So this week has been a lot. Monday night Politico published that leaked draft opinion out of the Supreme Court, the one suggesting Roe v. Wade is about to get overturned, and by Tuesday morning my group chats had completely stopped talking about anything else. Not the legal stuff, actually. I'll leave that to people who know what they're talking about. What caught my attention as a tech person was how fast the conversation turned to period-tracking apps.
Within about a day, I was seeing threads everywhere telling people to delete Flo, delete Clue, delete Natural Cycles, get rid of anything that logs your cycle with a timestamp and a location. The EFF and a bunch of other digital rights folks put out quick explainers on what these apps actually collect and who they might hand it to. And once you actually sit and think about it for five minutes, it's not paranoid at all. It's just how these apps have always worked, we just werent thinking about the worst case before.
Here's the thing that bugs me: this data situation isnt new. Flo alone has something like 100+ million downloads. These apps have been collecting cycle data, sometimes location data, sometimes it gets shared with ad networks or analytics companies, for years. Flo actually got in trouble with the FTC back in 2021 for sharing health data with Facebook and Google despite promising it was private. None of this is a secret if you were paying attention. What changed this week isnt the technology, its the stakes. Suddenly a log of "period 4 days late" plus a location ping near a clinic isnt just creepy ad-targeting fodder, it's potentially the kind of thing that could end up in a subpoena in certain states if the leaked draft becomes reality.
I dont have a period, obviously, so I want to be careful not to make this about me. But I do care a lot about data minimization as a general principle, and this is a pretty stark example of why "just trust the company" has never been a real answer. The advice going around — switch to a paper calendar, or use an offline-only app, or just use the built-in cycle tracking in Apple Health with iCloud sync turned off — is honestly decent advice for anyone who cares about this stuff regardless of what happens with Roe. Data that doesnt exist cant be subpoenaed. Data that exists on a server somewhere, under a privacy policy nobody reads, absolutely can be.
What's frustrating is how the industry's response to something like this is always retroactive. Apps dont build in "delete everything, permanently, right now" buttons until there's a crisis forcing the issue. Flo apparently rushed out an "anonymous mode" this week that strips your identity from your account. Good, I guess? But it took a leaked Supreme Court draft for that feature to become a priority, and that tells you everything about where privacy sits on most product roadmaps. Somewhere below "engagement metrics" and "retention emails," is my guess.
The other thing I keep seeing, and it drives me up a wall, is the "if you have nothing to hide you have nothing to worry about" line showing up in replies to these threads. I genuinely dont understand how that argument survives past 2013 at this point. Data doesnt just sit still. It gets sold, subpoenaed, breached, repurposed by a new owner after an acquisition, or used in ways the original terms of service never anticipated. Having "nothing to hide" today doesnt mean the law wont change around what youve already logged.
Anyway. Today's actually Star Wars Day, "May the 4th," which under normal circumstances would probably be the whole post: some joke about Disney+ subscriber numbers or whatever. Feels a little beside the point this week. I'll take the corny pun days when they come though, we dont get many easy ones.
If you use a period tracker and havent looked at what it actually collects, it's worth five minutes with the privacy policy or, more realistically, five minutes with someone else's summary of the privacy policy, because those documents are unreadable by design. Check what "anonymous mode" actually anonymizes, not just what the marketing page says it does.