Do period tracking apps sell your data?

Short answer: most mainstream period tracking apps don't literally "sell" your data in the strict sense, but many share it with advertising and analytics companies in ways users don't expect — and at least one has been penalised by a regulator for doing so. This article explains what these apps collect, where that data actually goes, what regulators have documented, and a five-minute checklist you can use to judge any app before you install it.

#What these apps actually collect

A period tracker sits on top of some of the most sensitive information most people will ever type into a phone: cycle dates, flow, symptoms, moods, sexual activity, and sometimes pregnancy status or a pregnancy loss. On top of that, like most apps, they can collect the ordinary technical data — device identifiers, IP address, and how you move around inside the app.

What makes this category unusual isn't the volume of data, it's what it implies. A gap in logged cycles can indicate a possible pregnancy. A switch to a pregnancy view, then back, can imply a loss. Fertility logging can hint at treatment. None of that is neutral marketing data, which is exactly why it deserves a higher bar than "we take your privacy seriously."

#Where the data goes

When data leaves an app, it usually travels one of three routes, and it helps to picture them separately:

• Analytics SDKs — kits bundled into the app to measure how people use it. Useful for developers, but they can send usage data to a third party.
• Advertising SDKs — the code that shows ads and, in many apps, tailors them. This is the route most likely to move identifiers and behavioural data to ad networks.
• Cloud sync and accounts — if the app has an account and syncs across devices, a copy of your data lives on a server the company controls.

Here's the sentence that trips people up: "we don't sell your data" is a narrow, specific legal statement. It can be completely true while the same app still shares a great deal of data through those three routes. Selling and sharing are not the same thing, and a policy can rule out one while quietly permitting the other.

#What regulators have actually found

This isn't hypothetical. In 2021 the US Federal Trade Commission finalised an order against Flo Health over its Flo Period & Ovulation Tracker. The FTC's complaint alleged that Flo shared users' health data with third parties — including Facebook and Google's analytics divisions — after telling users that information would be kept private, and that the practice continued until a February 2019 news investigation brought it to light. The settlement — which, like most settlements, is not an admission of wrongdoing — required Flo to obtain users' consent before sharing health data, to notify affected users, and to have its privacy practices independently reviewed.

Zooming out from a single company: in 2022 Mozilla's *Privacy Not Included researchers reviewed 25 popular period- and pregnancy-tracking apps and devices and attached a privacy warning label to 18 of them. Their core concern wasn't outright "selling" so much as vague, boilerplate policies that left it unclear how much data could be shared, and with whom. In their round-up, one app (Euki) was the only one placed in Mozilla's "Best Of" category, and the fitness wearables they examined generally fared better than the dedicated apps.

The honest takeaway from both is not "every app is spying on you." It's that the gap between what an app promises and what it permits has, in documented cases, been wide — so the promise alone isn't enough to go on.

#Why this got more attention after 2022

After the US Supreme Court's 2022 decision in Dobbs v. Jackson changed abortion law in parts of the country, a practical question moved from niche to mainstream: could cycle data be pulled into a legal case? Mozilla framed its review around exactly that post-Roe worry.

Set the politics aside — the mechanics are what matter here, and they're straightforward. Data held on a company's servers can, in general, be requested through legal process such as a subpoena or warrant. Data that was never transmitted off your device is not something a company can produce, because it never had it. That single distinction — server copy versus on-device only — is the practical heart of this whole topic.

#How to check any period app in five minutes

You don't need to trust an article's app rankings. You can judge any app yourself with a short checklist:

1. Read the App Store / Google Play privacy label first, before the marketing copy. It's a structured summary of what the developer says they collect and link to you.
2. Does it require an account? An account almost always means a server copy of your data exists. No account usually means there's nothing on a server to hand over.
3. Search the privacy policy for the words "third parties", "advertising partners", and "share". Skim what surrounds them. This is where sharing lives, if it lives anywhere.
4. Check whether it works in airplane mode. If the core features keep working with no connection, the app clearly isn't depending on sending your data somewhere to function.
5. Look for a real export and a genuine "delete everything". Being able to take your data out — and truly erase it — is a good sign the developer expects you to stay in control.
6. Check the notifications and the app icon. A private app lets you keep lock-screen text neutral and, ideally, offers a discreet icon, so a glance at your phone doesn't reveal what it is.

Run those six checks and you'll learn more in five minutes than any "top 10" list will tell you. And if you're leaving an app you already use, here's how to delete your data from a period tracking app properly — export first, then delete.

#What "offline" actually means

One word to be careful with: "offline." Some apps have an offline mode that queues your data and syncs it later, once you're back online. That is not the same as an app where no server exists and nothing is ever uploaded. Both can be reasonable choices — but they're different promises, so it's worth knowing which one you're getting.

And genuinely on-device apps do give something up: because there's no server, moving to a new phone usually means exporting a backup file and importing it, rather than automatic cross-device sync. That's an honest trade-off, not a free win. If seamless sync across devices matters more to you than keeping everything strictly local, a server-based app with a strong policy might suit you better. The point isn't that one model is morally superior — it's to choose with your eyes open.

#A note on the app I build

If you finish this article and install nothing, that's a fine outcome — the checklist is the part worth keeping.

#Frequently asked questions

The single most useful thing here isn't a specific app recommendation — it's the five-minute checklist. Whichever tracker you choose, the same questions apply: where does the data live, does an account exist, and can it work with the internet turned off? Answer those, and you're no longer relying on a slogan.