A private period tracker — one that doesn’t share data — stores your cycle on your phone: no account, no cloud copy anyone can read, no analytics firms wired into your logs. Data that never reaches a company’s server can’t be sold, breached, or handed over in response to a legal request, because there is nothing on the server to hand over.
That one sentence is the whole trick, and it matters because “we take your privacy seriously” appears in the policy of every app that has ever done the opposite. Promises are marketing. Architecture is physics. This guide explains the difference in plain words, gives you a four-point checklist you can run on any tracker in two minutes, and looks honestly at which apps pass — including the one this site belongs to.
On-device vs cloud: where your cycle data actually lives
Most period apps work like this: you tap “period started,” your phone sends that fact to the company’s server, and it lands in a database next to millions of other people’s cycles. From there it can flow into analytics tools, ad platforms, “trusted partners,” breach dumps, and legal discovery. Not because anyone is cartoonishly evil — because that’s just where data goes once it exists on a server.
An on-device tracker skips the trip. Your log is written to a database file on your own phone, protected by your phone’s encryption, and the prediction math runs right there. In daily use an offline period tracker app feels identical to any other — you tap, it logs, it predicts. The difference is invisible until you ask the only question that matters: where did that tap go? If the answer is “nowhere,” there’s nothing to sell, nothing to leak at company scale, and nothing for a subpoena to collect from the developer.
The honest trade-off: no cloud means no automatic account backup. If your data lives only on your phone, it moves with your phone backups, not with a login. For most people, that’s a trade worth making twice.
How to find a period tracker that doesn’t share data
Run any app through these four questions before you log anything:
- Does it demand an account? A period tracker without an account has no profile to attach your cycle to. A sign-up screen isn’t proof of wrongdoing, but it is proof your data is leaving the phone — that’s what accounts are for.
- Does it say where your data lives, plainly? Look for a precise claim like “your data lives on your phone.” Be suspicious of vague comfort words — “encrypted in transit” means your data is, in fact, in transit, and readable when it lands. The encryption that counts is end-to-end: the company never holds the key.
- Is there an app lock? The most realistic threat isn’t a hacker in a hoodie; it’s whoever picks up your unlocked phone. A period tracker with a Face ID lock closes that door.
- What does the App Store privacy label say? Scroll to “App Privacy” on the listing and read “Data Used to Track You” and “Data Linked to You.” The shorter those sections, the better the story.
The Flo settlement: why “we value your privacy” needs receipts
If the checklist feels paranoid, it isn’t — it’s pattern recognition. In 2021, the FTC settled with Flo Health over allegations that the popular period and ovulation app had shared users’ health data with third-party marketing and analytics firms — including Facebook’s and Google’s analytics divisions — despite promising to keep it private. The settlement required Flo to get users’ affirmative consent before sharing health data, to notify affected users, and to instruct the third parties that received the data to destroy it.
The instructive part isn’t the headline — it’s the mechanism. This wasn’t a dramatic hack. It was ordinary analytics plumbing doing exactly what analytics plumbing does, in an app people trusted with the most intimate calendar they keep. When data sits on a server, sharing isn’t an accident waiting to happen; it’s a setting waiting to be enabled. On-device storage removes the setting.
Other private period trackers worth knowing
Honesty ranks, so here it is: Hormoscope is not the only app built this way, and depending on what you want, one of these might suit you better.
- Euki — free, built by a nonprofit (originally developed with Ibis Reproductive Health), stores everything on your device, and collects no personal information at all. It even has a decoy PIN that opens a fake screen. A great pick for pure, no-frills logging.
- Drip — open-source, made by the Bloody Health collective, keeps data on your phone with password protection, and supports sympto-thermal charting if you track temperature. Available on iOS, Android, and F-Droid.
Both are excellent and deliberately spartan. Hormoscope shares their architecture — on-device, no account — and adds the part they skip: a daily forecast with a personality. If you want private and fun to open, read on.
