Privacy Review: Flo

Mostly. Out of the box, Flo asks you to agree to two things before you can use it: processing your health data to run the app, and the standard privacy policy and terms of use. A third option—sharing basic app and device data with Flo’s ad and analytics partners—is optional.

That last question is worth paying attention to. In our testing, saying yes meant that Flo pulled in companies like AppsFlyer, Moloco, and Google’s Firebase service, who were each sent their own mix of encrypted information related to app downloads. Turn tracking off, and those systems mostly vanished from our testing—meaning that privacy toggle was doing exactly what it promised. For period-tracking apps in particular, that kind of follow-through is worth a mention.

A spokesperson for Flo emphasized that Flo does not share health data or detailed in app navigational screen-by-screen browsing behaviors.

A lot. Flo is designed to learn as much about you as possible, and it gives you plenty of opportunities to share. During testing, the app prompted us for information about:

• mood swings
• aches and pains
• skin flare-ups
• changes in sex drive
• fertility goals
• ...and what felt like an endless stream of other physical and emotional changes tied to different stages of our cycle.

The app also offers optional check-ins, framed as chat-style conversations, meant to help you “figure out what might be going on” behind different symptoms you’ve logged that day. These chats, naturally, also nudge you for details.

For example, when we logged that we’d been experiencing cramps that day, the AI chatbot followed up with a new cascade of questions: how intense were these cramps, exactly? Did it feel like a dull ache or a sharp pain? Were painkillers helping at all? Each answer usually led to more follow-ups, along with tailored responses the app says are reviewed by their in-house healthcare professionals.

To its credit, Flo is pretty upfront about what it’s collecting and why, both in those chat-style check-ins and across the app more broadly. According to the app, the more users log, the more personalized—and supposedly more accurate—its predictions, insights, and recommendations become over time.

Flo has one of the most extensive privacy rap sheets in the period-tracking space. Much of the early scrutiny came from a 2019 Wall Street Journal investigation, which found that several health apps, including Flo, were sending sensitive in-app activity data to Facebook via embedded analytics tools.

The Federal Trade Commission would later echo this report in bringing its case against Flo in 2021 over similar concerns about the alleged mismanagement of people’s health data. The case settled later that year.

More recently, the company agreed to pay an $8 million dollar settlement as part of a 2025 case alleging that sensitive data was flowing from the app through advertising and analytics systems tied to companies like Google and Facebook without users being adequately informed or giving meaningful consent.

“Since 2019, Flo has made significant investments to strengthen its privacy and security program,” said a Flo spokesperson in response to our inquiry on the settlement.

Privacy International also ran its own analysis of Flo’s data-sharing practices, which found underlying data flows and structural scaffolding matching much of what we saw in our testing.

Flo's privacy policy has gone through several substantial rewrites. According to snapshots tracked by Berkman Klein, the 2018 version named Facebook Analytics and Google Analytics as recipients; by 2019, both were gone, replaced with "we will never share your health data" language, right as WSJ’s reporting on Flo and Facebook broke.

After the FTC's 2021 settlement, Flo added a GDPR-style legal-basis table, a named-processor list, a "no sale of personal data" pledge, and a promise that "even your employer" won't find out what you log. By April 2026, the policy had grown again, naming TikTok Ad Manager and Firebase as advertising partners, disclosing new wellness and telehealth partnerships, and splitting off dedicated U.S. state and Consumer Health Data notices.

Flo does not share user health data with advertising partners, and there is no indication that Flo sells user data.

A nuance worth flagging: Flo might be a maximalist on collecting your data, but it’s pretty minimal on sharing. None of the health data we gave to Flo as part of our initial tests was shared with its analytics or marketing partners. Our testing showed one third party in the ads space—Appsflyer—getting pinged when we first launched the app, with or without tracking allowed.

Most of what it received was encrypted: an opaque binary blob we couldn't open, sent on every launch we saw in our tests. When we denied tracking, AppsFlyer also received our IDFV—an Apple-specific identifier for our device. unhashed, in plaintext.

Flo, to its credit, does offer heightened privacy settings under what it calls "Anonymous Mode." Once it's on, things change. AppsFlyer goes quiet—not a single request for the rest of our session. Flo's own traffic stops going straight to its servers and starts routing through a Cloudflare relay, so Flo receives your data without seeing the IP address it came from.

The catch is timing. We turned it on six minutes into our session. AppsFlyer had our device's IDFV, in plaintext, before that.

Compared to some of the other period-tracking apps we tested, Flo felt noticeably more careful about sending reproductive-health data into the broader tracking ecosystem.

There’s still a fairly extensive analytics and attribution stack running behind the scenes, but we didn’t see any of those parties getting details like symptom logs, fertility predictions, pregnancy information, or cycle classifications. Flo also gives users more meaningful privacy controls than many consumer apps. Instead of collapsing everything into one giant “agree” button, the app lets users manage certain analytics and advertising systems company by company.

It also explains, in unusually plain language for the average app, what tools like AppsFlyer or Firebase are doing with the data they collect, and what kinds of information Flo says remain internal. There’s even an optional PIN lock if you want an extra barrier between your reproductive-health data and anyone who picks up your phone. Flo also lets you revisit and adjust those controls whenever you want.

Flo being more careful about sharing reproductive-health data isn’t the same thing as Flo collecting less of it.

At its core, the app only works by building and maintaining a deeply detailed long-term model of your reproductive health over time. And while most of that modeling appeared to stay inside Flo’s own systems instead of getting piped straight into advertising platforms, the app still sits inside a much larger web of analytics, tracking, and attribution systems than its branding initially lets on.

The line between “internal health insights” and outside analytics systems can get thin pretty quickly.

Our testing showed that Flo already turns extremely granular reproductive-health information into highly structured, machine-readable categories behind the scenes to power its prediction and personalization features. We might not have seen those classifications being sent outside the app now, but the way Flo structured its datasets would make that kind of sharing a lot easier if Flo ever had a change of heart down the line.

• Say no to app tracking. When we did, we found that Flo would pull far less fewer advertising, measurement, and monetization machinery into the mix.
  
• Revisit Flo’s privacy settings after setup. Flo gives users more privacy controls than many apps in this space, so it’s worth spending a few minutes reviewing them every so often. Limiting optiq aonal analytics, advertising, or personalization settings can help reduce how much long-term behavioral data gets tied to your account over time.
  
• Be selective about what you log. Flo becomes more personalized as you feed it more information, but that also means the app gradually builds a deeply detailed long-term profile of your reproductive health and habits. If certain categories, like sexual activity or medication use, feel especially sensitive, consider keeping some of that information out of the app.
  
• Use Flo’s PIN lock. If you share devices, travel frequently, or just don’t want someone casually opening the app on your phone, the optional PIN can help keep your reproductive-health information a little more private.

Of all the cycle trackers we tested, Flo might be the one that surprised us most. We went in expecting to find the usual mess: health data flowing freely into ad systems, device identifiers lighting up across a dozen third-party trackers. What we found instead was a company that did the work to keep its reproductive-health modeling contained. In this category, that’s not something you should take for granted.

But that doesn’t mean there aren’t different kinds of privacy tradeoffs. With Flo, the bigger question isn’t just whether data gets shared at all, but how much one company is designed to know about you, and for how long.