I will say, with codex/cc access and a free weekend you could make an app that covers like 99% of this app’s purpose. The harder part would be the art/making it cutesy, as some other commenters have pointed out. Plain SwiftUI or compose just isn’t eye catching enough

[drip.](https://bloodyhealth.gitlab.io/) [source](https://gitlab.com/bloodyhealth/drip)

  - around since 2019. Last update 2 months ago
  - iOS, Android
  - React Native

  - around since 2024. Last update 2 weeks ago
  - Android
  - Kotlin

  - around since 2015. Last updated 3 weeks ago.
  - iOS and Android
  - Dart

  - around since 2023. Last updated 2 years ago.
  - iOS
  - Swift

I think the biggest thing I'd like to see is a data format standard defined. You should be able to "take your data with you" and go anywhere you like. If you decide an app is unethical or if your favorite OSS app stops being updated, it should be simple to switch. Many apps let you export your data. Maybe someone can make a converter between popular proprietary apps and a common data structure spec

Hey surely Meta wouldn’t send that data to a government interested in regulating women’s reproductive rights

• juggina

  today at 12:52 PM

  I'll bite. Why...?

  • forgotaccount3

    today at 12:58 PM

    People in power want the information to identify a narrower set of people who may have been pregnant and then did not have a child and so may have had an abortion.

    And facebook doesn't care about people's rights when those people in power are able to block Facebook from acquiring some new startup they want to buy, so facebook is willing to share the information.

    • Muromec

      today at 4:43 PM

      Do they actually want that or just want to be elected and say things that rhyme with your fears?

    • euroderf

      today at 2:07 PM

      Handmaids, assemble! Gilead is in your device.

    • joe_mamba

      today at 3:55 PM

      >People in power want the information to identify a narrower set of people who may have been pregnant and then did not have a child and so may have had an abortion.

      And what will people in power do with this information?

      • array_key_first

        today at 4:05 PM

        Presumably try to get those women arrested, or at least investigate them.

        It's actually quite difficult to investigate an abortion, though. Abortion isn't "real", in the sense that there's no obvious difference between a natural abortion (read: miscarriage) and a purposeful one.

        The thing that means abortion abortion colloquially is the purposeful-ness of it. If you knowingly terminate a pregnancy, that's an abortion. If your body terminates its own pregnancy, for a variety of reasons because the human body is very complicated, that's not an abortion.

        Generally trusting people with that nuance is, I think, asking for trouble.

      • malfist

        today at 3:58 PM

        Do you really have to ask that question? They've criminalized health care. There's motive, history and current events to explain what they'll do with this information.

    • lagniappe

      today at 3:04 PM

      Are we assuming the lack of a recorded period is the criteria? If yes, what if you just forgot to add it that month, or have hormonal issues, or abnormal BMI?

      • pavel_lishin

        today at 3:06 PM

        You're welcome to suggest to your lawyer this particular defense.

        The people prosecuting women for abortions aren't looking for reasons not to arrest and prosecute them.

        • joe_mamba

          today at 3:55 PM

          >The people prosecuting women for abortions aren't looking for reasons not to arrest and prosecute them.

          Who are these people doing this?

          • Tangurena2

            today at 4:39 PM

            Texas & West Virginia is one of those states that prosecute women for having miscarriages. Texas offers a $10k bounty for turning in any woman who leaves the state and somehow returns without that pregnancy.

            > Nationally, about 20% of pregnancies end in a loss, which includes miscarriage or spontaneous abortion, ectopic pregnancy, stillbirth or fetal death, according to federal data. Only a small number are investigated as crimes. But advocates say the growing number of laws in some states place people’s actions following pregnancy loss under greater scrutiny from law enforcement.

            > Women in South Carolina, Georgia, Ohio, Arkansas, Texas, Mississippi, Oklahoma and several other states have faced criminal charges after a miscarriage or stillbirth for failing to seek immediate medical treatment, not pursuing prenatal care or disposing of the fetal remains in a way that law enforcement or prosecutors considered improper.

            https://www.themarshallproject.org/2024/10/31/stillbirth-okl...

            Many states prosecute black women who miscarry and one of their claims is that the woman took some (illegal - allegedly) drug that caused the miscarriage.

