--- title: "Period tracker privacy: what to check" description: "A simple checklist for period tracker privacy: storage, sharing, analytics, deletion, phone access, and the questions to ask Ruva." url: "https://myruva.co/learn/period-tracker-privacy-what-to-check" language: "en-GB" topic: "Getting started" published: "2026-10-18" updated: "2026-10-24" author: "Ruva team" reading_minutes: 6 --- # Period tracker privacy: what to check A simple checklist for period tracker privacy: storage, sharing, analytics, deletion, phone access, and the questions to ask Ruva. *Written and reviewed by the Ruva team · Updated 2026-10-24 · Getting started* Before you enter a period date, open the app's privacy information. Check what it collects, where the information goes and how you can stop using the service. Look for [clear explanations of why data is used, how long it is kept and who it is shared with](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-urges-all-app-developers-to-prioritise-privacy/). Use these questions with any cycle tracking app before you add personal health information. If an answer isn't clear, write that down and ask the provider. ## Read the policy as well as the store label Find the policy linked from the app's own store listing or settings. Check which company and product it covers, its date, and who to contact about privacy. Look for what it collects, who receives it, how long it is kept and what choices you have. Write each answer in plain words. If all you can copy is “we value your privacy”, keep looking. The [ICO calls for short, easy-to-read privacy information](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-urges-all-app-developers-to-prioritise-privacy/). If the wording is vague, ask the provider to explain it before you rely on it. For example: “Does turning off backup remove an existing cloud copy, or only stop future backups?” App store privacy or data-safety labels can help before you download. The [ICO says these labels help with transparency, but inconsistent wording can confuse people](https://ico.org.uk/media2/migrated/4021036/dcms-call-for-views-response-app-security-and-privacy-interventions-20220627.pdf). Compare the label with the full policy. Look for matching answers about health information, identifiers and sharing. If they differ, ask which one covers the version and features you plan to use. ## Choose what to record Start with what you plan to type, such as period dates, flow or personal notes. Then check what comes from your device or connected services. Ask about device identifiers, location, and access to contacts or photos. Find out which items are required and which you can leave out. The FTC recommends [limiting collection and permissions to what an app needs](https://www.ftc.gov/business-guidance/resources/mobile-health-app-developers-ftc-best-practices). Decide how much you want to record. [Getting started with cycle tracking](https://myruva.co/learn/getting-started-with-cycle-tracking) can help you choose. ## Trace phone, cloud and backup copies Ask whether your entries stay in a database on your phone, go to the provider's servers, or are kept in both places. Ask what changes if you turn on backup or connect another service. Also check whether your phone's own backups include the app's data. The [FTC advises developers to understand where data goes](https://www.ftc.gov/business-guidance/resources/mobile-health-app-developers-ftc-best-practices), including their duties for cloud storage. Ask which copies the provider's explanations cover. Ask for separate details on how data is protected on the phone, while it is sent and in any cloud copy. A screen lock does not answer all three questions. ## Check how sign-in works Does basic logging need an email address, phone number or linked account? If you can use the app without an account, ask what identifier it uses instead. Also ask how you get back in if you change phones. Health information combined with [mobile identifiers can identify someone without a name](https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0). Ask what “anonymous” really means in the way the app is built. ## Identify recipients and embedded software Look for named recipients, or groups such as hosting providers, analytics services and advertisers. Ask what each one receives and why. Check whether optional sharing starts switched off, and what happens if you say no. Even if the provider says it doesn't sell information, check who it shares data with and why. The [ICO calls for explanations of who data is shared with](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-urges-all-app-developers-to-prioritise-privacy/). Ask about advertising and about running the service as two separate questions. An SDK (software development kit) is software a developer can build into an app. [Embedded SDKs can support analytics or functions such as logins](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-pecr-rules/). To do this, they may store or access information on your device. Ask which SDKs the app uses, what they send and to whom. Does analytics record only a technical event, or could it include what you wrote in an entry? Can you turn off optional analytics and still keep your record? Check each tool on its own. Knowing that an SDK is there doesn't tell you what it collects. ## Check export and deletion separately - Export: ask which entries are included, what file format you get and whether you can pick a date range. For an appointment, decide what to share before you create the file. [Preparing healthcare appointment notes](https://myruva.co/learn/preparing-notes-for-a-healthcare-appointment) can help you pick the details that matter. - Deletion: ask how to remove single entries or the whole record, and whether you need to close an account. Ask what happens to backups and to copies you already shared. Ask how long it takes and whether there are any exceptions. The [ICO says apps should explain how long they keep data](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-urges-all-app-developers-to-prioritise-privacy/). The [FTC recommends planning for account closure](https://www.ftc.gov/business-guidance/resources/mobile-health-app-developers-ftc-best-practices). Don't assume that uninstalling the app is the same as deleting your data. Check which export and removal options the app offers. ## Protect access on your phone Could someone using your phone open the app, read