How to do it with Hormoscope
Hormoscope’s privacy claim is scoped precisely: your cycle data lives on your phone, and nothing we can read ever leaves it. Not “anonymized,” not “shared only with trusted third parties” — unreadable to us, by construction. Here’s the setup, start to finish:
- Download and open. There is no sign-up screen, because there is no account. The app works the second it launches.
- Log your last period in the calendar. Period prediction and the calendar are free forever, and the prediction math runs entirely on your phone.
- Turn on the Face ID lock. In settings, lock the whole app behind Face ID. The intimacy log is always behind Face ID and never appears in anything you share.
- Read “How your data is stored.” The settings screen spells out the storage model in plain language instead of hiding it in a policy.
- Log symptoms as they come. Cramps, headache, bloating, fatigue, acne, cravings, flow intensity — all of it stays local. And the standard signpost: if a symptom feels severe or genuinely off, that’s a conversation for a clinician, not an app.
- Add the forecast layer if you want it. Hormoscope Pro unlocks the daily reading, five live meters (Energy, Mood, Social Battery, Skin, Libido), and The Briefing — a week of hormone weather — all generated from the same on-device data.
“Your standards are at an all-time high and your tolerance at an all-time low. Avoid the comments section.” — a real Day 26 luteal reading. Sharp, yes. Shared with advertisers, no.
Sharing with a partner: encrypted before it leaves
Hormoscope can show a partner your phase and a countdown — so they know when to bring snacks and when to skip the debate. It’s off until you turn it on. Here’s exactly what happens when you do:
- Your phone builds a small forecast. The name you chose, your last period start, your cycle length and period length. Not your logs, not your symptoms, not your notes, nothing from the intimacy log.
- It’s encrypted on your phone with AES-256-GCM and a random key. That key travels to your partner inside the invite, sealed with the 12-character code you hand them — stretched through 1.2 million rounds of PBKDF2, so it’s slow to guess on purpose. We never see the code, so we can never unseal the key.
- Our server stores ciphertext it can’t open. Your partner’s phone decrypts it and does the phase math itself, the same way yours does.
- Stop sharing and it’s gone. The encrypted copy is deleted from our server on the spot, and their app loses access on its next refresh. A share you forget about expires on its own 400 days after your last update.
What we keep, because the feature can’t work without it: a push token so your partner’s phone hears about updates, and a one-way hash of your anonymous purchase ID so Pro shows up on their side. No names, no emails, no account. And one thing every privacy page should say out loud: we count anonymous app events — which screens get opened — to make the app better. Never what you log.
Private period tracker FAQ
Does a period tracker without an account still predict my period?
Yes. Period prediction is math on the dates you log, and your phone is more than powerful enough to do that math locally. Accounts exist for cloud sync and marketing, not for accuracy — a period tracker without an account predicts just as well.
Can on-device cycle data be handed over or subpoenaed?
A company can’t hand over data it never receives — or can’t read. With on-device storage there is nothing on a server to request, sell, or breach; with end-to-end encryption the server holds only ciphertext it has no key for. Your phone itself is a separate matter: protect it with a strong passcode and an in-app lock like Face ID.
What should a period tracker’s App Store privacy label say?
Shorter is better. Check the sections called “Data Used to Track You” and “Data Linked to You” on the App Store listing — a genuinely private tracker has little or nothing listed there, because your logs never leave the device to be linked to anyone.
Is Hormoscope’s forecast computed in the cloud?
No. The daily reading, the five meters, and the weekly Briefing are generated from your cycle phase on your phone. Your cycle data lives on your phone, and there is no account to attach it to.
Can Hormoscope read what I share with my partner?
No. Your phone encrypts the shared forecast before it leaves, and the key only travels inside the invite code you hand over — a code we never see. Our server holds ciphertext it has no key for; stop sharing and even that is deleted.
Privacy shouldn’t cost you the fun parts. Hormoscope is the private one that also gives you a daily forecast — the calendar is free forever, and nobody reads your cycle unless you invite them to.
