Privacy Review: Spot On

Mostly, yes, but there’s some important context. If you’re just using Spot On for the basics, like tracking your cycle, logging symptoms, and setting birth control reminders, everything stays within the app. From our testing, nothing about the default setup for these features jumps out as a red flag: basic privacy protections are in place from the jump.

When we used the app on its own, we didn’t see it sharing data with other companies or trying to track us across visits. Beyond what you enter, the app collects basic technical data in the background.

Spot On hasn’t been at the center of the kind of major privacy scandals that have hit other apps in this category. Planned Parenthood, which develops Spot On, has faced scrutiny over its broader digital tools in the past. A 2021 investigation from The Markup found

Planned Parenthood’s website running more than two dozen different ad trackers when users visited. The next year, The Washington Post reported that Planned Parenthood’s website shared appointment-search details with companies like Google and TikTok. Planned Parenthood later said it had suspended tracking on the pages named in the report.

Notably, the privacy notice covering Spot On—governed by Planned Parenthood Direct's privacy notice, not a policy of its own—was last revised in April 2024. That's nearly two years after the Markup and Guardian investigations. And according to Berkman Klein's snapshots of said policy, it hasn't changed since.

Planned Parenthood did not respond to a request for comment.

When we used the app on its own, we didn’t see it sharing data with other companies or tracking users across visits. Activity mostly stayed within the app.

In our testing, we didn’t see obvious signs that Spot On is selling user data, like the ad-tech or data broker pipelines that often signal that kind of activity.

You can use Spot On without creating a full account, which already puts it ahead of a lot of apps in this category. That’s a meaningful privacy win, particularly in a space where apps often ask for personal information upfront.

Features like the provider finder or Roo send users to Planned Parenthood’s website via an in-app browser where the site’s third-party tracking comes along too. In the provider-finder flow, for example, we consistently saw search details, like our city and the type of care we were looking for, sent to AB Tasty, a web analytics and personalization company. That included searches for health services that most users would expect to stay private, like HIV testing or gender-affirming care.

In searches for abortion providers, AB Tasty received all of those self-reported details, plus two more: our age and the date of our last menstrual period.

We saw more trackers from other companies, roughly half a dozen, to be precise, activate when we opened Roo’s webpage through the app. Google, Microsoft, TikTok, and Pinterest were among the names that showed up during those interactions. What we didn’t see, more importantly, was the sensitive data leakage we described earlier. The data Roo shared was more or less contextual: whether the visitor appeared to be using iOS or Android, what language the page loaded in, the timestamp of their visit, and the like.

Those transmissions were also tied to identifiers for the visit, meaning a company like TikTok could potentially use someone’s Roo visit for ad targeting later, even if it doesn’t know the questions they asked.

From what we found, Spot On doesn’t give users a clear way to turn off the tracking that happens inside the in-app browser. Once those Planned Parenthood pages load, the tracking runs automatically.

If you’re going to use Spot On, a few simple steps can help keep more of your data contained:

• Stick to the app’s core features. In our testing, things like cycle tracking, symptom logging, and reminders stayed within the app.
• Be intentional about how you search for care or ask questions. Those specific web pages can inadvertently pass along sensitive information about your cycle and the reproductive health services you might be trying to find.
• Use a separate browser for sensitive searches. It’s not a silver bullet, but you can limit the data that these pages collect by using a mobile browser designed with privacy in mind, like Safari or DuckDuckGo.
• Return to the app once you’re done. The tracking we observed happens on those external pages, not during normal in-app use.

At most, Spot On collects what you give it, and some traceable identifiers. That's the case for just about every app you'll use. And Spot On's in-app browser loads Planned Parenthood's site just as any browser would, third-party trackers and all.

But Spot On isn't a shopping app, and Planned Parenthood isn't a shoe retailer. People who use these services reasonably hold the bar for discretion a bit higher than the average web-surfer. An app can clear that bar better than most and still prove that the smallest data, in the wrong context, is enough. That doesn’t mean you need to stop using Spot On if it’s part of your routine. Instead, be intentional: stick to the core logging features, keep the web out of the experience when you can, and use an anti-tracking browser when you can’t.