its notifications or find exported files? Ask about a separate app lock, notification previews and what happens if you lose your phone. If there is an account, find out how to remove access from the missing phone. The [UK regulators' mobile app safety guide](https://ico.org.uk/media2/migrated/2346/apps-consumer-guide.pdf) recommends protecting your phone with a password and keeping apps updated. Review the settings on the phone you use, especially if you share it. Do this even if you trust the provider's data practices. Don't test privacy controls with information you wouldn't want others to see. ## Choose what a partner can see If the app offers sharing, ask exactly what it includes: a chosen summary, past entries or future updates. Can you preview it? Can you stop access without deleting your own record? Ask what happens to information your partner already received once sharing ends. Before you send the invite, talk about what you want to share. That includes whether to give access to your whole record. The [FTC recommends private defaults for optional social sharing](https://www.ftc.gov/business-guidance/resources/mobile-health-app-developers-ftc-best-practices). ## Read health-data law claims carefully Don't assume a consumer tracker has the same HIPAA protection as your doctor's records. The [FTC's mobile health app tool](https://www.ftc.gov/business-guidance/resources/mobile-health-apps-interactive-tool) explains this. HIPAA likely doesn't apply to health information in consumer apps, unless the app is offered by a covered healthcare entity or its business associate. The [FTC's Health Breach Notification Rule guidance](https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0) explains when covered organisations must tell people about a breach. This applies to unsecured health information that can identify someone. A breach can mean unauthorised sharing, not only hacking. This is general background. It doesn't decide which laws apply to an app or to you. Ask how the provider would tell you about an incident. ## Apply the same checks to Ruva Ruva works in your browser and on Android now, and its iPhone app is coming soon. Your entries stay in a local database on your device (in the web app, that's your browser), and you don't need an account. With a linked account, sync keeps your record up to date on all your devices. Without one, cloud backup keeps a copy that you send by tapping Back up now. To link an account, you can choose a Google account on Android or the web, Sign in with Apple on iOS, or an account with your email address. With Google or Apple, Ruva receives only the email address, so it can recognise the account. With an email account, your name is used only in emails about your account, and Ruva never receives your password. Your cycle data isn't shared with Google or Apple. The partner summary is optional and uses an anonymous ID with no name or email attached. It holds only the name you enter and the short lines you choose, and the person you share it with can't see your ID. The Community is optional too. To join it, you link a Google, Apple or email account, and other members see only your display name. There are no ads, every feature is free, and Ruva doesn't sell data. It uses Google Analytics for Firebase, with advertising switched off, to see how the app is used, and counts health-related screens itself so they never reach Google. You can switch it off. You can download everything at any time, and delete everything. The download comes as two files. The JSON file can be restored into Ruva on another device, without an account. The CSV file is for spreadsheets. Ruva's [Privacy Policy](https://myruva.co/privacy) is now published. Check its answers against the same list. Look closely at service providers, how long data is kept and what happens to cloud copies after deletion. [Account and data deletion](https://myruva.co/delete-account) explains exactly what each deletion step removes. To see how some widely used trackers answer these questions, with a source for each answer, read [how Ruva compares with other apps](https://myruva.co/compare). ## Quick answers ### Are period tracking apps safe? There is no single answer for every app. Check its published data practices, its settings and the protection on your phone. Find out what leaves your phone and who receives it. A privacy label alone does not answer all of that. ### What data do period apps collect? Check what you type in, what the app collects from your device and what it gets from connected services. Look at each one on its own. Ask about period records and notes, and also about identifiers, permissions and analytics. Don't assume every app collects the same things. ### Does deleting a period app delete my data? Removing an app may not remove every copy of your information. Check the provider's deletion process. Ask what happens to any account, backups and information you already shared, and how long removal takes. ## Sources 1. [ICO urges all app developers to prioritise privacy](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-urges-all-app-developers-to-prioritise-privacy/), Information Commissioner's Office 2. [Mobile Health App Developers: FTC Best Practices](https://www.ftc.gov/business-guidance/resources/mobile-health-app-developers-ftc-best-practices), Federal Trade Commission 3. [What are the PECR rules?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-pecr-rules/), Information Commissioner's Office 4. [Response of the Information Commissioner’s Office to the DCMS call for views on app security and privacy interventions](https://ico.org.uk/media2/migrated/4021036/dcms-call-for-views-response-app-security-and-privacy-interventions-20220627.pdf), Information Commissioner's Office 5. [Using apps safely and securely on your mobile](https://ico.org.uk/media2/migrated/2346/apps-consumer-guide.pdf), Ofcom, in association with the ICO and other UK regulators 6. [Mobile Health App Interactive Tool](https://www.ftc.gov/business-guidance/resources/mobile-health-apps-interactive-tool), Federal Trade Commission 7. [Complying with FTC’s Health Breach Notification Rule](https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0), Federal Trade Commission --- This guide is general information to help you keep and use your own records. It isn’t medical advice. If you’re worried about a symptom, or something changes suddenly, talk to a doctor, nurse or pharmacist.