            > In the year after the U.S. Supreme Court dismantled the constitutional right to abortion in June 2022, more than 200 pregnant women faced criminal charges for conduct associated with their pregnancy, pregnancy loss or birth, according to a new report.

            https://missouriindependent.com/2024/10/01/200-women-faced-c...

          • intrinsicallee

            today at 4:13 PM

            https://www.cbsnews.com/news/georgia-woman-charged-murder-ab...

            https://www.newsweek.com/texas-gop-meeting-death-penalty-wom...

            https://www.theguardian.com/us-news/2025/sep/30/pregnancy-us...

            https://www.pbs.org/newshour/show/after-overturn-of-roe-more...

            "Abstract

            When Dobbs v. Jackson Women’s Health first overturned long-standing precedent protecting a woman's fundamental right to abortion, pro-choice leaders issued warnings about the possibility of prosecuting women for abortions. These concerns were dismissed as hysterical or as political theatrics because, in the past, women were rarely prosecuted for their own abortions. This note analyzes the history of illegal abortion before the Supreme Court’s ruling in Roe v. Wade to demonstrate that women were targeted, used as leverage against abortion providers, and sometimes arrested for their roles in the procedure." https://scholarship.law.slu.edu/lj/vol69/iss4/11/

          • today at 4:11 PM

      • cogman10

        today at 3:08 PM

        Lots of reasons why you would miss a period that aren't pregnancy related. But that's not the point. Missing a period opens you up to further scrutiny and investigation by the state. Now they will start seeing if you've made out of town trips or perhaps subpoena your chat log to see what you've said to friends and family. It's not enough to prosecute, it is enough to start an investigation.

        • Muromec

          today at 4:45 PM

          It's scary and all, but does it actually happen?

  • SamDc73

    today at 4:31 PM

    Not sure why, but they did cooperate with the government on such matters

    Facebook previously gave private Messenger chats to Nebraska police, these messages were used as key evidence to charge a mother and daughter over an alleged illegal abortion[1]

    [1] https://www.theguardian.com/us-news/2022/aug/10/facebook-use...

  • freeAgent

    today at 1:04 PM

    If you stop having a period for a few months and then start again, it may be worth buying some location data during that time to see if you were near any medical offices that may have offered illegal abortion services.

    • juggina

      today at 1:13 PM

      Could they get a warrant for that data anyway?

      • _alternator_

        today at 1:16 PM

        Not if you don't have the data. This is one of the reasons that google changed how it tracked people's data.

      • giantg2

        today at 1:39 PM

        Why get a warrant when you can just buy it?

        This whole data economy has significantly undermined privacy, including 4th amendment protections.

        • nwatson

          today at 2:14 PM

          Admissible evidence probably requires parallel construction and then a warrant. The purchased data is the catalyst but not legally actionable.

          • voakbasda

            today at 3:06 PM

            Parallel construction like that is unambiguously fruit from the poison tree. It should never be allowed, and the fact that it is used routinely is one of the many ongoing travesties in the US.

            • eszed

              today at 3:26 PM

              My understanding is that it would be, if admitted to. That's where the parallel comes in: establish an evidentiary trail that's plausible enough to withstand defense scrutiny, and count on the court itself (ie, judge) not to dig any deeper.

            • some_furry

              today at 3:32 PM

              Right, but since that's the world we have today, our threat models should all account for it until we can meaningfully change things.

          • giantg2

            today at 3:13 PM

            Do you have a ruling that says they can't used purchased data?

      • alistairSH

        today at 1:42 PM

        How would they select which women get warrants served if they don't have some basic cycle-tracking data?

      • pdpi

        today at 1:38 PM

        You can't (in theory) get a warrant "just because", you need to state the grounds for the search in your application for a warrant.

      • 2ndorderthought

        today at 1:32 PM

        What reason would they have to ask for a warrant without that data?

  • 2ndorderthought

    today at 1:31 PM

    Meta is a defense contractor. They absolutely would do this for money if asked. Just like how a good portion of HN would.

  • blks

    today at 4:25 PM

    To punish people they suspect in abortion, for example.

  • Lapra

    today at 3:46 PM

    The data is already being (ab)used in the UK. https://humanists.uk/2025/06/04/police-access-to-period-apps...

• ndisn

  today at 2:28 PM

  “Reproductive rights” is a loaded term.

