Menstrual cycle app data privacy statistics: who tracks, what gets shared, and how often predictions miss

She held up her phone in clinic and showed me a pink calendar tile that said she was "high fertility" today. She was 29, trying to conceive for seven months, and had timed intercourse to that tile for half a year. When I asked how the app decided the window, she shrugged. "It knows my cycle." What it knew was a short run of self-entered bleed dates and an algorithm she had never been shown. Plus a dense log of sexual activity and pregnancy attempts sitting on a server she could not name.

Cycle-tracking apps sit where two patient concerns meet: wanting a clearer map of physiology, and wanting that map not to travel. After the Supreme Court overturned Roe v. Wade in 2022, the second concern stopped being abstract. A missed-period log can be clinical context in my office and legal evidence somewhere else. That is why researchers and regulators now treat period apps as high-stakes health infrastructure, not wellness gadgets.

What follows are the primary numbers reporters and clinicians can cite: usage, audit findings on data sharing, prediction accuracy, enforcement actions, and what we know about trust. Where the data are thin, I say so.

Audit	Sample	Key finding
Alfawzan et al., JMIR 2022	23 popular women's mHealth apps	87% shared data with third parties
Alfawzan et al., JMIR 2022	Same sample	13% collected data before consent
Mozilla Privacy Not Included, 2022	25 period/pregnancy apps and fertility wearables	18 received *Privacy Not Included warning
Mozilla Privacy Not Included, 2022	Same sample	8 failed Minimum Security Standards
Malki et al. / KCL-UCL, CHI 2024	20 popular female health apps (UK/US stores)	35% claimed no third-party sharing in data-safety labels but described sharing in policies
Grundy et al., BMJ 2019	24 top medicines-related apps	79% shared user data

Sources: Alfawzan et al., JMIR mHealth and uHealth (2022); Mozilla Foundation (2022); Malki et al. / King's College London-UCL CHI 2024 findings; Grundy et al., BMJ (2019).

Measure	Value	Source
Mean ovulatory cycle length (real-world app users)	29.3 days	Bull et al., 2019 (612,613 cycles)
Mean follicular phase length	16.9 days	Bull et al., 2019
Mean luteal phase length	12.4 days	Bull et al., 2019
Women who believed they had a 28-day cycle	34%	Johnson et al., 2018
Women who actually had a 28-day cycle in that study	15%	Johnson et al., 2018
Best ovulation-day prediction accuracy, calendar apps	≤21%	Johnson et al., 2018
Respondents whose period arrived later than app predicted	72.1%	Broad et al., 2022

Sources: Bull et al., npj Digital Medicine (2019); Johnson et al., Current Medical Research and Opinion (2018); Broad et al., Women's Health (2022).

How many women use cycle apps

The cleanest U.S. population estimate still comes from KFF's Health Apps and Information Survey, fielded August 16-18, 2019. Among women who had a smartphone or used the internet, 30% reported tracking fertility or menstrual cycles at least occasionally: 1% about once a day, 3% about once a week, 15% about once a month, 3% a few times a year, and 8% less often. Sixty-eight percent said they had never done it.

Nearly one in three connected adult women had put cycle data into a digital tool before the pandemic and before Dobbs. Among those who tracked, KFF found that 73% used a smartphone app, 14% used a browser only, and 9% used both. The survey is older now and does not name products; what it still establishes is scale. When privacy fails for a category this large, it is infrastructure, not a boutique tech story.

People use these tools for different reasons. In Broad, Biswakarma and Harper's 2022 survey of period-tracker users (330 complete responses; mean age 26.0), 29.7% said the best thing about the app was knowing when they were ovulating, and many used it mainly to anticipate bleeding. That dual use is why the data are clinically useful and legally sensitive at once. For fertility-timing context, see fertility and age statistics.

What audits found about data sharing

If you only remember one privacy number from this page, make it this one. In 2022, Alfawzan and colleagues published a content analysis of popular women's mHealth apps in JMIR mHealth and uHealth. Most apps shared user data: 20 of 23, or 87%. Sharing details could not be obtained for the remaining 13%. Only 13 of 23 apps (57%) told users anything about data security. Three apps (13%) collected data before obtaining consent. The authors concluded that many of the most popular women's mHealth apps have poor privacy, sharing and security standards.

Mozilla's August 2022 Privacy Not Included investigation reviewed ten period apps, ten pregnancy apps, and five fertility-tracking wearables. Eighteen of 25 products received a *Privacy Not Included warning. Eight failed Mozilla's Minimum Security Standards, in some cases accepting single-digit or sequential passwords. Only one app, Euki, earned a "Best Of" badge, largely because it stores data on the device. Wearables in the sample (Garmin, Fitbit, Apple Watch, Oura Ring, Whoop Strap) fared better and did not receive the warning. Mozilla also found that most apps lacked a clear policy on when data could go to law enforcement. That gap matters after Dobbs, when a late-period log is not just a calendar note.

