By Sachin

Mozilla Foundation's privacy researchers performed a six-month test of the most downloaded period-tracking apps and how the apps handle the most sensitive data of individuals, including: cycle history, fertility goals, symptoms, and sexual activity. Given the industry's track record, the testers went in expecting to find the same problems that have surfaced again and again in this category, such as identifiers leaking to advertisers or symptom data landing somewhere it shouldn't.

Flo Health, the app Mozilla listed at more than 80 million monthly users, turned out to be a harder case than that history suggests.

What Did Mozilla Find When It Tested Flo's Data Sharing?

Mozilla's reviewer, Shoshana Wodinsky, a former senior advisor at the FTC on privacy matters, spent three hours running manual tests and network analysis on the Flo Health app, tracking what left Flo's servers and where the data went. Wodinsky's conclusion: there is no evidence that Flo sells user data, and the health information logged during testing never reached the app's advertising or analytics partners. Symptom entries, fertility predictions, pregnancy details, and cycle classifications, key functions of period-tracking apps, didn't show up anywhere in the traffic observed by Mozilla's team.

That finding helped Flo land a score of 7 out of 10 in Mozilla's review, just behind Clue's 8 and behind the review's top performer, Euki, a nonprofit tracker built for local-only storage that took the only perfect score in the group. Set against the five other apps in the review, Flo's number told an unusual story: a company that collects a large volume of information and, according to Mozilla's testing, keeps data inside its own systems instead of feeding it into the ad-tech pipeline that tripped up some of its competitors.

How Does Flo's Current Practice Compare to Its Own History?

Mozilla confirmed with Flo that its score reflected the historical matter, rather than Flo's current, highly stringent privacy and security practices.

Flo Health reached a settlement with the FTC in January 2021, tied to Software Development Kits that inadvertently shared technical information with a third-party. Flo settled to avoid the time and expense of litigation, and as part of the agreement, Flo had an independent privacy audit in March 2022. Flo successfully passed the audit, which confirmed Flo's privacy practices are strong and align with our publicly stated Privacy Policy.

See also: Here’s How You Can go Environment-friendly During Menstruation

A separate case resolved in 2025 with an $8 million settlement tied to data flowing through advertising and analytics systems without adequate user consent, according to Mozilla's account of the company's record. However, the presiding Judge said that the lack of evidence against Flo was an "insurmountable" problem in Plaintiff's case.

These historic matters have persisted and added to misconceptions about Flo's privacy policies. However, Mozilla's own review of the company's privacy policy over time backs up Flo's side of the story. The 2018 version named Facebook Analytics and Google Analytics directly as data recipients. That language disappeared the following year, replaced with a pledge never to share health data. The language was changed, as the SDKs in question were removed from Flo's ecosystem.

After the 2021 settlement, Flo added a formal legal-basis table, a list of named data processors, and a "no sale of personal data" commitment. By this April, the policy had grown again to disclose newer wellness and telehealth partnerships and to separate out dedicated notices for state privacy law and consumer health data specifically.

What Privacy Controls Does Flo Actually Give Users?

Mozilla's testing found Flo's permission structure breaks from the all-or-nothing model common across femtech and other health apps. Only two things are required to use Flo: agreeing to have health data processed to run the app and accepting the standard privacy policy. A separate, optional setting controls whether Flo shares basic device and app information with its advertising and analytics partners, among them AppsFlyer, Moloco, and Google's Firebase. Turning that setting off visibly reduced what those partners received during Mozilla's tests.

Flo also runs a feature called Anonymous Mode, built, according to the company's own privacy materials, to let people log health data without tying it to a name, email address, or device identifier. The mode routes traffic through an encrypted relay using a protocol called Oblivious HTTP, so identifying details are stripped before the data reaches Flo at all. The company says it holds an ISO 27701 privacy certification, first obtained in 2024, and describes itself as the first period-tracking app to receive it. Flo also maintains a standing Privacy and Security Advisory Board, whose members include current and former chief information security officers from companies such as Teladoc and SAP Fioneer.

Where Did Mozilla Still Flag Concerns?

The review wasn't uniformly positive. Testers found that even with tracking declined, one partner, AppsFlyer, still received a device identifier in plain text during the first few minutes of a session, before Anonymous Mode had a chance to take effect. Notably, Anonymous Mode creates an entirely separate account for these users, which means there is no way to tie the profile back to a specific users.

Mozilla's broader concern about Flo had less to do with any data leaving the company today and more to do with what stays inside it: the app's core function depends on building a detailed, long-running model of a user's reproductive health. Mozilla mused that the way that data is structured internally could make future sharing easier if Flo's practices ever changed. However, this presumptive narrative makes assertions that do not align with Flo's business model, and the researchers were careful to describe this as a design risk to watch, with no evidence that any data is shared outside of user consent.

What Does This Mean for the Period-Tracking Category?

Placed next to the rest of Mozilla's findings, Flo's results stand out. One app tested in the same review, Stardust, was found sharing detailed health information, including birth control type and specific symptoms, with a third-party analytics firm. Another, Period Calendar, was flagged as the only ad-supported app among the six.

Flo, despite holding by far the largest user base in the group and collecting some of the most detailed data, did not do either, Mozilla confirmed.

For a company with Flo's public history and misconception, that distinction matters. Mozilla's researchers said outright that they expected to find the same pattern that has dogged this category for years and instead found a company that kept its most sensitive information contained. The report's authors noted that containment doesn't mean invulnerable. However,for someone deciding which app to trust with information this personal, selecting an app where data stays in-house is arguably the most important feature.

[GP/KS]

Suggested reading: