Your Period App Might Be Sharing More Than You Think
What if the app tracking your cramps is also telling advertisers about your birth control, your moods, and your pregnancy status? For millions of women, period tracking apps feel like a private space. However, new research shows that period tracker privacy varies wildly between apps. Some of your most intimate health details may be traveling further than you’d expect.
The Mozilla Foundation investigated six popular period trackers: Flo, Clue, Stardust, Spot On, Period Calendar and Euki. Their findings reveal a mixed picture. Some apps protect your data carefully, while others share it in ways that might genuinely disturb you, in an era where child safety features and data protection are under increasing scrutiny across tech platforms.
This matters more than ever. Since the US Supreme Court overturned federal abortion protections in 2022, experts worry that period tracker data could show up in criminal cases. Additionally, police have already used other kinds of tech data to help prosecute women. Therefore, understanding period tracker privacy isn’t just a nice-to-have. It’s essential.
Let’s walk through what Mozilla found about period tracker data privacy, and how you can protect yourself.
Period Tracker Privacy: Who Actually Sees Your Health Data?
Mozilla’s research uncovered several concerning practices around period tracker data sharing. However, Stardust stood out as the only app sharing detailed reproductive health data with an outside company.
According to the report, Stardust sends user health information to a data management company called RudderStack. This includes pregnancy status, birth control use, moods, alcohol consumption, and specific symptoms like tender breasts and stomach cramps. Notably, RudderStack isn’t even named in Stardust’s privacy policy.
There’s nothing illegal about this practice. Companies frequently share data with outside services to process information and analyze user behavior, much like how AI systems such as Meta’s Muse Image tool rely on backend data pipelines to function. Still, experts say it’s inherently risky when health data spreads to more places. Each new destination creates another opportunity for a security breach or a legal request for information.
A Stardust spokesperson told the BBC that RudderStack is only used as a technical pipeline to route data into the company’s own systems. Nothing shared could identify a user’s name or contact details, the spokesperson added. The company also said RudderStack is contractually barred from selling the data or using it for its own purposes.
Shoshana Wodinsky, the privacy research analyst who conducted Mozilla’s tests, put it simply: people deserve better. At minimum, she says, users should know what’s happening with their information.
The Spot On App and Planned Parenthood’s Privacy Complication
Spot On, made by Planned Parenthood, presents a more nuanced case for menstrual health app privacy. The app itself doesn’t share data with other companies or track users directly, according to Mozilla. However, certain features, like the Roo AI chatbot and a healthcare provider search tool, open Planned Parenthood’s website inside a browser. That website, Mozilla found, is less secure.
The most concerning example involves Planned Parenthood’s website sharing information about what kind of healthcare you’re searching for with an analytics company called AB Tasty. This includes whether someone is looking into HIV testing or gender-affirming care. Wodinsky noted that this could likely be fixed quickly, saying someone could probably solve the issue in an afternoon.
This isn’t Planned Parenthood’s first brush with privacy criticism either. Similar concerns were raised about the organization years earlier.
Does Your Period Tracker App Reveal That You’re Using It at All?
Beyond specific health details, there’s another layer of exposure to consider when it comes to period tracking app security. Mozilla found that most apps in the report don’t share detailed health information. Yet many still send basic user data to advertising and analytics platforms run by Google, Meta, Microsoft, and TikTok, the same companies that faced backlash after the recent WhatsApp, Facebook and Instagram outage exposed how much daily life depends on their infrastructure.
Typically, this data includes an ID number or identifier used to track you, often for targeted advertising or cross-platform tracking. Users technically consent to this by accepting the apps’ privacy policies, though few people read them closely.
Even without specific symptoms attached, simply revealing that you use a reproductive health app can carry consequences. Sara Geoghegan, director of the Consumer Privacy Program at the Electronic Privacy Information Center, explained that this kind of data can become part of a larger surveillance picture. Consequently, it could signal to law enforcement that a trove of health data exists somewhere, ready to be requested.
For example, Period Calendar sent ID numbers and device information to Google and the advertising company InMobi, with no way for users to opt out, according to Mozilla’s findings. Meanwhile, Stardust shared similar data with Facebook and AppsFlyer, though users can block this through their phone’s privacy settings. Similarly, accessing Planned Parenthood’s website through Spot On shares comparable information with Google, Microsoft, TikTok, and Pinterest, and Mozilla says there’s no way to prevent it.
A Stardust spokesperson clarified that the company doesn’t share health data with advertising platforms. AppsFlyer and Meta are used only to measure and optimize ad campaigns, the spokesperson said.
Why Advertising Data Still Matters for Reproductive Privacy
Even seemingly harmless advertising IDs can build a profile that reveals reproductive health status over time. As a result, privacy experts recommend checking your phone’s ad tracking settings regardless of which period app you use, a concern that echoes broader debates around AI models like Kimi K3 and how much personal data trains modern platforms.
Where Does the App Actually Store Your Information?
Storage location turns out to be one of the biggest differentiators in period tracker privacy. Euki was the only app Mozilla recommended without reservations. Wodinsky described Euki as genuinely special among the group tested.
Unlike every other app in the study, Euki keeps all health information stored directly on your device rather than sending it to company servers. Users don’t even need to create an account, allowing for complete anonymity. Additionally, the app includes a decoy feature that displays fake, harmless information if someone else picks up your phone.
