulation resumed weeks later, and then that a period was logged again. To law enforcement in a state where abortion is illegal, that sequence of events is potentially relevant evidence. The app holding that data is not, in most cases, subject to HIPAA — meaning the baseline legal protections that govern your medical provider’s records don’t apply.
The HIPAA Gap
This is a point of significant confusion for most users: HIPAA, the US health data privacy law, applies to healthcare providers, insurers, and their business associates. It does not apply to consumer wellness apps, period trackers, or fitness platforms.
When you hand your menstrual data to Flo, Clue, Glow, or Apple Health, you’re not getting HIPAA protection. You’re getting whatever protection the app’s privacy policy promises — and, as the FTC action against Flo demonstrated, those promises have not always been kept.
The FTC took action against Flo under its authority over unfair and deceptive practices. That’s a different legal framework than health privacy regulation. It requires a user complaint, an investigation, and a finding — it doesn’t prevent the data from being shared in the first place.
Several US states have passed health data privacy laws since Dobbs, including Washington’s My Health My Data Act, which extends health privacy protections beyond HIPAA to consumer health apps. But coverage is uneven across states, and the laws vary significantly in what they protect and how enforcement works.
The Advertising Business Model
Period tracking is expensive to build and maintain. App development, server infrastructure, customer support, and ongoing feature work require sustained revenue. For most free apps in this category, the revenue model involves data.
The specific mechanisms vary. Some apps partner directly with advertising networks. Some share data with health research organisations in exchange for funding, under terms that may or may not give individual users meaningful rights over their contributions. Some sell aggregated insights to pharmaceutical companies or consumer health brands. Some include sponsored content within the app.
The common thread is that the data users log is not treated as purely personal. It’s treated as an asset that generates value for the business, which is why the business offers the app without charging for it.
Oura, the ring-based health tracker, charges for its subscription service and explicitly states it does not sell user health data to third parties. Some apps in this space are moving toward subscription models precisely to separate revenue from data monetisation. But most free period tracking apps have not made this transition.
What You Give Up When You Delete the App
Deleting a period tracking app from your phone doesn’t delete your data from the app’s servers.
Most major apps retain user data for an extended period after account deletion — sometimes indefinitely, subject to legal retention requirements or anonymisation processes that may or may not be fully effective. The retention terms are usually buried in the privacy policy under a heading like “how long we keep your data.”
Some apps export your data before deletion, which is useful for record-keeping but doesn’t address what stays on the company’s servers. Others require you to explicitly request deletion through a separate process from simply deleting the app.
The California Consumer Privacy Act, GDPR in Europe, and equivalent laws in other jurisdictions give users the right to request deletion of their personal data. Exercise of this right requires finding and using the deletion mechanism, which is rarely in an obvious location.
Apps That Have Committed to Not Sharing Reproductive Data
Following the Dobbs decision, several app companies made public commitments about reproductive health data:
Apple Health: Apple has stated that Health app data stored on the device is encrypted and not accessible to Apple. If iCloud sync is enabled, the data is encrypted in transit. With Advanced Data Protection, it’s end-to-end encrypted. Apple also confirmed it will not provide Health data to law enforcement without a valid legal order.
Clue: Based in Germany and subject to GDPR, Clue has committed to not selling user data for advertising and not sharing data with US law enforcement without due process protections under German law.
Natural Cycles: Certified as a medical device in the EU and US, which brings different regulatory requirements than a consumer wellness app.
These commitments are meaningful but require ongoing verification. Privacy policies change, companies are acquired, and what a company says publicly is not always a reliable predictor of what it does under pressure.
The On-Device Alternative
One structural approach to this problem is keeping period tracking data on the device rather than uploading it to a cloud service. Apple’s Health app with iCloud disabled, or dedicated apps that explicitly support offline-only operation, store your data locally rather than on company servers.
This approach has tradeoffs. Data isn’t backed up. It doesn’t sync across devices. If you lose your phone, the data is gone.
But from a privacy standpoint, data that never leaves your device is data that can’t be subpoenaed from an app company, can’t be exposed in a company data breach, and can’t be shared with advertising partners.
For users who want cloud backup and cross-device sync, the question becomes which company holds the data and under what terms. The answer varies significantly between apps.
Storing Reproductive Health Notes Privately
Some users approach period tracking differently: instead of logging cycle data into a specialised app designed to analyse it, they log it as private personal notes or files alongside their other health records.
This approach gives up the cycle analysis and ovulation prediction features that make dedicated apps useful. But it also gives up the data model that treats cycle information as analysable health data connected to an account on a company’s servers.
A note logged as a private personal record in a file storage service that doesn’t process content for advertising purposes occupies a different category of exposure than the same information logged in a purpose-built health app whose business model depends on aggregate health data.
What to Look For If You Use a Dedicated App
If you want to continue using a period tracking app rather than logging health records as private files, these are the properties worth evaluating:
Subscription-funded, not ad-funded. Apps that charge a subscription have less incentive to monetise user data directly.
GDPR or equivalent jurisdiction. Apps based in Europe are subject to stricter data sharing requirements and have to explain lawful basis for processing health data.
Explicit no-third-party-sharing commitment. Look for this in the privacy policy, not in marketing copy. The policy is the legal commitment.
On-device option. Whether the app can operate without uploading your cycle data to company servers.
Named data recipients. If data is shared with partners, those partners should be named in the privacy policy, not described as “trusted third parties.”
A real data deletion process. Not just deleting the app from your phone, but a mechanism to request deletion of your data from company servers, with a response timeline.
Your cycle data is personal health information. The company holding it may not treat it that way by default — but you can choose services that do.
The Larger Picture
Period tracking apps offer real value: cycle prediction, fertility awareness, symptom pattern recognition. Many users find them genuinely useful tools for understanding their bodies.
But the category has a documented history of sharing intimate health data with platforms and advertisers, a HIPAA gap that leaves most consumer health apps outside the regulatory framework that governs medical providers, and a business model that frequently monetises the data users provide.
Understanding what your app does with your data — not what its marketing says, but what its privacy policy commits to — is the relevant starting point. After Flo, after the Dobbs-era prosecutions, and after a class-action win against Meta for intercepting health data without consent, treating period tracking data as genuinely private requires choosing the right service, not just assuming the category protects you.