A 2024 CHI study from King's College London and University College London reviewed 20 popular female health apps in UK and U.S. Google Play stores. Per the institutional summary, 35% claimed in store data-safety labels that they did not share personal data with third parties, yet their privacy policies described some sharing. Half assured users that health data would not go to advertisers while staying ambiguous about other data generated through app use. Forty-five percent of policies disclaimed responsibility for third parties even while claiming to vet them. Only one app explicitly addressed menstrual-data sensitivity with respect to law enforcement.

The broader mobile-health literature looks no cleaner. Grundy and colleagues' 2019 BMJ traffic analysis of 24 top medicines-related apps found that 19 of 24 (79%) shared user data: "routine, yet far from transparent." Period apps are a high-sensitivity corner of a leaky ecosystem, not a uniquely reckless niche.

One legal point patients get wrong almost every time: most direct-to-consumer period trackers are not covered by HIPAA. HIPAA reaches clinics, health plans, and their business associates; a free app-store download usually does not. The FTC's Health Breach Notification Rule more often applies, and unauthorized disclosure to ad platforms can count as a breach. The agency has pressed this point since 2021, including a finalized HBNR update in April 2024. Your hospital portal and your pink calendar tile do not have the same legal duties.

How accurate are the algorithms

Privacy is half the story. The other half is whether the predictions are good enough to plan around.

Johnson, Marriott and Zinaman tested calendar-based apps against true ovulation timing determined by urinary LH surge in 949 volunteers. Mean cycle length was 28 days (range 23-35). Thirty-four percent of women believed they had a 28-day cycle; only 15% actually did. For a 28-day cycle, the most likely ovulation day was day 16, and even that peak probability was only 21%. App accuracy for ovulation day was no better than 21%. The authors' conclusion is the one I quote in counseling: because ovulation day varies widely for any given cycle length, calendar methods that use cycle length alone cannot accurately predict the day of ovulation.

Real-world data make the same point at larger scale. Bull and colleagues analyzed 612,613 ovulatory cycles from 124,648 Natural Cycles users: mean cycle length 29.3 days, mean follicular phase 16.9 days (95% CI 10-30), mean luteal phase 12.4 days (95% CI 7-17). That follicular-phase mean should end the folk belief that everyone ovulates on day 14. Apps that hard-code a 14-day offset from the predicted period are guessing with confidence.

Moglia, Castaño and colleagues' 2016 evaluation in Obstetrics & Gynecology concluded that most free smartphone menstrual tracking apps for patient use are inaccurate, with few citing medical literature or documenting clinician involvement. Logging bleed dates can still help someone notice cycles past 35 days, soaking-through bleeding, or three months without a period. These are patterns worth evaluating. What the literature does not support is treating an unvalidated fertile-window tile as contraception or a definitive ovulation test. For patients who want structured tools without uploading a sexual history to a commercial server, our period calculator, ovulation calculator, and cycle length tool keep the math on the page.

When predictions miss, and what users feel

Users already know the apps miss. Broad and colleagues asked 330 period-tracker users whether their period ever started earlier or later than predicted: 54.9% said earlier, 72.1% said later. When bleeding arrived early, people described frustration, anxiety, or simply feeling unaffected. When it arrived late, themes included pregnancy anxiety, disappointment about pregnancy, seeking advice, and thoughts about menopause.

That emotional load is clinical. A late-period alert can send someone to buy a pregnancy test. Or, where abortion is criminalized, worry that a digital record of a missed period will outlive the private decision she makes next. Our summary of abortion access and travel distance after Dobbs describes how far that legal geography already forces people to travel; digital trails travel farther still.

Prediction misses also distort contraceptive counseling. A patient who believes her app "covers" her fertile window the way a condom covers intercourse is combining two different failure models. Evidence on app-based fertility awareness as contraception is limited, often company-linked, and frequently excludes people with variable cycles. Fertility-awareness methods need published typical-use failure rates, not a free download's defaults. See also contraception access and unintended pregnancy statistics.

Regulatory actions and settlements

Two FTC matters define the U.S. enforcement baseline.

In January 2021 the FTC announced a settlement with Flo Health, developer of a period and fertility app the agency said was used by more than 100 million consumers. The complaint alleged Flo promised to keep health data private, yet disclosed information from millions of users, including pregnancy status sent as "app events," to marketing and analytics partners including Facebook, Google, AppsFlyer and Flurry. It did not stop until a February 2019 news article revealed the practices and prompted hundreds of user complaints. The June 2021 final order required affirmative consent before sharing health information, an independent privacy review, user notification, and instructions to third parties to destroy the data.

In May 2023 the FTC charged Easy Healthcare Corporation, operator of Premom, with deceiving users about data sharing. The agency alleged Premom shared sensitive information with third parties, including two China-based firms, disclosed health data to AppsFlyer and Google through software development kits, and failed to notify consumers under the Health Breach Notification Rule. Under the order, the FTC's second HBNR enforcement after GoodRx, Easy Healthcare would pay a $100,000 civil penalty, be permanently barred from sharing personal health data with third parties for advertising, and obtain consent before sharing health data for other purposes. The company also agreed to pay $100,000 total to Connecticut, the District of Columbia, and Oregon.

