← All articles

Why your cycle data stays on your phone

By Chris Ayers 7 min read

I built Ferrabelle for one person first, and there was never a reason to send her cycle anywhere. When I rebuilt it as an Android app for everyone, I kept it that way. It lives entirely on your phone. There is no account, no server and nothing for me to see.

I want to explain what that means in practice, because “private” is a word every app uses and it rarely means the same thing twice. I also want to show you how to check it, since I would rather you trust Android’s own counters than trust me.

Why I think this kind of data is different

I live in Washington State, and in 2023 the state passed a law called the My Health My Data Act. The definitions section, RCW 19.373.010, is worth reading once. It defines consumer health data as personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. The list of examples includes “bodily functions, vital signs, symptoms, or measurements” and “reproductive or sexual health information.” It also covers anything inferred about your health “by any means, including algorithms or machine learning.”

Read that against what a cycle app holds. Period dates. Symptoms. Temperature. Mood. A prediction of where you are in your cycle. Every one of those is on the list, and the predictions count too, because they are inferences.

The Washington Attorney General’s page on the act calls it the first privacy-focused law in the country to protect personal health data that falls outside of HIPAA. Most businesses had to comply from March 31, 2024. Under the act, you can ask a business to delete your health data, and a business cannot sell it without valid authorization from you.

I am a software developer, not a lawyer, so I will not tell you what the law means for any other product. I will tell you what it meant for me. If a law had to be written to give people the right to ask a company to delete their cycle data, the simplest thing I could do was never hold it in the first place. You cannot be asked to delete what you never had.

What “on your phone” actually means

There is no Ferrabelle account. Nothing to sign up for, no email, no password. The app has no server for your data. When you log a period, it is written to a database in the app’s private storage on your phone, and that is where it stays.

Out of the box, the app makes no internet connections at all. Not fewer. None. Two optional features can use the internet, and both are off until you turn them on: the AI assistant, where you pick the provider and the app shows you what it sends, and pressure tracking, which asks MET Norway, the Norwegian weather service, for pressure readings for the city you pick. If you never turn those on, the app never connects.

I measured this rather than assumed it. On the release build, with the assistant off, zero bytes left the phone. That number is on the accuracy page, and the way to check your own phone is below.

There is one honest exception I need to spell out. While the AI assistant is on, whichever provider you choose, Google’s on-phone AI library can send Google usage and error statistics: device information, app version, an installation identifier and error codes. It never includes your question or your data, and with the assistant off nothing is sent. But it is a connection that is not mine, and I would rather tell you about it than have you find it on the meter and wonder.

Backups are yours too. The app can save an encrypted backup file wherever you choose through Android’s file picker. It is encrypted on your phone with a passphrase only you know. I cannot read it, and I cannot recover the passphrase if you lose it. That is the cost of the design, and I think it is the right cost.

How to check it yourself

The Federal Trade Commission has a plain consumer page on how apps collect information. Two of its suggestions are worth doing with any app, including mine. Go to your phone’s privacy settings to see what each app can access from your device. And consider turning off permissions an app does not need, or deleting apps that ask for many they do not need. The page also notes that when you use an app on your smartphone, advertisers may use a unique advertising identifier to track you.

So here is what to look at in Ferrabelle.

The permissions list. Open your phone’s settings for the app and look at what it has asked for. You will not find location, contacts or an advertising identifier. Health Connect access, if you turned it on, is read-only and you can revoke it per data type in Health Connect’s own settings.

The privacy meter. In the app, Settings, then Privacy, then “What left your phone.” It shows how much data Ferrabelle sent and received today, over the last 7 days and since install. Those numbers come from Android’s own network counters for the app, and the app cannot change them. The screen’s headline says it: “Measured by Android, not by us.” The meter also lists what it cannot see, such as downloads Google Play makes for the app, your phone’s speech recognizer and the watch connection.

Your phone’s data usage screen. Android keeps a per-app tally of mobile and Wi-Fi data. Ferrabelle’s line should be at or near zero unless you have turned on one of the two optional features.

Export and delete. Settings, then Your data, then “Export your data” gives you a readable copy of everything, free. “Delete all data” on the same screen erases everything on the phone. Both work offline, because there is nothing to ask a server to do.

What I am not saying

I am not saying anything about any other app. I have not audited them and I am not going to make claims I cannot support. The FTC page and your phone’s settings let you check any app the same way you can check mine, and I think that is the right standard: look at the counters, not the marketing.

I am also not saying local-only is free of trade-offs. There is no sync between devices. Moving to a new phone is something you start yourself, and it runs over your own Wi-Fi. If you lose your phone without a backup, the data is gone. I made those trades on purpose, for one person first, and I still think they were right.

If you want a private period tracker app with no account, and you are willing to hold your own backups, Ferrabelle is in a closed test on Google Play right now. You can join at ferrabelle.com/testers, and the first thing I would do after installing is open the privacy meter and watch it sit at zero.

Sources