Geoghegan sees this as proof that better options exist. Technology doesn’t have to be built on harmful practices, she noted.
Flo and Clue weren’t as tightly locked down as Euki, but they scored reasonably well thanks to genuine transparency and detailed privacy controls. As far as Mozilla could determine, neither app shares health information with third parties under any circumstances. Both inform advertising and analytics partners when someone uses the app, clearly disclosed in privacy policies and consent pop-ups, though users can disable this easily.
However, Mozilla criticized Flo and Clue for collecting far more health data than other apps and storing it on company servers rather than locally. Even if these companies never share the information, keeping a copy at all could expose users to data breaches or government legal requests, Wodinsky explained. That’s a genuine trade-off worth considering.
Spokespeople for Flo and Clue pushed back against this framing. Both companies maintain that cloud storage is necessary for their services and that adequate safeguards protect the data. Flo spokeswoman Samantha Wannemacher pointed to the app’s Anonymous Mode, which she says ensures no one, including Flo itself, holds a user’s identity and health data simultaneously. She added that Flo has never received a subpoena for user data and would fight one if it happened.
Both Clue and Flo are based in Europe, which could make US legal requests more difficult to enforce. Clue’s chief executive Rhiannon White stated the company has never disclosed private health data to any authority and never will.
What This Means for Your Own Period Tracker Choice
Ultimately, the right period tracker depends on your personal risk tolerance. If keeping data off company servers entirely matters most to you, an app like Euki offers stronger guarantees. On the other hand, if you value features that require cloud storage, look closely at anonymous modes and opt-out settings.
Period Tracker Track Record: Past Privacy Scandals Worth Knowing
Current practices only tell part of the story. Mozilla suggests examining each app’s history too, since past behavior often predicts future risk.
Flo, for instance, settled a case with the US Federal Trade Commission in 2021 over allegations that it shared sensitive user information with Meta, Google, and others after promising to keep the data private. Mozilla noted that Flo’s practices improved significantly afterward. Still, the company’s privacy policy later expanded to include new advertising partnerships with Google, Meta, and other platforms, though users retain the ability to disable this.
A Flo spokesperson responded that the FTC settlement involved practices that ended five years ago, and the company did not admit wrongdoing. Flo maintains that its current privacy and transparency practices exceed industry standards.
Other apps have faced their own scrutiny. A 2022 investigation found lists of individual devices using Clue, Period Calendar, and other trackers for sale online. White responded that this data originated from the broader mobile advertising ecosystem rather than Clue’s app directly, adding that Clue has never sold and will never sell user data to third parties.
Stardust faced a separate credibility issue. The app initially appeared to promise end-to-end encryption, a strong security feature that makes data particularly difficult to access. However, the company later removed these references from its website after reporters asked questions about them. Stardust’s spokesperson didn’t address this specific point.
As Geoghegan put it, people are rightfully concerned because society has combined widespread surveillance with the criminalization of abortion in some states. She argues this highlights the need for stronger privacy regulation in the US, where, unlike Europe, no comprehensive national privacy law currently exists, a gap that has also fueled controversy in unrelated cases like Elon Musk’s Wisconsin legal dispute over data and disclosure rules.
Beyond legal risk, privacy problems create real emotional costs too. Ongoing concerns can cause fear and anxiety that discourage people from using tools designed to improve their health in the first place, much the way patients have raised trust concerns around new NHS AI tools handling sensitive medical information.
Key Takeaways on Period Tracker Privacy
Choosing a period tracker isn’t just about convenience anymore. Here’s what to remember:
Euki stands out for keeping all data on your device, making it the most private option among those tested. Flo and Clue offer solid transparency and granular controls, though they store more data on company servers. Stardust raised the most serious concerns, sharing detailed health information with an unnamed third party. Spot On’s core app is fairly secure, but its in-app browser exposes sensitive search behavior. Finally, track record matters just as much as current policy, so check an app’s history before trusting it with your most personal information.
As Wodinsky says, people deserve to know what’s happening with their data. Reading the privacy policy, checking opt-out settings, and understanding where your information actually lives can help you make a genuinely informed choice.
FAQs
Which period tracker app is the most private?
Euki is currently considered the most private option, according to Mozilla’s research. It stores all health data directly on the user’s device rather than company servers and doesn’t require an account, allowing for anonymous use.
Do period tracking apps share data with police?
Apps generally state they haven’t shared health data with law enforcement without proper legal process. However, experts warn that any data stored on company servers could potentially be obtained through legal requests. This is why storage location matters so much.
Is Flo safe to use after its FTC settlement?
Flo settled with the FTC in 2021 over data-sharing allegations and says its practices have since improved significantly. The company points to features like Anonymous Mode as evidence of stronger current protections, though it still stores health data on its servers.
What does Anonymous Mode do in period tracker apps?
Anonymous Mode, offered by apps like Flo, is designed to ensure that no one, including the company itself, can connect a user’s identity to their health data at the same time. This feature adds a layer of protection against data requests.
Why does period tracker privacy matter after Roe v. Wade was overturned?
Since federal abortion protections ended in 2022, experts worry that data from period trackers could be used in criminal investigations or prosecutions related to pregnancy outcomes. As a result, data privacy has become a more urgent concern for users.