Those cases establish a pattern: privacy promises in a period app's marketing copy are enforceable claims. Sharing health events with ad platforms after telling users the data stay private is a fact pattern regulators have already litigated.

Trust after Dobbs

Trust is harder to quantify than sharing rates, and the survey evidence is thinner than I would like. What we have points one direction.

Mozilla's 2022 review was framed for a post-Roe world, warning that apps millions of people trust could help identify pregnancy, abortion-seeking, or cross-state travel. The KCL-UCL 2024 analysis showed how few apps treat menstrual data as uniquely sensitive in that legal sense. I do not have a gold-standard national poll that says exactly what share of American women deleted a period app after Dobbs. The stronger claim the primary sources support is structural: wide usage, routine third-party sharing, vague law-enforcement policies, and a changed criminal legal environment create a foreseeable risk. Trust erodes when the threat model changes and product design does not.

That tension shows up when a patient wants help with a late period but hesitates to open the app in front of me, or asks whether she should delete it before a partner checks her phone. Those are safety questions. They belong in the same visit as the pregnancy test: next to practical issues like whether she can afford products this month, which we cover in our period poverty statistics brief.

Practical counseling for patients who track

I still recommend cycle logging. I do not automatically recommend a commercial cloud app.

Prefer tools that store data on the device, minimize third-party SDKs, publish a clear law-enforcement policy, and let you export or delete data without a second questionnaire about miscarriage or abortion. Turn off unnecessary permissions. Do not enter information you would not want read aloud in court. If you time intercourse for conception, corroborate the fertile window with LH kits or basal temperature rather than a calendar tile alone. If you are using an app as birth control, switch to a method with a published typical-use failure rate you accept.

Paper calendars still work. So do local tools that need no account. Our late period tool is built for the common "my period is late, what now" visit, not for building a commercial profile. Apps that flag "possible PCOS" from incomplete self-report can be a useful nudge to seek care; they are not a diagnosis. Irregular cycles deserve history, exam and labs. Not a push notification.

The patient with the pink fertility tile conceived on a cycle when we ignored the tile and timed to a positive LH kit. She kept a tracker after we cut the fields she did not need. That is the compromise I can live with: keep the useful diary, drop the parts that treat her reproductive life as ad inventory.

Frequently asked questions about period apps and privacy

How many women use period or fertility tracking apps?

In KFF's 2019 national survey, 30% of U.S. women with a smartphone or internet access said they tracked fertility or menstrual cycles at least occasionally, and 15% did so about once a month. Among those trackers, 73% used a smartphone app. Newer national estimates of comparable quality are scarce, so treat 30% as a solid pre-pandemic baseline rather than a 2026 point estimate.

Do period apps share data with third parties?

Often, yes. Alfawzan and colleagues found that 87% of 23 popular women's mHealth apps shared user data with third parties. Mozilla labeled 18 of 25 period and pregnancy products with a privacy warning in 2022. A 2024 KCL-UCL review found that 35% of 20 female health apps claimed in store data-safety labels that they did not share personal data, while their privacy policies described sharing.

Are cycle apps covered by HIPAA?

Most direct-to-consumer period trackers are not HIPAA covered entities. HIPAA generally reaches clinics, health plans, and their business associates, not free app-store downloads used without a provider in the middle. The FTC's Health Breach Notification Rule is the federal tool that more often applies when non-HIPAA health apps improperly disclose personal health records.

How accurate are period app ovulation predictions?

For calendar-style apps that rely mainly on cycle length, not very. Johnson and colleagues found ovulation-day prediction accuracy no better than 21% when checked against LH surge timing. Real-world data from Bull and colleagues show a mean follicular phase of 16.9 days, which undercuts the day-14 assumption many apps still embed. Apps can still help log bleeding patterns; they should not replace validated fertility or contraceptive methods.

What have regulators done about period app privacy?

The FTC settled with Flo Health in 2021 over alleged sharing of sensitive health data from an app used by more than 100 million consumers with analytics and advertising partners including Facebook and Google. In 2023, the FTC ordered Premom's developer to stop sharing health data for advertising and to pay a $100,000 civil penalty for violating the Health Breach Notification Rule after alleged disclosures to third parties including two China-based firms as well as AppsFlyer and Google.

Should I delete my period tracker after Dobbs?

That is a personal risk decision, not a universal medical rule. If you live in or travel through a jurisdiction that criminalizes abortion, minimizing cloud-stored reproductive data is a reasonable safety step. If you keep an app, choose local storage, limit permissions, and avoid logging details you would not want disclosed. Deleting an app is not a substitute for clinical care when periods are late, heavy, or absent. Get evaluated, then decide how to keep records.