Yuvix Guide

Is a Period Tracker Safe for Your Health Data?

Mentari RahmanFounder of Yuvix

dr. Risdayani R JumarangMedically reviewed, General Practitioner

A period tracker can record sexual activity, symptoms, mood, and attempts to conceive. The useful question is not whether an app collects data, since most do, but what it collects, where that data goes, and whether you can remove it. This guide gives you a way to check any tracker, Yuvix included, using public sources.

What a period tracker collects

Most trackers ask for cycle dates and flow, and many also collect symptoms, sexual activity, medication, sleep, weight, and free-text notes. Apps often add device identifiers, IP addresses, usage events, and purchase records. Symptom and sexual-activity logs are the most sensitive. Device identifiers matter because they let a company link your activity across apps. If you compile these records for clinical visits, learn what data is actually necessary in our guide to how to prepare your cycle records for a doctor visit.

Where the risks come from

The US Federal Trade Commission has warned that health apps may use data for research, advertising, or disclosure and sale. Many of them are not covered by HIPAA, the US health privacy law that applies to doctors, hospitals, and insurers. The FTC's case against Flo Health shows the gap between a privacy promise and actual practice. According to the FTC, Flo shared health data from millions of users with marketing and analytics firms, including Facebook and Google, despite its assurances. The final order in 2021 requires affirmative consent before sharing, an independent privacy review, notice to affected users, and instructions to third parties to destroy the data.

Other risks worth understanding:

• Third-party code. An app may include analytics or advertising software development kits (SDKs) that send data to companies you never chose to deal with.
• Data brokers. Information passed to a broker can be resold to parties the app never named.
• Breaches. Records on a company server can be exposed in an intrusion. Records kept only on your phone are not exposed that way, but they are exposed if the phone is unlocked or stolen.
• Legal requests. Data a company holds can be requested by police or courts. A 2022 review found that many apps were unclear about how they would handle police warrants.
• Weak account security. The same review found that eight apps failed minimum security standards, including allowing weak passwords.

Mozilla's Privacy Not Included review, reported by the Guardian in August 2022, examined more than 20 period and pregnancy tracking apps and wearables. Only seven were judged safe, and most shared data with third parties. Those findings describe apps tested in 2022, not necessarily the apps you may install today.

In April 2024 the FTC also finalized changes to its Health Breach Notification Rule, which covers health apps outside HIPAA. An unauthorized disclosure of health data can now count as a "breach of security".

How to read Apple and Google privacy labels

The App Store privacy label is built from the developer's own declarations. Check two parts. Data linked to you is tied to your account or identity, and Apple's health and sensitive info categories include pregnancy or childbirth information. Data used to track you means linking app data with third-party data for targeted advertising, or sharing it with a data broker. The label lists these separately.

Apple's developer guidance also defines "collect" as transmitting data off the device for longer than needed to serve the request. Data processed only on the device does not need to be disclosed. A label that shows no data collected should therefore be checked against the privacy policy. It is not proof that nothing leaves the phone.

On iPhone you can also manage App Tracking Transparency prompts. If an app asks to track your activity, you can choose Ask App Not to Track. Apple says the app then cannot access the advertising identifier (IDFA) and cannot track you using other identifying information, such as your email address. You can review every app's setting in Settings, then Privacy & Security, then Tracking.

Google Play's Data safety section lists the data an app collects and shares, whether data is encrypted in transit, and whether users can request deletion. Google's help center says data processed only on the device is not "collected", and sharing exemptions cover service providers and legal requests. A "not shared" entry does not rule out all third-party processing, so check the privacy policy for named services.

A privacy audit checklist

Use this list before you install an app and again after any major update:

1. Read the privacy policy before installing. Search for "sell", "share", "advertising", "broker", and "third party".
2. Compare the data types on the App Store or Google Play listing with what the privacy policy says.
3. Check the permissions requested. A cycle tracker rarely needs contacts, precise location, or background access.
4. Look for a list of third-party services or SDKs. If none is published, ask the developer directly.
5. Check whether you can use the app without creating an account.
6. Look for a deletion option inside the app, plus a documented web route. Google Play policy requires apps that allow account creation to offer deletion both in-app and on a web resource, and it says freezing an account is not a substitute.
7. After installing, review the settings. The FTC advises checking them because defaults often favor sharing, and keeping the app updated.
8. Test deletion and export before you rely on the app. The next section explains what to check.

Checking deletion and export

Deletion should be possible inside the app, and the policy should say what it removes: the local database, server records, third-party copies, and cloud backups. A policy that answers only the first question is incomplete.

Check what uninstalling does. Some apps keep payment or analytics records, and some backups survive a reinstall. Deleting local data does not cancel your store subscription.

If the app exports a PDF or CSV for your doctor, check where it is saved and whether it is uploaded. Once shared through messaging or email, the file is outside the tracker's control.

