Maya Period, Fertility, Ovulation, & Pregnancy

Things your privacy researchers really don't like about Maya's period and fertility tracking app. One, they bury their privacy policy in their Terms of Service doc, making it really hard for an average person to find. Boo! Two, consent to use your personal information for the all the purposes they want seems to comes when you visit the platform and/or provide your information. Users might not realize they've given consent simply by doing those things. And there there is this gem mentioned in their privacy policy that raises eyebrows when it comes to consent, "You acknowledge and agree that even if You are not a registered User with Us, We may collect information about You, if a registered User has provided Us with Your information to facilitate services." Yuck!

Three, while they do say they won't share personal information about identifiable individuals to advertisers, they do say they do say they can share aggregate and/or anonymised information "to help advertisers reach the kind of audience they want to target" And they make use information the collect on you "to comply with our advertisers’ wishes by displaying their advertisement to that target audience." Maya goes on to say they can share users' information with sponsors, and/or business partners to send "newsletters, offers, information about new services, and other information." So, your information is potentially being shared with a fair amount of third parties and advertisers to reach you with more offers and even targeted ads. That's not so great.

Four, we also ding Maya because they don't mention any data retention details in their privacy policy. They do say users can delete their information from the app though, so if you use this app, maybe sure you reach out them and ask them to delete all your personal information. We're not sure they would do so otherwise.

All this is bad, but it's not the worst. The worst is yet to come!

Maya doesn't meet our Minimum Security Standards for a couple of reasons. First, they allow the super duper weak password of "1" to login to their app. Very bad form. And two, because we just couldn't tell if they do things like use strong encryption and have a way to manage security vulnerabilities.

But really, the worst thing Maya has done when it comes to protecting and respecting their user's privacy is when Privacy International discovered in 2019 that they were sharing some VERY personal information of their users with Facebook. BuzzFeed News reported Privacy International found Maya shared user data such as when a user last had sex, their use of contraception, the timing of their periods, their moods, and what symptoms they had such as cramping and swelling. Ick! Uhg! Bad! The report also found some data was being shared with Facebook even before a user had the change to agree to the app's privacy policy. When called out about sharing all this data, Maya responded by pointing out they it doesn't share any personally identifiable data with Facebook. Yeah, no. This is data that should never be shared with Facebook, ever. It also seems like data that wouldn't be super hard to re-identify.

Given all these knocks against Maya — they collect a metric ton of very personal information, they share that information with lots of places, they don't tell users how long they can retain that information, they only require a very weak password of "1" and don't meet our Minimum Security Standards, and they have a pretty bad track record of protecting their user's personal information, we'd say there is a whole lot that could go wrong if you use this app to track your periods and fertilizing. We have to say, Maya almost certainly comes with *Privacy Not Included.