Flo Ovulation & Period Tracker

There's good news and bad news when it comes to Flo. Let's start with the bad news, because that's probably why you're here. Flo has a spotty track record of protecting their user's very sensitive personal information. Which is very bad for a app that collects and tracks so much sensitive personal information.

Here's what happened. Back in 2019 the Wall Street Journal reported that Flo was sharing data with Facebook that included health data like when a person started their period. This prompted a review by the FTC who found that "despite express privacy claims, the company (Flo) took control of users’ sensitive fertility data and shared it with third parties." This resulted in the FTC and Flo agreeing to a settlement in 2021 that required Flo Health " to obtain the affirmative consent of users of the company’s fertility-tracking app before sharing their personal health information with others and to obtain an independent review of their privacy practices". So, the bad news is, Flo got caught misleading their users and sharing data they had promised they wouldn't (although the never admitted wrongdoing in the settlement). That's really bad. The good news is, after they got busted and settled with the FTC, they were forced to (hopefully) clean up their act and do better. So are they doing better? Well, again, hopefully.

They do say in their privacy policy they can collect a whole heap of personal and usage data. Things like, name, email address, birth data, location, weight, body temperature, dates of your menstrual cycle, pregnancy details, sexual activity, symptoms, moods, and how often you use the app, your mobile service provider, unique device identifiers, and more. That's a LOT of information to trust Flo with. Which, you know, they've not been so trustworthy in the past, although now they've got the FTC keeping a bit more of an eye on them.

What does Flo say they can do with all that data, according to their privacy policy? They do say they won't sell your data, so that's good. And they do ask for your consent to use your data as laid out in the privacy policy when you set up the app, so pay close attention to what you are consenting to! Because they say with your consent they can use your personal information for things like customizing the app, making recommendations to you for other product offers, including third-party products, and for Flo promotional purposes. Flo also says that consent means they can share some of your non-health personal information with third-party marketing platform AppsFlyer for marketing and promotional purposes on third-party platforms like Facebook, Google, Pinterest, Snapchat, Twitter, and more.

Good news though. Flo recently announced the launch of an "Anonymous Mode," which is a free features that allows people to "use the service without any personally identifiable information, such as a name, email address, and technical identifier being associated with the account." We like that for sure! See, we told you there was both good and bad news when it comes to Flo.

Flo collects a whole lot of personal information, shares some of that with third-parties for marketing and promotional purposes, and has a track record of not being completely honest about how they share their data. So far, not great. They also say they can gather more information about your from third-party sources, "We may receive Personal Data about you from third parties. For example, we may obtain information from third parties, to enhance or supplement existing user information…" Does this mean they could buy data from data brokers to learn more about your and build a bigger profile on you? Perhaps. Flo has told us that they currently do not buy or sell data to data brokers (yay!). However, the way their privacy policy is written seems like they could in the future if something were to change inside the company. Flo also says they "aggregate, anonymize or de-identify your Personal Data so that it cannot reasonably be used to identify you. Such data is no longer Personal Data. We may share such data with our partners or research institutions or use for statistical purposes…" This is fairly common, but now is a good time to remind you that it has been found to be pretty easy to re-identify this sort of data, especially when location data is included.

And back to that whole Flo honesty problem. When we were reading the data safety information they shared on their Google Play store app page, we noticed they self-declared they say they don't share data with other companies or organizations. Which, as we've just outlined above, just isn't true. Unfortunately, Google's data safety sharing information rules are pretty terrible because they say developers don't actually need to say they are sharing data with third parties even if they are if consent is obtained. This is terribly misleading on all parts and we wish both Flo and Google would do better for consumers. Bottom line, please don't trust the self-reported data safety information you find on the Google Play store. It's better (and also awful) to read the app's privacy policy instead. If you need some tips to do that, well, here's a good article to help (even better, read our *Privacy Not Included reviews!).

How does Flo say they will handle requests from law enforcement to obtain their users' information? Their privacy policy says, "We may also share some of your Personal Data … in response to subpoenas, court orders or legal processes, to the extent permitted and as restricted by law (including to meet national security or law enforcement requirements)." Which is a bit vague. However, Flo shared with us this public statement they made to clarify what this means. And it's actually pretty good -- they say they require a legally valid request, will work to limit the scope of any data they are required to share, and will do their best to notify the user if their data is requested by law enforcement. Good work Flo.

So, what's the worst that could happen with Flo? Well, you could trust a company with a spotty track record to keep all that personal information you share with them private, safe, and secure. It's possible, although hopefully it doesn't happen, that they could leak or share data about your period or pregnancy that gets scooped up by people you don't want to have it and used against you. Which is really scary in the post-Roe vs Wade world we live in these days. Hopefully this never, ever happens. And hopefully all that data they collect and store on you to train up their AI algorithms is stored securely and never leaked. And hopefully Flo doesn't give your user data to law enforcement unless absolutely necessary, and then, hopefully they only give the bare minimum (which is what they say they will do, thank goodness). These are a lot of hopefullys. Maybe it's better to just not share so much personal info to begin with.