How Yuvix stores data

Yuvix is a period and cycle tracker for Android and iOS. Core tracking is free; Premium is $2.99 per month or $19.99 per year. Yuvix is not a medical device or contraception, and predictions are estimates from logged data. Founder: Mentari Rahman. Our privacy policy says the following, which you can test against the checklist above:

• Records stay on your device. Cycle history, symptoms, notes, and fertility observations are stored in an encrypted local database (SQLCipher). The key is kept in the Android Keystore or the iOS Keychain, set to this device only on iOS. We do not claim the key is held in dedicated security hardware.
• No account is required. Mentarich LLC does not operate a remote user account database or a cloud health server for Yuvix V1.
• No cloud copy and no cloud restore. The health database is excluded from device backups and transfers. Uninstalling the app, erasing the device, or losing access to its device-bound key can permanently erase your records. Restoring a backup does not bring them back.
• Health Connect is optional on Android. It stays off until you connect it under Settings, then Connect health data.
• Purchases go through the store. Apple or Google processes payment. RevenueCat validates receipts and checks subscription status. When a RevenueCat key is configured, the app contacts RevenueCat at launch for every user, including people who never subscribe. RevenueCat receives an anonymous app user identifier, purchase and entitlement data, and technical device data. Yuvix does not send cycle dates, symptoms, health reports, or personal health notes to RevenueCat or to payment processors.
• No advertising trackers. Yuvix V1 does not include third-party advertising SDKs, data brokers, or behavioral ad tracking.
• Reports are yours to share. A Doctor-Ready Health Report PDF is created on your device and saved as a temporary file. It is shared only when you choose, through your operating system's share sheet, and the temporary file is deleted after you share or dismiss it.

To evaluate and compare permissions across major cycle trackers before installing, see our structured period tracker comparison scoring worksheet, or understand the physiological reasons for symptom logging in our guide to the four phases of the menstrual cycle.

To delete everything in the app, go to Settings, then Data & Privacy, then Delete All Local Data, and confirm. This removes the database, the encryption keys, and any workouts imported from Health Connect. It does not clear Health Connect permissions and does not delete your RevenueCat customer record. For that record, email [email protected]. Deleting local data does not cancel your store subscription.

Local storage protects against server breaches, but it does not protect a phone that someone else can unlock. Use a device passcode. Yuvix also offers an optional app lock using Face ID, Touch ID, or Android biometrics. Platform protections help, but no system is guaranteed secure. Policies change, so read the current version of ours and run the checklist above against it.

Protect your reproductive health data with Yuvix. Your period dates, fertility signs, and private notes stay encrypted on your phone. No cloud database, no tracking pixels, and no data sales.

Related Guides in this Cluster

Explore related clinical guides on cycle biomarkers, fertility awareness, and data privacy.

Buyer's Guide

How to Choose a Period Tracker

A feature checklist, how to test a free trial, how to judge prediction accuracy over three cycles, and an objective scoring worksheet.

Read guide →

Doctor Visit & Records

How to Prepare Your Cycle Records for a Doctor Visit

What to record, how to summarise three months of cycle data, a sample summary template, and red-flag symptoms that need prompt care.

Read guide →

Sources

• US Federal Trade Commission, "Does your health app protect your sensitive info?" (13 January 2021), consumer.ftc.gov/consumer-alerts/2021/01/does-your-health-app-protect-your-sensitive-info
• US Federal Trade Commission, "FTC Finalizes Order with Flo Health, Fertility-Tracking App that Shared Sensitive Health Data with Facebook, Google, and Others" (22 June 2021), ftc.gov/news-events/news/press-releases/2021/06/ftc-finalizes-order-flo-health-fertility-tracking-app-shared-sensitive-health-data-facebook-google
• US Federal Trade Commission, "FTC Finalizes Changes to the Health Breach Notification Rule" (26 April 2024), ftc.gov/news-events/news/press-releases/2024/04/ftc-finalizes-changes-health-breach-notification-rule
• The Guardian, "How private is your period-tracking app? Not very, study reveals" (17 August 2022), reporting the Mozilla Foundation's Privacy Not Included review, theguardian.com/world/2022/aug/17/pregnancy-period-tracking-apps-privacy
• Apple, "App Privacy Details", developer.apple.com/app-store/app-privacy-details/
• Apple Support, "If an app asks to track your activity", support.apple.com/en-us/102420
• Google Play Help, "Understand app privacy and security practices with Google Play's Data safety section", support.google.com/googleplay/answer/11416267
• Google Play Console Help, "User Data policy", support.google.com/googleplay/android-developer/answer/10144311
• Yuvix, "Privacy Policy", yuvixapp.com/privacy-policy, and "Delete Your Yuvix Data", yuvixapp.com/delete-data

Health information only. Yuvix is not a medical device and does not provide legal advice.