Period trackers
Flo privacy rating
Period, ovulation and pregnancy tracking app with cycle predictions, symptom logging and health content, funded by Flo Premium subscriptions. An Anonymous Mode removes name and email from the account.
Summary
Flo scores 20 out of 100 (grade F) on the period trackers criteria. It partly meets no ads or data sales, independent audit and no account needed. It does not meet open source, no trackers or telemetry and data stays on device. It is based in the United Kingdom: Five Eyes member; GDPR-style data protection law; CLOUD Act data access agreement with the US.
Score 20 out of 100. How scoring works
Criteria
- No
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The Exodus report finds AppsFlyer, Google Firebase Analytics and Sentry in the Android app.
-
Partial
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by subscriptions with no in-app ads or data sales, but with consent device identifiers are shared with AppsFlyer and ad partners such as Meta and Google Ads to target Flo's own ads.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Flo holds ISO 27001 and ISO 27701 certifications and cites a third-party privacy audit, but no full audit report is public.
-
No
Data stays on device Weight 3 of 3
Is cycle data stored only on the device by default?
Cycle data is stored on Flo's servers, encrypted at rest but not end-to-end encrypted.
-
Partial
No account needed Weight 2 of 3
Can the app be used without an account?
An account is created on Flo's servers, but Anonymous Mode lets it be used without a name, email or other identifiers.
The FTC settled allegations that Flo shared users' health information with outside data analytics providers after promising to keep it private. The order requires Flo to get users' consent before sharing health information and to obtain an independent review of its privacy practices. See the FTC press release and case page.