  • peen1slicker

    today at 3:11 PM

    This is a very insightful comment. Can you expand on it a little for the rest of the hackers here who might be less smart than you?

I don't have a period, so I'm not the best person to do it, but there really needs to be a solid FOSS alternative to flo. If GNU had more women, it'd probably already exist

• culi

  today at 3:46 PM

  I did a quick review of what FOSS options are currently out there

  https://news.ycombinator.com/item?id=47936103

• TFNA

  today at 2:11 PM

  A comparable FOSS app called Drip has been on F-Droid since forever.

  • xzjis

    today at 2:48 PM

    Drip has a paradoxical flaw: by trying to be extremely inclusive and making a "gender-neutral" app (without the colour pink) to include trans people, it discourages some people from using it. At least, my friend told me she thought the design was ugly and was looking for a "cute" app, so she ended up using Flo instead of Drip despite my many warnings.

    I think FLOSS apps often forget that not everyone is a developer or a nerd who prioritizes privacy and ethics over design, which is a real problem since people end up using proprietary apps that data-mine them.

    • embedding-shape

      today at 2:58 PM

      That sounds not so much as a flaw, as a conscious product decision. And to be honest, doesn't sound like a bad one, not every app needs to work or look the same way, as long as people have choices, they can be responsible for the choices they make. If someone wants a safer but boring app or if someone wants a cute "who gives a fuck about privacy" app, both should be fine.

      • voakbasda

        today at 3:11 PM

        The government does NOT let people have choices in many cases. People should NOT be forced to choose between medical privacy and potential prosecution.

        That your comment even implied that would be acceptable in this context is appalling.

        • embedding-shape

          today at 3:15 PM

          I don't know where you got "the government" from, all I'm saying is that apps should be allowed to have cute designs or boring designs, based on their own judgement, and that people should be allowed to freely choose between those. No one should be FORCED to chose anything, I agree, and I didn't imply anything like that.

    • Hendrikto

      today at 3:16 PM

      Regardless of your opinion on gender and identity politics, surely people can agree that only biological women have periods.

      • mghackerlady

        today at 3:23 PM

        Of course, but treating transgender men like you would a cisgender woman with all the same gendered expectations is both incredibly disrespectful if done on purpose and humiliating for someone who very much does not want to be treated as a woman despite having a period that most likely already makes them very uncomfortable and dysphoric

        > only biological women have periods

        generally, yes, but there are so many edge cases there with intersex people that it is far easier and more inclusive to just say roughly 50 percent of the human population has periods and avoid having to deal with the million asterisks that come with that statement

      • freirin

        today at 4:13 PM

        Not quite! While trans women obviously don't have menstrual cycles a good chunk of the population suffer from period-like symptoms/PMS just due to similar hormonal fluctuations.

      • awlpod

        today at 3:30 PM

        [dead]

    • mghackerlady

      today at 3:18 PM

      I think this could easily be fixed by allowing themes of some kind

• gabeyaw

  today at 2:15 PM

  https://www.my28x.com/ I recently heard a talk from this founder. It's free and local, but don't think it's OSS. They have a high ORCHA rating, but waiting to see if they keep their business model this way

  • embedding-shape

    today at 2:56 PM

    How does the sharing between partners happen with 28x, or is it literally local-only as in "solely for one person and no way to share with partner"?

• xorvoid

  today at 2:09 PM

  I don't know how many more examples people need to see of big tech not respecting privacy... it's just becoming a farce now. Big tech tracking woman's cycles? Of course they are. (sigh) If this doesn't gross people out enough to seriously pursue alternatives, I literally don't know what will.

I don’t have the right configuration of equipment to use an app like this, but does anyone know why this needs to be a service-driven app? What piece of functionality requires a server to track your health?

• embedding-shape

  today at 1:38 PM

  My partner uses the app this article is about (Flo) and I have an account there too in order for her to share the data with me.

  I guess you could do it with some sort of P2P sync with cryptography involved locally instead, and/or E2E for stuff sent via the servers. Kind of surprised me they didn't have E2E already, but I guess I shouldn't be surprised anymore.

  • JohnFen

    today at 1:41 PM

    Or, you know, she could just track it without any app at all and share it with you in person.

