Period app privacy — in the EU

Start anonymously — no email, no name

This one gets over-complicated in most write-ups, so start here: Privacy policies are written to be survivable in court, not readable at 11 pm. This is the plain-language version: what period apps typically collect, why, and what Avoria does differently. GDPR Article 9 gives cycle data a specific legal status, and EU hosting keeps it inside that regime. Below: the mechanics, the trade-offs and what to do in the next five minutes.

Period app privacy — in the EU

In the EU, period app privacy sits inside GDPR Article 9: menstrual data is special-category health data, which raises the bar for lawful processing and gives you access, portability and erasure as enforceable rights rather than courtesies. Avoria's database is EU-hosted, so special-category data doesn't need a cross-border transfer mechanism.

How it actually works

The privacy of a tracker comes down to four questions: what identifiers it stores, which third-party SDKs are compiled into the binary, where the database physically lives, and whether you can export and delete in one tap. Avoria's answers: no required identifiers, no ad SDKs, EU hosting, one-tap export and delete. Avoria ships with no advertising SDKs and no third-party analytics in the mobile app.

Why it matters

The FTC's 2021 and 2024 actions against Flo, and repeated Mozilla 'Privacy Not Included' findings across the category, made the baseline clear: cycle data has been shared with analytics and advertising partners at scale. This is documented regulatory record, not speculation. Framed for in the EU, the practical consequence is that fewer parties end up holding a copy of a health record you never intended to publish, and the copies that do exist are harder to join back to you.

What Avoria does about it

Three concrete things. First, Zero advertising SDKs compiled into the Android build. Second, EU-hosted database with row-level access scoped to your account id. Third, Export to CSV/JSON and hard-delete, both without contacting support. None of that is gated behind an email address — the anonymous account is the full product, not a preview tier.

The AI part, without the hand-waving

Avoria's daily brief is generated by a language model that receives cycle context and nothing else: cycle day, phase, recent symptom tags and your stated goal. No name, no email, no device id enter the prompt, and responses aren't recycled into third-party training sets. The output is deliberately unexciting — an energy read, a focus window, a food angle and a movement suggestion — because a brief that shouts is a brief optimised for engagement rather than for you.

What you get besides privacy

Privacy on its own is a feature nobody opens an app for. Avoria pairs it with the working parts: a cycle calendar that models your own variance instead of a 28-day template, phase-aware nutrition and training guidance, symptom logging with 1–5 severity charted against cycle day, wearable sync scoped to the metrics the model actually uses, one-click imports from Flo and Clue, CSV and JSON export, and calm reminders you configure once. All of it available on an account with no identity attached.

Do this next

Exercise the rights you already have: request your export from your current app under Article 20, then import it here and delete the original account under Article 17. Avoria is educational and is not medical advice. For diagnosis or treatment, please talk to a clinician.

Signals this applies to you

Look for three things this week: does the app ask for more data than it uses, does it explain why a prediction shifted, and does it treat a heavy day differently from a light one. Two 'no's mean you'll get more from a tool built around your phase, not a generic 28-day loop. On period app privacy (in the EU) specifically, these signals show up faster than most people expect — usually inside two cycles, sometimes inside one. Write them down the moment you notice, because the memory of a rough day compresses fast and the log is the only honest record you'll have when you re-read the month at the end. If none of the signals apply and you're just curious, keep reading anyway — the plan below is a decent baseline for anyone tracking a cycle at all.

What the science actually says

What the research actually shows: cycle length varies more than the classic 28-day figure suggests — a large 2019 Nature Digital Medicine analysis of over 600,000 cycles found the average is closer to 29.3 days and normal variation spans 21–35 days. That's why a rigid 28-day model quietly misses days for a huge share of users, especially in perimenopause and PCOS. Any predictor worth using has to model your variance, not average it away. That's the reference frame Avoria's daily brief works from when it talks about period app privacy (in the EU), and it's why the answer for in the eu rarely matches the answer for someone on a perfectly textbook 28-day loop. The corollary matters too: any advice that ignores your phase, your history and your logged variance is population-level advice being sold as personal advice. It might still be right for you, but you'll only know from your own two-cycle log — not from the marketing.

Your 7-day Avoria plan

Here's the calm one-week reset: Day 3 — read Avoria's daily brief once, in bed, no scrolling after. Day 4 — tag your workout with phase + energy; skip the heavy lift if energy is under 3. Day 5 — log skin, sleep and libido on the same screen; it takes under a minute. Day 6 — turn off every notification except the daily brief. Day 7 — re-read the week's briefs together; the pattern will be obvious. Day 1 — log one mood + one energy score (1–5) at the time you already unlock your phone. Day 2 — export your last six months from your current app; keep the CSV somewhere you'll find it. By day seven you'll have enough signal to see whether Flo — or any tracker — actually helps with period app privacy (in the EU), or whether it's just been logging around it. Nothing on this list takes more than five minutes. The point is not a heroic new routine; it's a small honest baseline you can compare against next month. Re-run the same seven days one cycle from now and the diff will tell you more than any single insight card ever could.

What not to do

Avoid the classic three: over-logging on good days and under-logging on hard ones (the hard days carry the signal); trusting a 28-day default when your last six cycles say otherwise; and leaving old trackers installed 'just in case' — an app you don't open is still syncing on schedule. The temptation with period app privacy (in the EU) is to add more tools; the fix is almost always fewer, better ones. A second app you check twice a week isn't a backup — it's a second surface leaking the same data, plus a second notification queue eating your attention. Uninstall the ones you don't open. The point isn't more data. It's the right data, held on your terms, translated into one useful decision each morning. That's the bar. Anything below it is noise.

A quick self-check

A quick self-check before you commit to any tracker: does it show you the raw data, does it let you export the raw data, and does it explain — in one sentence — how a prediction shifted when it did? Three yeses means the tool respects you. One 'no' is a warning; two is a reason to move. Avoria answers yes to all three by design, and that's the standard worth applying to the rest of your health stack too — sleep, nutrition, activity. The specific answer for period app privacy (in the EU) will land in your daily brief; the pattern for in the eu will emerge in the weekly recap. Don't optimise week one — just log honestly.

Avoria is not medical advice. For diagnosis or treatment, please talk to a clinician.