A period tracker ends up holding an unusually intimate record: when you bleed, when you might be ovulating, whether you are trying to conceive, symptoms, moods, sometimes sexual activity. That is exactly the kind of data advertisers pay for and regulators fight over. Yet most people pick a tracker in about thirty seconds, from a search results page. This guide is the ten-minute version of doing it properly.
What has already gone wrong
The best-documented case involves Flo, one of the most popular cycle apps in the world. In 2021, the US Federal Trade Commission announced a settlement with Flo Health over allegations that the app had shared users’ health details, including pregnancy status, with third-party analytics and marketing services run by companies including Facebook and Google, despite promising to keep that information private. Under the settlement, Flo agreed to notify affected users and obtain consent before sharing health data, without admitting wrongdoing.
The story continued in court. In 2025, a California federal jury in a class action brought by Flo users found Meta liable under the California Invasion of Privacy Act for collecting sensitive health data that the Flo app had transmitted through an analytics tool. Other defendants, including Flo itself and Google, settled before the verdict. Whatever happens on appeal, the trial record made one thing plain: cycle data really has flowed from period apps into ad-tech systems, at massive scale.
The pattern is structural. Free apps ship with analytics SDKs wired into advertising businesses by default, and an app’s marketing copy can say one thing while its data flows do another. That is why the checklist below leans on written commitments and incentives instead of slogans.
The checklist
1. Make the privacy policy answer two questions
Open the policy and search for what happens to personal data. You are looking for two plain commitments: we do not sell personal data, and we do not use your data for advertising. Clear, unqualified sentences are a good sign. Watch for hedges like sharing with trusted partners, affiliates, or for improving relevant offers, which can be doing a lot of quiet work. If the policy will not say either thing plainly, treat that as your answer.
2. Treat ads in the app as a disclosure
If the app shows ads, an advertising SDK is running inside it, and at minimum some behavioral signals are leaving the app. That does not make the developer malicious, but it does mean your cycle app contains the exact machinery the Flo case was about. For this category of data, no ads is the sane baseline.
3. Follow the money
Every app pays its bills somehow. A paid app or subscription means the business model is you paying for a product. Free forever with no visible revenue means the model is something else, and your data is the most likely candidate. You do not have to begrudge anyone a business model; just make sure you know which one you are agreeing to.
4. Know where your data lives, and be honest about tradeoffs
Some trackers keep data only on your phone; most sync it to servers. Neither choice is automatically private, and both have real tradeoffs. On-device storage means your history never sits on a company server, but it can vanish with a lost phone and rules out multi-device use or sharing features. Synced storage means the company holds your data, so its encryption, retention, and deletion practices carry the weight, and in exchange you get backup and the features that need a server. What to check is simple: does the app say clearly where data is stored, is it encrypted in transit and at rest, and does the policy say how long it is kept?
5. Check the delete path before you need it
A trustworthy tracker lets you delete your account from inside the app, and its policy spells out that deletion actually removes your data from the company’s servers. If deleting requires emailing support, or the policy is silent about what deletion actually deletes, weigh that before entrusting the app with years of history.
6. Skim the App Store privacy label
On iOS, every listing has an App Privacy section declaring what data the app collects and what is used to track you across other companies’ apps. The labels are self-reported, so treat them as a first screen rather than an audit, but a health app whose label lists data used to track you deserves harder questions.
What to ask the developer
If anything is unclear, email and ask: Do you sell or share personal data with advertisers or data brokers? What happens when I delete my account? How do you respond to legal demands for user data? Small teams often answer quickly and candidly. If marketing boilerplate comes back instead, downgrade accordingly. A developer that collects less also has less to hand over, whatever its intentions.
Where Plum stands
We build Plum, so grade us against the same list. Plum shows no ads and never sells personal data; the business model is a straightforward optional subscription, so we make money from subscribers, not from data. Your cycle data belongs to you. Plum does sync your data to our servers, encrypted in transit and at rest, which is what makes backup and shared groups work, so we will never claim your data stays only on your phone. You can delete your account and its data from inside the app at any time, and the details are in our privacy policy, written to pass the two-question test above.
Picking one
Choose a tracker the way you would choose someone to tell a secret to. Ten minutes with the privacy policy and the App Store label rules out most of the risk, and an app you actually trust is one you will log into honestly, which is what makes tracking useful in the first place. If you are new to tracking, our guide to normal cycle length is a good place to start.
