Are period tracker apps safe? What we found in 2026

"Are period tracker apps safe?" is one of the most-asked questions about this category of software in 2026, and the honest answer is: some are, most aren't, and the difference is structural.

Safety in this context means four separate things — they get blurred together in headlines but they aren't the same problem. Below, each of them, what the evidence shows, and what you can actually do about it.

1. Is the data being sold?

The most common failure mode. Many free period trackers fund themselves the same way most free apps do — by including SDKs from ad networks (Meta, Google, AppLovin, AppsFlyer, Branch) that observe what users do inside the app and send those signals to advertisers.

The most-cited case: Flo, which the FTC fined in 2021 for sharing users' menstrual and pregnancy data with Facebook, Google, and AppsFlyer despite promising in its privacy policy that it wouldn't. Flo has since changed its practices, but the consent decree from that case is a public record of how the industry was operating until very recently.

How to tell: Open the app's privacy policy and search for the words "third-party," "partners," "ad networks," "analytics providers," "marketing partners," and "service providers." Anything beyond Apple-platform services (App Store, TestFlight) means data is leaving the device.

2. Could the data be subpoenaed?

After the 2022 Dobbs decision in the United States, this stopped being theoretical. State prosecutors in some U.S. jurisdictions have requested cycle data from third-party period apps in criminal proceedings related to abortion. The cases are still unfolding, but the pattern is clear: data that exists on a server can be subpoenaed; data that lives only on a phone cannot.

For users in those jurisdictions — or anyone who wants their reproductive history unreachable to law enforcement — the only durable defense is an app that structurally cannot hand over the data.

How to tell: If the app has accounts, it has a database. If it has a database, the data is reachable. Look for "on-device only," "end-to-end encrypted," or "we have no copy" in the privacy promise. If those phrases aren't there, assume the data is reachable.

3. Has the company been breached?

Even apps that don't sell data can leak it. In 2020, Flo had a security disclosure about an API misconfiguration. Several smaller tracker apps have had data exposed through unsecured databases (the "left an S3 bucket open" pattern). Major fertility apps Glow and Ovia have had similar issues over the years.

Breaches happen even to companies with the best intentions. The only protection against breach is to not have your data on a server in the first place.

How to tell: Search "[app name] breach" or "[app name] security incident" before installing. Check Have I Been Pwned for the app's domain.

4. Is the cycle prediction itself safe?

Separate from data privacy: most period trackers are NOT regulated medical devices. Their predictions are estimates, not medical guidance. Apps that claim contraceptive efficacy (Natural Cycles is the main one) ARE regulated and have FDA clearance. Apps that don't claim it shouldn't be relied on for contraception or fertility guidance.

This is a category-wide note: even a "safe" app from a privacy standpoint should not be your sole source of fertility planning. Talk to a doctor.

The safest options in 2026

Based on the four criteria above, here's where the major apps land:

• Safe on all four: Dew, Apple Health Cycle Tracking, Euki, Drip. On-device data, no third-party SDKs, nothing on a server to breach.
• Safe on most, mid on data-sale risk: Clue. Cloud-stored but under German privacy law, no advertising SDKs, account deletion honored.
• Improved but with history: Flo. Has updated practices but the FTC consent decree is recent and Anonymous Mode is a feature, not a default.
• Skip: Free trackers funded by ads (any of them — look for the ads, that's the tell), small unbranded apps from the App Store with no clear company behind them.

What "safe" looks like in practice

If you want a fast safety check before installing any period app, run these four questions:

1. Does it require an account? (If yes, your identity is tied to your data.)
2. Does the privacy policy mention third-party partners? (If yes, data is leaving the device.)
3. Does the app work offline? (If no, data is syncing somewhere.)
4. Is the company based in a jurisdiction with strong health-data law? (If you don't know, look it up.)

An app that answers no, no, yes, yes is structurally safe. An app that answers yes, yes, no, no is structurally unsafe, no matter what the marketing says.

What we did about it

We built Dew so that the four-question check returns the safe answer in every column: no account, no third parties in the privacy policy, fully offline-capable, based on Apple-platform-only infrastructure. The architecture is the protection — not the promise.

For more on how the comparison shakes out across apps, see Flo, Clue, Stardust, Dew: a privacy comparison.