Is a period tracker safe to use
in the US?

3 min read · checked against its sources · updated 18 Oct 2026

It can be, but it depends on the app. In the US, no single federal law protects period data the way it protects a medical record. What protects you is the app's own privacy promises, a few state laws, and the FTC stepping in when a company breaks its word. The safest setup is an app that never collects your data in the first place.

Does HIPAA cover period apps?

Usually not. HIPAA applies to doctors, health plans and the companies that work for them. The Department of Health and Human Services says that when a person downloads a health app on her own and uses it to manage her own information, the developer is generally not covered, even if she later shows a report to her doctor.

So the note you type into a tracker is often not "medical record" data in the legal sense. The FTC Act still applies to these companies, which brings us to the next part.

What has the FTC done?

The FTC has acted when apps promised privacy and then did something else.

In the Flo Health case, the FTC said the app told users their health details would stay private but shared them with outside marketing and analytics services, including Facebook's and Google's analytics divisions. The final order in June 2021 required Flo to get user consent before sharing health data and to tell any third party that received it to destroy it.

In 2023, the maker of the Premom ovulation app agreed to a $100,000 civil penalty and a permanent ban on sharing personal health data with third parties for advertising. The FTC said it had also disclosed data to AppsFlyer and Google.

The lesson is not that every app does this. It is that the rule you rely on is "don't break your own promise", and that is only enforced after the fact.

What do state laws add?

A few states have gone further. Washington's My Health My Data Act covers consumer health data outside HIPAA. Selling that data requires the person's signed authorization, people can ask for their data to be deleted, and a violation can be enforced by the attorney general and through private lawsuits.

The state's own guidance does not name period trackers, though it says apps that track body functions collect consumer health data. Laws differ by state and change, so check your own state's rules if this matters to you.

What actually makes an app safer?

Law sets the floor. Design decides how much there is to leak.

Also keep a passcode on your phone. On-device storage is only as private as the phone.

Where Tideline fits

Tideline keeps your entries on your phone. There is no account and no server, no ads or tracking, a free export and a one-tap delete. It reads period dates from Apple Health read-only, and speech-to-text for the spoken sentence runs on the device. That is a design choice, not a legal promise to rely on. For more on this, see private period tracker, no account, and if you are leaving a specific app, Flo alternative for PMDD and privacy.

Whatever you pick, avoid logging anything you would hate to see shared, and read the policy once before you start.

Keep the record your doctor needs. Tideline is a period and mood tracker for iPhone: write one sentence a day, and after two cycles it puts the week before your period next to the week after it starts. Free to track, no account.
Get Tideline on the App Store

Keep reading

Sources

© 2026 Ben Jonas Goedeke · Tideline keeps a record. It does not diagnose, treat or prevent any condition.