Anonymous Period Tracking: What It Means, and What It Cannot Mean

Anonymous is one word doing three different jobs, and they are not worth the same. It can mean no account, so you never type a name or an email. It can mean unlinked, where your cycle still travels to a company's servers but is deliberately separated from anything that identifies you. Or it can mean never transmitted, where nothing about your cycle leaves the phone at all. Only the third one is a promise you can check yourself, in a minute, by turning the connection off.

What follows is how to tell the three apart from the outside, what the companies making each kind of promise actually publish about it, and the thing none of them covers.

The three meanings, in order of how much trust they ask of you

• No account

  The app opens straight into the tracker. No email, no password, no sign-up wall. This is real and it is worth having, but it is a fact about the front door, not about the building.

  Ask: does anything still leave the phone?
• Unlinked

  Your cycle data reaches a server, and the company has built something that is meant to stop that data being tied back to you. This is a genuine engineering discipline, and it is also the one you cannot inspect.

  Ask: who holds which half, and who says so?
• Never transmitted

  Nothing about your cycle is sent anywhere. There is no server-side story to trust, because there is no server side.

  Ask: does it work in airplane mode?

Almost every argument about anonymous period tracking is really an argument about which of these three somebody is being sold. The word on the store listing is the same in all three cases.

No account is the easiest thing to check and the easiest to overstate

An account exists so that data can live somewhere other than your phone. If an app never asks for one, it has told you something concrete before you have entered a single date, and that is why using a tracker without an account is the first question worth asking about any of them.

It is not the last question. No email does not mean no identifier. Software that talks to a server can attach a random install ID, a device model, an operating system version and an IP address to whatever it sends, without ever knowing your name. None of that is your identity in the way an email address is. All of it is a handle, and handles can be joined to other handles.

So "no sign-up" answers a narrow question honestly and leaves the wide one open. The wide one is whether your bleeding, your pain, your moods and your sex life go anywhere at all.

What an unlinking design looks like, in the company's own words

The clearest published example of the second kind comes from Flo. Flo describes its Anonymous Mode as a feature that lets you track your health without your name, email, IP address or any other identifiers being linked to your health data. Flo states that requests are routed through an Oblivious HTTP relay, so that the relay sees the IP address but not the health data, while Flo sees the health data but not the identity, and that even Flo cannot identify individuals using it.

Strip out the jargon and the idea is simple, and rather good. Two parties each hold one half of what would be needed to point at you. The middleman knows where the message came from but cannot read it. The destination can read it but does not know where it came from. Neither one holds both halves, so neither one can join them.

That is a real design, not a slogan, and it is more than most apps in this category attempt. It is worth saying so plainly, because the honest criticism that follows is not that the idea is bad.

The part you cannot check

You are on the outside. From there you can read a description of an architecture; you cannot see the servers, the code that is actually deployed to them, who operates the relay, what is logged at either end, or what changes next year. Every claim of the second kind is a claim about software you will never run and cannot observe. We cannot check it, and neither can you.

This is the reason people ask the question at all. In January 2021 the US Federal Trade Commission announced a settlement with the developer of a widely used fertility-tracking app; the FTC alleged that the company had promised to keep users' health data private while disclosing it to third-party analytics providers, and the company settled neither admitting nor denying the allegations. The honest counterweight belongs in the same breath: when the UK's Information Commissioner's Office reviewed period and fertility apps in 2024, it reported that no serious compliance issues or evidence of harms were identified, while urging developers to prioritise privacy.

Neither of those tells you what any particular server is doing today. That is the point. A design you cannot inspect is trusted or it is not, and trust is a reasonable thing to give — it is just a different category of thing from proof.

A promise about how data is handled is only as durable as the company handling it. A design where the data never moved does not need the company to keep its word.

Never transmitted, and the policies that describe it

The third kind is the simplest to state and the simplest to test. Two published policies describe apps built this way.

The drip privacy policy states that there is no collection of usage data or personal information, no ads and no spyware; that menstrual cycle data is stored locally on the device and cannot be accessed by other apps; and that deleting the app data in settings, or uninstalling, removes it. It also carries a caveat worth more than most privacy marketing: it says an automatic cloud backup may still take place depending on your device settings. The policy adds that the source code can be read to check that all of this is true.

Euki's privacy policy states that it does not collect any personal or other information from users, including through their use of the app, except for information a user voluntarily sends by contacting support, and that the app does not track its users to provide targeted advertising.

The drip caveat is the one to carry away, because it applies to every local-only app including this one. Your phone's own backup can lift a local database off the device even when the app never sends anything. The app's design is not the end of the story; your operating system's backup settings are part of it, and they are yours to look at. That is one strand of a wider trade, and it is worth reading properly before you choose a side: what you give up when there is no cloud sync.

What a store label tells you, and what it does not

Both app stores now publish a privacy summary, and the vocabulary is genuinely useful. Apple describes the App Store privacy information section as a system in which the information is self-reported by the developer. In Apple's own words, "Data Linked to You" means data collected in a way that is linked to your identity, such as to your account or device, and "Data Used to Track You" means data from the app linked with data collected from other companies' apps, websites or offline properties and used for ads or shared with a data broker.

That distinction is exactly the one this article is about, printed on the listing before you install. An app claiming anonymity while declaring health data linked to you has contradicted itself in public, and that is a cheap thing for you to notice.

The limit is in the phrase Apple uses: self-reported. A label is a developer's declaration, not an audit. It is a fast filter and a poor proof, which is why it belongs early in a ten-minute check of any tracker rather than at the end of it.

What anonymity does not buy you

None of the three promises protects the phone in your hand. The likeliest way a period log is read by somebody else is not a breach or a subpoena. It is a person picking up an unlocked phone.

So the things that actually matter at that range are dull and local. Whether the app has a PIN or a face unlock of its own. What your notifications say on the lock screen, because a helpful reminder is also an announcement to anyone standing near you. Whether the phone is shared, or was ever backed up to a computer somebody else uses. And whether a copy of your history already sits in some other app you signed up to years ago, which anonymity in a new app does nothing about — that copy has to be deleted where it lives.

If none of that can be made safe, there is an option with no software in it at all. The printable period tracker gives you a sheet of paper, which cannot be synced, breached, subpoenaed or relinked, and which you can keep wherever you keep things. And if what you actually wanted from an app was the arithmetic rather than the storage, the cycle length calculator works out your average and how much it moves from a few start dates, in your browser, with nothing sent anywhere. The deeper case for judging architecture over policy is in what actually makes a tracker private.

Where Athena stands

Athena is the app this site is being built for. It is in development, it is in no store, and there is nothing here to buy or sign up for, so this is a description rather than something you can verify today.

It is the third kind. Periods, symptoms, notes and temperatures are written to a private database on the phone, predictions are calculated on the device, and there is no account, so there is nothing on a server to link back to you. Two honest exceptions, stated because leaving them out would make this page the thing it is complaining about: the app will send anonymous diagnostics to Firebase — which features get used, crash reports, device model, never anything you log — and this website uses IP-anonymised web analytics. Nothing you record about your cycle is in either. When the app ships, the way to check the claim is the same one this whole article recommends: turn the connection off and see whether anything stops working.