On June 24, 2022, the US Supreme Court overturned Roe v. Wade. Within hours, searches for “how to delete period tracking app” spiked across the country. Millions of women had spent years logging their cycles, moods, and pregnancy attempts into apps like Flo and Clue. Suddenly they had a very concrete reason to worry about where that data lived.
Privacy researchers were not surprised. They had been documenting these problems for years. What the Dobbs decision did was make the stakes legible to everyone else.
The FTC caught Flo lying
Flo Health is one of the most widely used period tracking apps in the world. The company claims 70 million monthly active users. It markets itself as a personal health companion — a private space to track your cycle, fertility windows, pregnancy attempts, and mood.
In January 2021, the US Federal Trade Commission found that Flo had been sharing users’ health data with Facebook and Google for advertising purposes. This happened while Flo’s own privacy policy promised not to share health data with third parties for advertising. The data shared included whether users were menstruating, trying to get pregnant, or had experienced a miscarriage. It included mental health notes users entered manually. It went to Facebook’s analytics tool — which meant Facebook’s ad systems could use signals about pregnancy loss to target ads.
Flo settled. The settlement required the company to notify affected users and to instruct app stores to delete cached versions of the app that contained the old data. Flo did not admit wrongdoing. The company updated its privacy policy and continued operating.
What the FTC case confirmed — in writing, with evidence — is that an app can promise you privacy and do the opposite. For years. Without telling you.
What these apps know about you
The data category here is not “health-adjacent.” It is the most intimate possible record of your reproductive life.
Period tracking apps typically collect: cycle dates and flow intensity; sexual activity logs; pregnancy attempts and their outcomes, including miscarriages; mood and mental health notes; physical symptoms entered manually over months or years. Some apps add weight, sleep, and medication logs. Many prompt users to enter this information daily, building a longitudinal health record more detailed than most clinical files.
Individually, some of these data points seem minor. Together, they form a profile. It can tell an insurer whether you are likely to become pregnant. It can tell an employer something about your health status. And in a legal context, it can document your reproductive history in precise timestamped detail.
This is not speculative. The Dobbs aftermath made the legal risk concrete. If period tracking data can be subpoenaed in a US state investigating illegal abortions, it can be subpoenaed for other purposes in other jurisdictions. The data exists. Someone has it. Where it goes next depends entirely on who holds it and what law applies to them.
The problem is not just Flo
After the FTC settlement, Flo got a lot of attention. Other apps got comparatively little. That asymmetry does not reflect their actual data practices.
Apps like NUA and Maya serve Indian users directly. Ovia — now owned by Labcorp, one of the largest clinical laboratory companies in the US — markets itself to employers and insurers as a fertility benefits platform. Employers who offer Ovia as a benefit receive aggregated data about their workforce’s reproductive health. The consent mechanism is the app’s terms of service, which most users do not read.
Clue — a Berlin-based app — has a meaningfully stronger privacy posture than most US competitors. It falls under GDPR, which imposes actual enforcement risk on companies that mishandle European users’ data. Clue has been more explicit about what it does not share and why. That does not make it perfect. But regulatory jurisdiction matters, and German data protection authorities have more teeth than most.
The deeper problem is structural. Even apps with genuinely good intentions embed third-party analytics SDKs — Firebase, Amplitude, Mixpanel — that collect session data, device identifiers, and behavioral signals. Those SDKs can link your in-app behavior to your broader advertising profile even when the app itself never directly sells your health data. The data leaves through the plumbing, not the front door.
Many apps also include broad “anonymized research” consent clauses. These allow data to be shared with “research partners,” a category that can include pharmaceutical companies, insurers, and academic institutions. The theory is that stripping your name from the record makes it anonymous. It rarely does. A dataset containing your cycle dates, your zip code, and your age is not anonymous. It is re-identifiable.
Why this matters in India specifically
The abortion rights framing that dominated US coverage does not map cleanly onto India. But the risks are not smaller. They are different.
Reproductive health data in India carries its own set of exposure risks. Information about fertility struggles, pregnancy loss, or irregular cycles could affect marriage prospects in communities where that information is considered deeply private. It could surface in employment discrimination — against women of reproductive age, who already face documented hiring bias. Insurance underwriting in India is not prohibited from using health data in the same way GDPR markets restrict it.
Mental health notes are a particular concern. Many period tracking apps prompt users to log mood, anxiety levels, and emotional state alongside physical symptoms. This creates a mental health record inside an app that most users think of as a cycle tracker. That data is not protected the way clinical mental health records are. It sits on servers in the US or Europe, governed by laws that do not have your interests as a primary concern.
What you can actually do
Delete apps you are not using. Not “log out” — delete.
If you want to track your cycle with zero data exposure, a paper calendar or a plain notes app works. No server. No SDK. No research partner clauses. This sounds obvious and it is, but it is worth stating: the tracking itself is not the problem. Who has the data is the problem.
If you want a dedicated app, Clue’s GDPR compliance posture makes it a more defensible choice than US-based alternatives. Read their privacy policy. Look specifically for what they share with “research partners” and under what conditions.
Turn off advertising ID tracking on your phone. On Android: Settings → Privacy → Ads → Delete advertising ID. On iOS: Settings → Privacy & Security → Tracking → disable “Allow Apps to Request to Track.” This does not eliminate SDK data collection, but it limits the ability to link your health app behavior to your broader ad profile.
Before installing any health app, search its privacy policy for the words “research partners,” “third parties,” and “analytics.” The presence of those terms is not disqualifying on its own, but it tells you where to focus your questions.
Under Section 13 of India’s Digital Personal Data Protection Act, you can request deletion of your personal data from any app that processes it, including apps accessible in India. Many US-based apps also honor deletion requests made under California’s CCPA, even from non-US users, because their deletion infrastructure is global. Send the request in writing. Keep a record of it.
The core issue is not that these apps are malicious. It is that your most sensitive health data is, right now, held by companies whose business model depends on data being useful — to advertisers, to researchers, to acquirers. Your privacy is not their primary constraint. Their privacy policy is.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.