Are sex and period tracking apps safe?

Short answer: some are, some aren't — and the label on the app tells you very little. Intimate-health apps sit in a strange gap. People assume "health data" is tightly protected, but most of these apps aren't hospitals or insurers, so in many countries they fall outside laws like HIPAA. What actually protects you is the specific app's design and honesty — not the category it's in. Here's what the track record shows, and how to judge an app before you trust it with your sex life.

What has actually gone wrong

This isn't hypothetical. Regulators have repeatedly caught intimate-health apps sharing sensitive data after promising not to.

The clearest case is Flo. Its Period & Ovulation Tracker, used by over 100 million people, was found by the U.S. Federal Trade Commission to have shared sensitive information — including the fact that a user was menstruating or intended to get pregnant — with third parties such as Facebook and Google, despite privacy promises. The sharing only stopped after a 2019 news investigation, and Flo settled with the FTC in 2021, agreeing to get user consent before sharing health data and to submit to an independent privacy review (FTC, 2021).

It wasn't a one-off. In early 2023 the FTC brought its first-ever enforcement action under the Health Breach Notification Rule against GoodRx, which paid a $1.5 million penalty over sharing users' health information with Facebook, Google and others for advertising (FTC, 2023a). Months later, the fertility app Premom settled for sharing identifiable health data — and users' precise location — with Google, a marketing analytics firm, and two China-based companies; it paid a penalty and was permanently barred from sharing health data for advertising (FTC, 2023b). The same year, the online therapy service BetterHelp was penalised over sharing mental-health-intake data for advertising. And a Norwegian Consumer Council investigation earlier found period and fertility apps quietly passing data to advertising networks.

The pattern is consistent: the data is valuable, the promises were broken, and users had no visible way to know.

Why intimate data is different

A leaked shopping habit is annoying. A leaked record of your sex life, cycle, or pregnancy status is a different order of exposure — it can touch relationships, employment, insurance, and, in some places, legal risk. Concern sharpened after the 2022 Dobbs decision in the U.S., when reproductive-health data held by apps drew attention from regulators and state attorneys general as something that could potentially be used against users. The sensitivity is exactly why "we'll keep it private" needs to be more than a line in a marketing page.

The questions to ask any app

You don't need to read every privacy policy in full. A few pointed questions separate a trustworthy app from a risky one:

• What do they collect that they don't need? The safest data is data that was never collected. Does sign-up demand your name, precise location, or contacts when the app doesn't need them to work?
• Do they share with advertisers or "analytics" partners? This is where almost every case above went wrong. Look for a plain statement that they do not sell or share your data, not a vague "we may share with partners."
• Can you get your data out — and truly delete it? A real export and a genuine one-click delete are signals of good faith. If deletion is buried or partial, treat that as a warning.
• Are they honest about what law does and doesn't cover them? An app that clearly says "we're not HIPAA-covered, here's what we do instead" is being straight with you.
• What's the business model? If the product is free and there's no obvious way it makes money, your data may be the product.

What a privacy-first design looks like

The apps least likely to betray your trust are the ones that build the guarantee into the architecture, so there's simply nothing sensitive to leak or sell: collecting no name and no IP address, identifying you by a hashed email rather than a profile, keeping data minimal, and making export and full deletion trivial. When the data isn't there, it can't be shared, subpoenaed, or breached. (This minimise-by-design approach is the model behind Orgasmly — see how we handle it on our privacy page.)

Sex and period apps can be genuinely useful, and plenty are run responsibly. The point isn't fear — it's that you get to set the bar. Ask the questions above, favour apps that collect less and promise plainly, and treat any app that can't give straight answers about sharing and deletion as one that hasn't earned your most intimate data.

Sources

1. Federal Trade Commission. (2021). FTC Finalizes Order with Flo Health, a Fertility-Tracking App that Shared Sensitive Health Data with Facebook, Google, and Others. https://www.ftc.gov/news-events/news/press-releases/2021/06/ftc-finalizes-order-flo-health-fertility-tracking-app-shared-sensitive-health-data-facebook-google
2. Federal Trade Commission. (2023a). FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising. https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising
3. Federal Trade Commission. (2023b). Ovulation Tracking App Premom Will Be Barred from Sharing Health Data for Advertising Under Proposed FTC Order. https://www.ftc.gov/news-events/news/press-releases/2023/05/ovulation-tracking-app-premom-will-be-barred-sharing-health-data-advertising-under-proposed-ftc
4. Federal Trade Commission. (2023). FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising, Requiring It to Pay $7.8 Million. https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising
5. Norwegian Consumer Council (Forbrukerrådet). (2020). Out of Control: How Consumers Are Exploited by the Online Advertising Industry. https://consumerfed.org/press_release/popular-dating-health-apps-violate-privacy/