# Period apps and privacy: what happens to your data

> Where cycle data goes, what has gone wrong before, and the questions worth asking any app.

Category: Apps & privacy · 7 min read · Written by the Splash team · Sources checked October 2026
URL: https://splash.care/learn/apps-privacy/period-app-privacy

## Quick answer

Most period apps store your logs on their servers, linked to your account, where the company, its partners, attackers or courts could reach them. Regulators have acted before, including the FTC’s 2021 order against Flo Health. Safer apps work without an account, encrypt data end to end, avoid ad trackers and let you export and delete everything.

- Most period apps keep your data on their servers, where companies, partners and courts can reach it.
- Regulators and courts have acted on period-app data sharing, including the FTC’s 2021 Flo order.
- Prefer apps that work without an account, encrypt end to end, and let you export and delete everything.

Most [period apps](https://splash.care/learn/apps-privacy/how-accurate-are-period-apps) store what you log on their servers, linked to an account. What happens next depends on the company: some use it only to run the app, some share usage data with analytics or advertising partners, and all of them can be asked for it by courts. A few apps never receive your data at all because it stays on your phone.

## What has gone wrong with period app data before?

Table: Public cases involving period and pregnancy apps

| When | What happened | Source |
| --- | --- | --- |
| 2021 | The US FTC finalised an order requiring Flo Health to get consent before sharing health data and to have an independent review. The FTC had alleged Flo shared data with marketing and analytics firms; Flo did not admit wrongdoing. | FTC press release, 22 June 2021 |
| 2022 | Mozilla reviewed 25 period and pregnancy apps and devices and gave 18 its “Privacy Not Included” warning. | Mozilla Foundation |
| 2022 | TechCrunch reported that Stardust shared users’ phone numbers with an analytics firm. | TechCrunch, June 2022 |
| 2025 | Flo settled a US class action over data sharing during the trial. A jury then found Meta had violated California privacy law by collecting Flo users’ data. | Bloomberg Law; TechCrunch, Aug 2025 |

Apps change. These are historical events, not a description of how any app works today.

## Who could see your period data?

- **The app company and its suppliers** (hosting, email, support tools).
- **Analytics or advertising partners**, if the app includes their code.
- **Courts and law enforcement**, through legal requests for what the company holds.
- **Attackers**, if the company is breached.
- **Anyone with your unlocked phone.**

## What questions should you ask a period app?

1. Can I use it without an account?
2. Is my data encrypted so the company itself cannot read it ([End-to-end encryption](https://splash.care/learn/glossary/end-to-end-encryption))?
3. Does it include advertising or analytics SDKs?
4. Does it sell or share data, including “de-identified” data?
5. Can I export everything and delete my account, and does deletion remove server copies?

## How Splash handles this

Splash keeps your logs on your phone and works without an account. If you turn on sync, logs are encrypted on your phone with AES-GCM-256 before upload, and we do not hold the key. We have no third-party trackers and we never sell your data. We can still see some account details: your email, sync times and sizes, which categories a partner share contains, push endpoints and notification text (neutral by default). Our [privacy page](https://splash.care/privacy) lists all of it, the [security page](https://splash.care/security) explains the encryption, and the [FAQ](https://splash.care/faq) answers the common questions. Splash is made by a small team at WhealBit; [read who we are](https://splash.care/about).

## How do I delete my data from a period app?

Export a copy first if you want to keep your history. Then use the app’s “delete account” option, not just uninstall: uninstalling removes the app from your phone but usually leaves the server copy. Under UK and EU GDPR you can ask any company to erase your data. In Splash, deleting your account deletes all server data, and deleting the app removes what is on your phone.

> If you are in the US and worried about reproductive-health data and the law, organisations such as the Digital Defense Fund publish practical guides. This page is general information, not legal advice.

## Questions people ask

### Is Flo safe to use?

Flo settled with the US FTC in 2021 over past data sharing, without admitting wrongdoing, and now offers an Anonymous Mode. Whether it is right for you depends on how much you want stored on a server. Read its current privacy policy and settings, and compare with local-first apps.

### Can my period app data be used against me?

Data held on a company’s servers can be requested through legal processes. Data that only exists on your phone, or that is end-to-end encrypted so the company cannot read it, gives far less to hand over. This is general information, not legal advice.

### Does deleting a period app delete my data?

Not always. Uninstalling removes the app from your phone, but a server copy may remain until you delete your account. Use the in-app “delete account” option or ask the company to erase your data under GDPR.

## Sources

1. [FTC: FTC finalizes order with Flo Health (22 Jun 2021)](https://www.ftc.gov/news-events/news/press-releases/2021/06/ftc-finalizes-order-flo-health-fertility-tracking-app-shared-sensitive-health-data-facebook-google)
2. [Mozilla Foundation: Privacy Not Included, period and pregnancy apps (2022)](https://www.mozillafoundation.org/blog/in-post-roe-v-wade-era-mozilla-labels-18-of-25-popular-period-and-pregnancy-tracking-tech-with-privacy-not-included-warning/)
3. [TechCrunch: Stardust shared phone numbers with an analytics firm (Jun 2022)](https://techcrunch.com/2022/06/27/stardust-period-tracker-phone-number)
4. [Bloomberg Law: Flo settles data-sharing class action during trial (2025)](https://news.bloomberglaw.com/privacy-and-data-security/menstrual-tracking-app-flo-settles-privacy-case-during-trial)
5. [TechCrunch: Jury rules Meta violated California privacy law by collecting Flo users’ data (Aug 2025)](https://techcrunch.com/2025/08/05/jury-rules-meta-violated-california-privacy-laws-by-collecting-menstrual-health-data-from-flo)
6. [ICO: Special category data (UK GDPR)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/)
7. [FTC: Health Breach Notification Rule](https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule)

This is general information, not medical advice. Splash can’t diagnose. If you’re worried, talk to a GP, pharmacist or sexual health clinic. In an emergency call 999 (UK) or 911 (US).