--- title: "A cycle app that doesn't sell your data: how do you actually know?" description: "Every app promises 'privacy'. But what should you look for in a privacy policy to check if it's really true? 6 concrete things to watch." url: https://myperiod.app/en/blog/cyclus-app-zonder-data-verkopen lang: en date: 2026-06-30 publisher: PERIOD. B.V., Amsterdam --- [Back to blog](https://myperiod.app/blog) [Privacy & PERIOD.](https://myperiod.app/blog/categorie/privacy) · 6 min read # A cycle app that doesn't sell your data: how do you actually know? [Lees dit artikel in het Nederlands](https://myperiod.app/blog/cyclus-app-zonder-data-verkopen) PERIOD. team · June 30, 2026 ***A note up front:** this article compares publicly available information at the time of writing. We are the makers of PERIOD. and have no commercial relationship with the other apps discussed. All factual claims are based on those apps' own privacy policies and reporting by independent sources (incl. the FTC, Mozilla "Privacy Not Included", the Norwegian Consumer Council, Washington Post, TechCrunch). Privacy policies and features can change, always verify the current version with the provider. Spotted a factual error? Email [hi@myperiod.app](mailto:hi@myperiod.app) and we'll correct it.* A cycle app that truly protects your privacy is defined by its refusal to share data with third parties, strong encryption in transit and at rest, and strict access controls so only the user can read their own health information. To verify these claims, users must look beyond marketing slogans and check for the absence of tracking SDKs, the data location, and clear legal commitments against data monetization. Most period trackers on the market are built on a "free" model, which often means your intimate biological data is the product being sold. Since the overturning of Roe v. Wade in the US, the conversation around reproductive data privacy has moved from a niche concern to a critical requirement. However, reading a 40-page privacy policy is a daunting task. To distinguish between genuine privacy and "privacy washing," you need to know exactly where to look. ## 1. Data Location and Governance Where your data is physically stored matters because it determines which laws apply to your information. Many popular cycle apps are based in the United States, where data can be subpoenaed by law enforcement or sold to brokers with limited oversight. If an app is based in the European Union, it must comply with the General Data Protection Regulation (GDPR), which is currently the strictest privacy framework in the world. However, simply being "GDPR compliant" is the bare minimum. You should check if the company stores your data on servers they control or within encrypted cloud environments in regions with strong legal protections. At PERIOD. we operate from Amsterdam and your cycle data stays on EU servers under GDPR; AI requests are processed by Google under SCCs and the EU, U.S. Data Privacy Framework. You can read more about our specific approach on our **[privacy page](https://myperiod.app/privacy)**. ## 2. The Presence of Third-Party Trackers One of the quietest ways your data leaks is through Software Development Kits (SDKs). These are pre-packaged bits of code from companies like Meta (Facebook) or Google that app developers use to track user behavior or run ads. Even if an app says they don't "sell" your data, these SDKs might be constantly sending "signals" back to big tech companies about when you open the app or what features you use. To verify this, you can use tools like Exodus Privacy to see which trackers are embedded in an app. A truly privacy-first app will have zero trackers from ad-tech giants. If you see "Facebook Analytics" or "Google Firebase" in a health app's report, your usage patterns are likely being used to build a profile for targeted advertising. ## 3. Advertising as a Business Model If an app is free and displays third-party advertisements, it is impossible for it to be truly privacy-first. Displaying ads requires a feedback loop where the advertiser needs to know if the ad was shown to the right person. This often involves sharing a "Unique Device Identifier" (IDFA or AAID) with the ad network. When your cycle data is connected, even indirectly, to an advertising ID, companies can infer your pregnancy status, mood swings, or health conditions to serve you "relevant" products. PERIOD. follows a subscription-based model because it is the only way to ensure the user is the customer, not the product. We do not show ads, and we do not participate in