How do I know if a period app sells my data?

Read its privacy policy for three things: mentions of 'third parties,' 'partners,' or 'affiliates'; references to advertising, ad networks, or marketing; and language about 'sharing for business purposes.' Any of these means your data leaves the app. An app that genuinely doesn't sell data usually says, plainly, that data stays on your device.

What are the red flags in a period app's privacy policy?

The big three: the app requires an account (it holds your identity), the policy lists third parties or ad/analytics partners (data leaves), and the app can't work offline or wants your location (channels for data to flow out). Vague 'we may share data to improve our services' language is a catch-all worth treating as a yes.

Which period trackers don't sell your data?

On-device and nonprofit/open-source trackers: Dew, Euki, Drip, and Apple Health keep data on your device with nothing to sell. Clue says it doesn't sell data but shares de-identified data for research. The strongest assurance is structural — an app that never receives your data can't sell it.

Does 'we don't sell your data' mean an app is private?

Not by itself. A company can avoid 'selling' while still 'sharing' data with partners, using it for ad measurement, or storing it readably on its servers. The phrase is necessary but not sufficient. The reliable test is whether the company holds a readable copy at all — if it doesn't, the question is moot.

How to find a period tracker that doesn't sell your data

Three tells in a privacy policy that mean your cycle data is being sold, and five period trackers that pass the test. Read this before you install another app.

Every period app will tell you they care about privacy. Most of them are also selling — or at minimum sharing — your cycle data with someone else. Both statements can be true at the same time, because the industry has gotten very good at hiding the second one inside the first.

Here's how to spot it in 60 seconds, and the five trackers we found that pass the test honestly.

The 60-second privacy policy test

Open any app's privacy policy. Use Cmd-F (or your phone's Find function) and look for three phrases:

1. "Third-party partners" or "service providers"

These are legal-sounding catch-alls. They cover everything from a legitimate hosting provider (fine) to ad networks (not fine). When you see this phrase, the next thing to check is which third parties — most policies list them.

Red flag: Meta, Facebook, Google Analytics, AppsFlyer, Branch, Adjust, AppLovin, Singular, Tenjin, Liftoff. Any of these in the list means cycle data (or behavior signals about cycle data) is being shipped off device.

2. "Aggregate" or "anonymized" data sharing

"We share aggregate, anonymized data with research partners" is the friendliest version of "we sell your data, just not with your name on it." Sometimes this is genuinely benign — Clue has shared anonymized aggregate data with Stanford and Oxford for women's-health research, and that's a defensible use.

Red flag: The clause doesn't name the partners, or names ad-tech / market-research companies (Nielsen, IRI, Comscore, Numerator, Datawave) rather than universities.

3. "We may update this policy at any time"

Almost every privacy policy has this clause, but combined with a long list of third parties, it means the company reserves the right to change practices and you won't be notified. The data you log today could be used differently in a year.

Red flag: No notification commitment. No version history. No "material changes will be communicated by email" line.

The five trackers that pass

Dew

Privacy policy fits on a short page. No third-party SDKs. No ad networks. No analytics providers reading cycle data. Crash reports go through Apple's own MetricKit, which is on-device and de-identified. Anonymous usage analytics (taps, not data) goes through TelemetryDeck — opt-out in Settings, never references anything personal. Read the full Dew privacy policy.

Apple Health Cycle Tracking

Apple does not sell HealthKit data — they've stated this publicly and it's contractually enforced by HealthKit's API. Cycle tracking specifically is in the "extra-sensitive" classification and is end-to-end encrypted even from Apple.

Euki

Open-source, offline-only, no network code in the app. There's nothing to sell because nothing leaves the phone. Run by a women's-health nonprofit (Women Help Women).

Drip

Open-source. Optional backup is encrypted with your password and goes to your own iCloud or Google Drive — not Drip's servers. The privacy policy is two pages and readable.

Clue (qualified)

German company, GDPR-bound. Privacy policy is detailed. Has shared aggregate anonymized data with research partners (Stanford, Oxford) — that's documented. No ad networks in the app. Honors account deletion within 30 days.

The qualification: Data is still stored on Clue's servers tied to your account. If the threat model includes "server breach" or "subpoena," it's less protective than the offline-first options above. But if the threat model is "company selling my data to advertisers," Clue holds the line.

The ones we'd skip

Without naming names beyond what's public record: any free period tracker funded by in-app advertising is selling your behavioral data to make that ad revenue happen. That's not an opinion — it's how programmatic advertising works. If you see banner ads or interstitials in the app, the app is monetizing your attention AND your data signals together.

Flo is a complicated case. In 2021 it settled FTC allegations that it shared menstrual data with third parties — named in the complaint as Facebook, Google, and AppsFlyer — despite promising otherwise. The settlement carried no fine and no admission of wrongdoing; Flo says it has changed practices since. The FTC's consent order is public, and Anonymous Mode in Flo is a feature, not the default state.

The deeper rule

A period app that doesn't sell your data has a sustainable business model that doesn't depend on advertising — either it's a paid app, has a paid tier, or is backed by something else (nonprofit, university, indie maker who isn't trying to get rich).

If the app is free, has no ads, and has no paid tier, the business model is you.

For a side-by-side comparison of the trackers above, see The best private period tracker apps in 2026.