Your period app knows more about you than your doctor

Your doctor sees you two or three times in a good year. A 15-minute visit, maybe 30 if you get lucky. They might ask when your last period was. They might not.

Your period app sees you every day. Cycle length, flow volume, cramp intensity, mood, libido, sexual activity, contraception use, medications, sleep, PMS symptoms by category, pregnancy attempts, ovulation tests. Multiplied by daily entries. Multiplied by years.

There is no other record of your reproductive life this detailed anywhere. Not in your medical chart. Not at your GP. Not with any specialist you have seen. The app is the record. That would be fine if the app was actually yours.

What data does my period app collect

The Cambridge University Minderoo Centre report from June 2025 calls menstrual-tracking data "a gold mine for advertisers." Unlike age or gender or location, a period tracker can infer pregnancy status. That inference is worth more to advertisers than almost anything else about you. The report catalogued the data categories these apps harvest: menstruation cycle, mood, exercise, diet, medication, sexual preferences, hormone levels, contraception use.

Now compare that to what your doctor writes down. Last menstrual period. Contraception. Presenting complaint. That is a short list.

Read that again. Your period app has a richer, longer, more detailed record of your reproductive life than the entire medical system does. And the medical system operates under HIPAA. Your period app does not.

Where period tracker data collection actually goes

The FTC has been extremely clear on this.

In 2022, the FTC sued a data broker called Kochava. The complaint documented Kochava's audience segments for sale. Alongside demographic categories were labels like "menstruation," "ovulation," "Reproductive Health," "Pregnancy," and "Expecting Parents." That last one was built directly from people using pregnancy and fertility apps. Advertisers could buy lists of women flagged as ovulating or pregnant.

In May 2023, the FTC settled with Premom, an ovulation app, after finding it had shared reproductive-health data with Google, AppsFlyer, and two Chinese analytics companies (Umeng, owned by Alibaba, and Jiguang). The company was banned from ever sharing that data for advertising again.

Mozilla's 2022 review of 25 period and pregnancy apps flagged 18 of them with a Privacy Not Included warning. That is 72 percent of the category failing the basic privacy test. Only one app on their list, Euki, made the Best Of category.

This is not hypothetical. This is documented, litigated, published. Your ovulation window is somebody's quarterly ad inventory.

Is Flo app safe to use? The biggest player, the biggest settlement

Flo Health has around 77 million active users a month and 380 million lifetime downloads. It is the market leader by a distance.

In 2021, the FTC settled with Flo over allegations that it had shared user health data, including pregnancy status, with Facebook, Google, AppsFlyer, and Flurry. Flo had promised users the data was private. It was not. In 2024 and 2025, Flo, Google, and Flurry agreed to pay $59.5 million to settle a class action covering anyone who entered menstruation or pregnancy data into the app between November 2016 and February 2019. Google paid $48 million. Flo paid $8 million.

Meta refused to settle. On August 1, 2025, a federal jury in California found Meta liable for wiretapping. The court accepted that Meta intercepted Flo users' health data without consent, in violation of the California Invasion of Privacy Act. The class covers 38 million people. Statutory maximum exposure is around $200 billion. Meta is expected to appeal.

Flo has since built Anonymous Mode. The design routes traffic through Cloudflare so that Cloudflare sees who you are but not your health data, and Flo sees your health data but not who you are. Independently audited. It is a real thing.

It is also opt-in. If you did not switch it on, you are not using it. Most Flo users are not.

Does Clue sell your data

Clue is based in Berlin. That matters. GDPR treats reproductive health as special-category data and gives the German data protection authority strong ground to refuse foreign law-enforcement requests.

In November 2024, Clue's co-CEOs published a public statement: "We have never and will never disclose any member's private health data to any authority. If we are ever subpoenaed, we will not comply."

Give them credit. That is more than every US-based period tracker has said out loud.

Now the caveat. Clue's promise is a policy. It is not an architecture. Your cycle data lives on Clue's servers, not on your phone. If Clue is acquired, if leadership changes, if a future court order forces the German data authority's hand, that policy can shift.

What that means for you as an individual: if the company stays who they say they are, your data is well-defended. If any of the assumptions above break, you have no fallback.

Post-Dobbs: what the real risk looks like

Here is the correction the panic pieces keep missing.

As of 2025, there is no publicly documented US case in which period-tracker app data was subpoenaed to prosecute an abortion. The Nebraska case that gets cited constantly, Celeste Burgess and her mother, was based on Facebook Messenger DMs that Meta handed over after a warrant. It was not period-app data. Both pleaded guilty in 2023.

That does not make the risk fake. It makes the risk architectural. HIPAA does not cover period apps. The data exists on company servers. The FTC-Kochava filings show that data is already inside commercial audience segments. Washington's My Health My Data Act, Nevada's Consumer Health Data Privacy Law, and reproductive-data statutes in seven other states came into force in 2024 and 2025. None of them help if the company you are trusting has already shared your data.

What actually protects you from period app surveillance

Policy promises help until the company changes. Encryption in transit helps until the data lands on a server that can be subpoenaed. Anonymous modes help if you switch them on.

The one thing that survives all of that is architecture. Data that never leaves your phone cannot be sold, cannot be subpoenaed, cannot be shared with an ad broker after a takeover. That is what "on device" actually means. It is a design decision, not a paragraph in a privacy policy.

I built Bleed on that architecture. No account. No email. No third-party analytics. Your period log, your symptoms, and your predictions stay on the phone. I could not hand your data over if I wanted to. If a court served us with a warrant tomorrow, we would have nothing to give them.

That is not a promise. It is what the app is.

The bottom line

Your doctor sees you twice a year for 30 minutes. Your period app sees you every day for years. The question is not whether to track. The question is who holds the tape.

Pass it on.

References

Felsberger S. "The High Stakes of Tracking Menstruation." Minderoo Centre for Technology and Democracy, University of Cambridge (June 2025). cam.ac.uk news release
Federal Trade Commission. "FTC Sues Kochava for Selling Data that Tracks People at Reproductive Health Clinics, Places of Worship, and Other Sensitive Locations." Press release (August 2022). ftc.gov
Federal Trade Commission. "Ovulation Tracking App Premom Will be Barred from Sharing Health Data for Advertising Under Proposed FTC Order." Press release (May 2023). ftc.gov
Mozilla Foundation. "In Post-Roe V. Wade Era, Mozilla Labels 18 of 25 Popular Period and Pregnancy Tracking Tech with Privacy Not Included Warning." (August 2022). mozillafoundation.org
Federal Trade Commission. "Developer of Popular Women's Fertility-Tracking App Settles FTC Allegations that it Misled Consumers About the Disclosure of Their Health Data." Press release (January 2021). ftc.gov
Frasco et al. v. Flo Health, Inc. Class action settlement. N.D. Cal. Case 3:21-cv-00757. Preliminary approval September 2025.
Bloomberg Law. "Meta's Health Privacy Trial Loss Spotlights Power of Wiretapping." (August 2025). news.bloomberglaw.com
Flo Health. "Anonymous Mode." Product documentation. flo.health/product-tour/anonymous-mode
Clue Co-CEOs. "Patient Data Privacy at Clue: A Statement from the Co-CEOs." (November 2024). helloclue.com
NPR. "Nebraska Cops Used Facebook Messages to Investigate an Alleged Illegal Abortion." (August 2022). npr.org
Washington State Legislature. My Health My Data Act. RCW 19.373. app.leg.wa.gov