CITT

    Scan results

    Flo Ovulation & Period Tracker

    Android

    Flo is the world's leading period, pregnancy, and cycle tracker with over 430 million members. Track your menstrual cycle, ovulation windows, symptoms, and pregnancy with expert-developed insights. Features cycle predictions, health articles, and community support.

    CITT SCORE
    32
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Cycle tracking with standard analytics trade-offs

    Not For: You prefer your health data stays off ad networks

    What It Means For You

    Cycle dates, symptoms, and health logs are stored with less protection than expected and shared with analytics and attribution services including Firebase, AppsFlyer, and Sentry. User activity is used to build behavioral profiles. Users have limited ability to control or delete what is collected.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (13)

    Data Security

    5 total
    3 Critical
    1 High
    1 Medium

    Network Security

    2 total
    2 High

    Code Security

    2 total
    1 Critical
    1 High

    Privacy

    4 total
    1 Critical
    3 High

    Third-Party Services

    Sentry, Firebase Analytics, AppsFlyer, Auth0, Google Firebase

    Security Strengths

    • ✓HTTPS-only validation in WebViewActivity
    • ✓OAuth callbacks handled securely through Auth0
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    health
    sensitive data
    reproductive health
    pregnancy
    financial
    analytics
    ads
    gdpr violation

    Package

    org.iggymedia.periodtracker

    Version

    9.97.0

    Analysis Date

    Feb 2, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 5 findings (3 critical, 1 high, 1 medium)

    Network Security - 2 findings (2 high)

    Code Safety - 0 findings

    Privacy - 4 findings (1 critical, 3 high)

    Privacy Concerns

    What Data is Collected

    Flo collects cycle dates, symptom logs, health notes, and in-app activity patterns. Device identifiers may also be collected depending on user settings.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Firebase Analytics - behavioral analytics and usage tracking
    • AppsFlyer - advertising attribution and campaign measurement
    • Sentry - error reporting and diagnostics
    • Auth0 - account authentication
    • Google Firebase - app infrastructure and analytics

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy30/100
    Data Security25/100
    Network Security45/100
    Code Safety40/100
    Data Collection35/100
    Data Sharing40/100
    User Control25/100

    Positive Security Features

    • No positive security features were identified in this version.

    Areas for Improvement

    • Strengthen how health and cycle data is stored and protected on device.
    • Reduce the number of third-party analytics and advertising services that receive user health data.
    • Provide clearer tools for users to manage, export, or delete collected data.

    About This Analysis

    This scorecard reflects the security and privacy posture of the app version analyzed below.

    App Details

    • App: Flo Ovulation & Period Tracker
    • Package: org.iggymedia.periodtracker
    • Version: 9.97.0
    • Scan Date: 2026-02-02

    Right of Reply

    Developer not yet contacted