Flo Ovulation & Period Tracker Security & Privacy Scorecard
Android
Cycle dates, symptoms, and health logs are stored with less protection than expected and shared with analytics and attribution services including Firebase, AppsFlyer, and Sentry. User activity is used to build behavioral profiles. Users have limited ability to control or delete what is collected.
Best for
Cycle tracking with standard analytics trade-offs
Avoid if
You prefer your health data stays off ad networks
Findings
- 0 critical
- 0 high
- 0 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Realm Database Stored in Plaintext
- JWT Access Tokens Stored in Plaintext SharedPreferences
- JavaScript Interface "AndroidMessageHandlers" with Unknown Methods
Top privacy issues
- Sentry Initialized Before User Consent (GDPR Violation)
- Multiple Analytics SDKs Without Opt-Out
- Advertising ID Collection Without Consent
Full analysis
Flo Ovulation & Period Tracker
Security Score: 35/100 | Privacy Score: 30/100
What This Means for You
Cycle dates, symptoms, and health logs are stored with less protection than expected and shared with analytics and attribution services including Firebase, AppsFlyer, and Sentry. User activity is used to build behavioral profiles. Users have limited ability to control or delete what is collected.
Recommendation: Use With Caution
Best For: Cycle tracking with standard analytics trade-offs
Avoid If: You prefer your health data stays off ad networks
Key Findings
Data Security - 5 findings (3 critical, 1 high, 1 medium)
Network Security - 2 findings (2 high)
Code Safety - 0 findings
Privacy - 4 findings (1 critical, 3 high)
Privacy Concerns
What Data is Collected
Flo collects cycle dates, symptom logs, health notes, and in-app activity patterns. Device identifiers may also be collected depending on user settings.
Third-Party Data Sharing
User data is shared with the following third-party services:
- Firebase Analytics - behavioral analytics and usage tracking
- AppsFlyer - advertising attribution and campaign measurement
- Sentry - error reporting and diagnostics
- Auth0 - account authentication
- Google Firebase - app infrastructure and analytics
Understanding the Scores
| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 30/100 |
| Data Security | 25/100 |
| Network Security | 45/100 |
| Code Safety | 40/100 |
| Data Collection | 35/100 |
| Data Sharing | 40/100 |
| User Control | 25/100 |
Positive Security Features
- No positive security features were identified in this version.
Areas for Improvement
- Strengthen how health and cycle data is stored and protected on device.
- Reduce the number of third-party analytics and advertising services that receive user health data.
- Provide clearer tools for users to manage, export, or delete collected data.
About This Analysis
This scorecard reflects the security and privacy posture of the app version analyzed below.
App Details
- App: Flo Ovulation & Period Tracker
- Package: org.iggymedia.periodtracker
- Version: 9.97.0
- Scan Date: 2026-02-02
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 32/100 |