Cycle app privacy: where your data actually lives

A cycle app knows when you have your period. Which means it also knows when you don't. It knows if you're trying to get pregnant, whether it worked, and sometimes, whether the pregnancy didn't continue. It knows when you had sex, if you log it, and how you feel on which days. Hardly anything you type into a phone is this intimate. And yet very few people read where that data actually goes. This article will help you ask the right questions.

Why cycle data is different from other data

Legally, it's health data. The General Data Protection Regulation (GDPR) places it under special protection in Article 9, alongside data about religion, sex life, or ethnic origin. An app may only process it with your explicit consent, and it may not use it for purposes you haven't agreed to.

In practice, it's valuable. Whoever knows a woman is pregnant knows she'll be spending a lot of money over the next two years, and knows it months before anyone else does. That's why cycle and pregnancy data is especially attractive to advertising networks, and why several major providers have run into trouble in recent years for sending app data to Facebook, Google, or analytics firms while their privacy policy claimed otherwise. The US Federal Trade Commission held one of the biggest providers accountable for exactly this in 2021.

And depending on where you live, it can be dangerous. In countries where abortion is criminalised, data from apps and search histories has already been used as evidence. In Germany, this isn't an issue today. But data that ends up on someone else's servers tends to stay there longer than laws stay the same.

Seven questions for any cycle app

You don't need to read a privacy policy front to back. These seven questions are enough, and you can usually find the answers in five minutes.

1. Does the app work without an account?

The best kind of data sharing is the kind that never happens. An app that keeps everything on your phone can't sell it, lose it, or hand it over. If an app forces you to create an account the first time you open it, it has already decided it wants your data on its servers.

2. Where is the data stored, and who runs the app?

These are two separate questions, and both matter. Within the EU, the GDPR applies without detours. Outside it, extra contracts are needed, and courts have already struck down the validity of such contracts more than once. "We take data protection very seriously" is not a location. "Data centre in Frankfurt" or "EU region" is.

But the server location is only half the answer. If the company behind the app is based outside the EU, it can access the data from there regardless of where the hard drive sits, and the law of its own country applies on top. An honest privacy policy names both: where the data is stored and where the people running it are based.

3. Does it contain advertising or analytics components?

Most apps contain third-party components: for crash reports, usage statistics, advertising. Each of these components sends data to its own maker, often more than the app provider itself realises. The privacy policy has to name them. If it mentions Google Analytics, the Facebook SDK, Firebase, or an ad network, data is leaving the app, no matter what the rest of the text says.

4. Does the app ask for things it doesn't need?

A cycle can be calculated from the date your last period started. Nobody needs your name, date of birth, phone number, or contacts for that. Any piece of information the app demands that the feature doesn't actually require is information someone else wants.

5. Can you delete everything?

Not just the account, but the data behind it. The GDPR gives you the right to this. A trustworthy app has a button or an address for it, and it tells you how long it takes and what, if anything, remains afterwards, for example in backups.

6. What happens if the company is sold?

This is in almost every privacy policy, usually under "business transfer", and it's there because it happens. If your data is part of what's sold, the buyer's rules apply afterwards. Check whether the app promises to ask you in that case, or only to inform you.

7. Is the policy written so you can actually understand it?

This isn't a minor point. A privacy policy that runs twenty pages and mentions "legitimate interests" on every other page is written so you won't read it. A company that does little with your data can say so on a single page.

How Lunabia handles it

We build a cycle app ourselves, so these seven answers belong here too.

Lunabia works without an account. Everything you log stays on your phone first, and if you never create an account, it stays there. You only need an account if you want to see your data on a second device or back it up against loss. It consists of an email address and a six-digit code sent to you. No password, no name, no phone number, no advertising ID.

On question 2, our answer isn't the one we'd most like to give, so we're giving it precisely. The data sits with Cloudflare. For storing photos and videos, the EU legal region is fixed and guaranteed. For the database holding your entries, the stated location is Western Europe; that's a region, not a guarantee for a specific country. Lunabia is run by Fluxera LLC, based in the US, and that's where we access the data from. Under European law, the US counts as a third country. The privacy policy explains what that means and what the processing is based on. So we don't claim "servers in Germany", and we don't invent a seal of approval either.

Because cycle data is health data, the app asks for your explicit consent in its own separate step the first time you open it, before you sign in and before anything is saved. The toggle for this isn't pre-checked, and you can withdraw your consent at any time with a single tap.

The app contains no advertising components, no analytics components, and no tracking pixels. Neither does this website: it doesn't set cookies and doesn't load anything from third-party servers, not even the fonts. We don't know how often you open the app, and we don't want to know.

The app only asks for what each specific feature needs, nothing more. For your cycle, that's the first day of your period. From the second entry onward, the prediction calculates based on your own cycles instead of a default of 28 days, and this calculation happens on your phone.

For the lock, there's a code inside the app, separate from your phone's own lock screen. So whoever is holding your phone doesn't automatically see your calendar.

And on deletion: without an account, you delete the app and everything is gone. With an account, there's a "Delete account" button in the app under More, Profile. It immediately removes everything on the server tied to your account: entries, photos, and videos. You don't need to email us for that.

What you can do yourself

A few things that apply no matter which app you use:

• Check your phone for old cycle apps. If you're no longer using one, don't just delete the app, have the account deleted too. Otherwise the data just sits there.
• Check the permissions. A cycle app doesn't need access to your location, contacts, or microphone.
• Use your phone's lock screen, and if the app has its own, use that too.
• When trying a new app, read its privacy policy using the seven questions above. Five minutes is enough to rule out most of them.

You don't have to trust anyone who tells you they take your data seriously. You can go check for yourself.