the ad-tech ecosystem. Learn more about our philosophy on our **[about page](https://myperiod.app/over)**. ## 4. Data Monetization in the Terms and Conditions You need to look for specific language in the Terms of Service. Many apps use "de-identified" or "aggregated" data as a loophole. They claim that because your name isn't attached to the data, it's safe to sell to research firms or pharmaceutical companies. However, studies have repeatedly shown that "anonymized" health data can often be re-identified with just a few data points. Look for a clear, legally binding statement that says: "We do not sell, trade, or rent your personal or health data to third parties." If the terms are vague or mention "sharing data with partners for research purposes" without an explicit opt-in, your data is likely being monetized. ## 5. Encryption and Access Controls At a minimum, a serious app encrypts your data in transit (TLS/HTTPS) and at rest on the server (typically AES-256). On top of that, access controls determine who can read your rows. PERIOD. uses Row-Level Security on its EU-hosted database: only you, signed in to your account, can fetch your own data. No other user and no third party has access. The gold standard goes one step further: end-to-end encryption (E2EE), where the key lives only on your device and even the app's developers cannot read your data. PERIOD. does not implement full E2EE today, we are honest about that and are researching it for the future. What you get today is EU jurisdiction, encryption in transit and at rest, no ad-tech trackers, and strict access controls. You can read more in our **[blog post on privacy at PERIOD](https://myperiod.app/blog/privacy-period-vs-andere-cyclus-apps)**. ## 6. The Right to Complete Erasure A "delete account" button doesn't always mean your data is gone from the company's backups or their partners' databases. A transparent app should clearly outline its data retention policy and provide an easy way to trigger the "right to be forgotten." - The process should be transparent, time-bound, and complete. - It should include the removal of data from all backup systems. - There should be no requirement to email a support desk to "request" deletion; it should be a self-service feature. > "If you aren't paying for the product, you are the product. In the world of cycle tracking, that means your most intimate biological rhythms are being auctioned off to the highest bidder." ## How PERIOD. Scores on the Privacy Check We built PERIOD. because we were tired of the "pink-tax" on privacy. Here is how we measure up against the criteria above: - **Location:** Amsterdam, The Netherlands (EU). - **Trackers:** 0 third-party trackers. No Meta, no Google, no hidden SDKs. - **Ads:** None. Ever. - **Data Sharing:** We do not sell, rent or share your personal data with any third party for marketing. - **Encryption:** Encrypted in transit (TLS) and at rest (AES-256) on EU servers (Frankfurt), with Row-Level Security so only your account can read your data. - **Deletion:** One-tap in-app deletion. Live data removed within 30 days; backups rotate and purge within an additional 14 days. Tracking your symptoms can be a vital part of understanding your health, but it shouldn't come at the cost of your digital autonomy. By choosing tools that prioritize encryption over engagement metrics, you reclaim control over your personal history. *Disclaimer: This is not medical advice, if you have concerns about your hormonal health or persistent symptoms, please consult your GP.* Experience the security of a cycle tracker that puts your data in your hands and nowhere else. Want to understand your cycle better? ## Keep reading [Best period tracker app for privacy in 2026: 6 questions that decide itWhich cycle app is safest for your data? Six questions to test any app in two minutes, plus how Flo, Clue, Natural Cycles and PERIOD. compare.Read more](https://myperiod.app/blog/best-period-tracker-app-privacy-2026)[Is PERIOD. free? What the app really costs (and what it does not)Short answer: yes. Tracking your cycle, predictions and reminders cost nothing. Plus and baby are extras. Here is exactly what is what, no fine print.Read more](https://myperiod.app/en/blog/is-period-gratis-wat-kost-de-app)[Does my period app sell my data? How to check in 5 minutesShort answer: you cannot tell from the app itself, but you can from the privacy policy and the trackers. Five checks you can do yourself, on any cycle app, including ours.Read more](https://myperiod.app/en/blog/verkoopt-mijn-menstruatie-app-mijn-data-checklist)