Every period-tracking app on the market makes a basic design choice early on: keep a user’s cycle data almost entirely on their phone, or move it into company servers where it can power more advanced features for better insights. the privacy decisions made by femtech apps, That decision is also the question underneath a new review from Mozilla Foundation, which tested six popular trackers this year. The researchers found that where a company lands on the local-versus-cloud spectrum says nearly as much about its privacy profile as any specific data-sharing incident.
Mozilla’s team didn’t rely on a single app session to reach its conclusions. Testers combined manual use and network analysis with outside help: Harvard’s Berkman Klein Center tracked how each app’s privacy policy has changed over time, and researchers at the University of Illinois ran additional testing on Android operating systems.
That combination is why the review’s read on Flo carries some weight: it measures what the app does today against what it has promised to do, as well as the historic matters that are no longer part of the company.
How Did Flo Score in Mozilla’s 2026 Privacy Review?
Mozilla’s testers gave Flo a 7 out of 10, trailing just behind the review’s outright winner, Euki, a nonprofit tracker that scored a perfect 10. The gap between the two apps occurs for two primary reasons: Flo’s historic SDK matter and Euki’s choice to keep data on the user’s phone. Euki earned its score largely by keeping things simple: no account system, no cross-device sync, no cloud backend, and nearly everything a user logs into Euki stays on the device itself. However, the trade-off is the limited functionality of data insights for users.
Why Does Flo Store Data in the Cloud While Euki Doesn’t?
Flo takes the opposite approach, and Mozilla’s own testing shows why that choice exists. The app’s machine learning-powered check-ins, the ones that ask whether cramps feel like a dull ache or a sharp pain, or whether a headache showed up before or after a mood shift, rely on analysis of a person’s own history over time. Flo’s own materials describe this as the engine behind its personalized predictions: the more a person logs, the more precisely the app can calibrate specifically to their body. That comparison and related insights are not possible without machine learning.
Mozilla’s review is possibly rooted in its view of data collection, rather than an actual trade-off. Its criticism of Flo appeared based more on how much the app has built up internally, a detailed, continuously updated model of a person’s reproductive health, as it found no evidence of data leaving the company. The review’s authors flagged that this structure could make future sharing easier if Flo’s practices ever changed. However, that change would completely upend Flo’s business model and is not based on any material evidence found in its review of Flo.
The hypothetical speaks more to a caution rooted in the design of technology today, and, and the researchers did not share evidence to support this type of action happening today.
What Does Flo Actually Do With the Data It Collects?
On the specific question Mozilla set out to answer, whether any of that data reaches outside the company, testers came back with a narrower and more favorable finding than Flo’s public history might predict. No symptom logs, fertility predictions, pregnancy information, or cycle data reached Flo’s advertising or analytics partners during testing. A separate, optional setting governs whether basic device information goes to those partners at all, and switching it off visibly changed what left the app in Mozilla’s own network analysis.
Flo has also built tools meant to separate a person’s identity from their data even while that data stays on Flo’s servers. Anonymous Mode, which the company says strips identifying details like name, email, and device identifiers before information reaches Flo at all, routes traffic through an encrypted protocol called Oblivious HTTP. The feature picked up outside recognition in 2023, including a spot on TIME’s list of that year’s best inventions and a finalist nod at Fast Company’s World Changing Ideas Awards.
Is Cloud Storage a Fair Trade for More Personalized Insights?
None of this erases what the researchers purport is an underlying trade-off. A fully local app like Euki can’t lose a user’s data to a server breach, a subpoena, or a change in company ownership, because there’s no server in the picture to begin with. Flo’s model depends on one. What Mozilla’s review adds is a clearer picture of what that trade actually buys: a company that, when tested directly, kept the sensitive layer of that model out of advertising systems, backed its claims with an active certification and a standing security advisory board, and gave users a working option to opt out of the parts of the app that touch outside partners.
For someone weighing a bare-bones tracker against one that predicts cycle patterns or answers specific questions about symptoms, the real choice comes down to two different answers to the same question: how much does an app need to know about a person to be useful, and what happens to that knowledge once it exists? Mozilla’s testing suggests Flo has put real work into answering the second half of that question, even as it keeps building out the first.
That distinction is easy to miss in coverage of app privacy, where a single score can flatten a more complicated picture. A cloud-based health app and a fully local one aren’t competing on the same terms, and judging one by the standard built for the other misses what each is actually trying to do. Mozilla’s own testing points to a narrower, more useful question for anyone choosing between them: what happens to the data an app collects, and who gets to see it along the way.