    • dwedge

      today at 2:54 PM

      You could also be snarky without internet access

    • coldpie

      today at 2:52 PM

      Computers are useful tools that do useful things for people. It is reasonable for people to want to use them to do things they find useful. They don't have to function like spy devices, but we've chosen to highly reward the people who have turned them into spy devices, so they do. We could choose to do something else with them instead. For example we could pass & enforce privacy regulations so they cannot function as spy devices. Or we could wheel out the guillotines so there are appropriate consequences for the creeps and sociopaths who choose to build and work at places like Facebook. Whichever, I'm flexible.

    • embedding-shape

      today at 1:44 PM

      [flagged]

• jumpconc

  today at 12:49 PM

  The spying part requires a server.

  If you use GrapheneOS, you can enable or disable internet access for each app.

  • embedding-shape

    today at 1:39 PM

    > If you use GrapheneOS, you can enable or disable internet access for each app.

    Not sure what information you're expecting the app in question to surface if you disable internet access for it.

    • antiframe

      today at 3:28 PM

      An error? It's useful to know if/when an app wants to access the Internet. So if an app says it's local only you can disable network permissions. Trust but verify.

    • bonoboTP

      today at 3:43 PM

      Locally stored info

• toast0

  today at 1:16 PM

  I'm not familiar with this app, but a service lets you do potentially nice things like cross device sync and sharing observations with trusted others.

  • 3form

    today at 1:41 PM

    I'm assuming the question should be further refined to "why does the service need to know the data". The things that you mention could be done with the service only having the encrypted blob.

    • array_key_first

      today at 4:17 PM

      Encryption is more work than not-encryption, and most software is optimally lazy and barely functional. The main goal of the developers is to make the app almost work most of the time, and not crash too much or be so inconvenient that users delete it. Anything past that is extra, and businesses don't pay for extra.

• thephyber

  today at 1:12 PM

  Better revenue model? Pushing some data to the server, serving ads to the app, reselling demographic data, etc all allow for more revenue than just the price of installation.

  There are almost certainly other apps in the space that don’t need a server, don’t phone home to Meta, and are lower priced, but they probably aren’t as good at marketing.

  From my experience in the startup world, I would wager that this developer probably wanted to track marketing campaign installs (Meta library is required to close the loop on Facebook/Instagram ad conversions after app install) or wanted a feature from some Meta library they integrated but didn’t realize or care about the consequences.

• newtwentysix

  today at 1:58 PM

  Like notes apps, reminder apps, etc, data from almost everything we do on phone is saved in cloud. That data is their business fundamental. Same with this app also.

• alistairSH

  today at 1:44 PM

  Not being a women, I've always wondered what insight the app gives regardless of data traveling to a server... does it do anything you can't do with a simple notebook app (like Apple's default Notes)?

  If you have an irregular period, does this app help "guess" when it's going to start/end?

  If you have a regular period, why do you need an app at all?

  • natbennett

    today at 1:58 PM

    Like most data entry software there’s nothing that unstructured notes (or paper) can’t handle.

    The main useful feature of the apps (or Apple Health’s tracker which is entirely adequate) is that it sends reminders on the estimated period start date, and then a few days afterwards if you haven’t recorded the end date.

    Even “regular” periods often aren’t perfectly regular, or can become irregular when they were regular. (Which is often very important health information.)

    It also automatically calculates median period length and typical variation/range.

    All unnecessary for some people but very useful for others.

    • eszed

      today at 3:36 PM

      > median period length and typical variation/range.

      This was what my partner found useful to share with her doctor while trying to figure out a medical issue. Of course it could have been done typing dates and notes into excel, and manually creating charts, but the chance that she (or most people) would consistently follow that workflow (pun not intended, but I like it) is nil.

• CGamesPlay

  today at 2:46 PM

  It doesn’t? You could easily install the tracker on the client app, no need to do it server side. In fact I bet the app in question (Flo) was doing the upload to Meta client-side.

  • embedding-shape

    today at 3:00 PM

    > It doesn’t?

    I'm guessing P2P technology isn't really sufficiently easy for developers yet, so when you have two users using an app that are supposed to share something between the two, most of us default to building server-side services. That + the "dynamic" list of articles and "help" Flo offer I'm guessing is the main reason for them having servers in the first place.

• ozlikethewizard

  today at 1:36 PM

  I have actually been playing around with scoping a privacy first version of these tracking apps that store all the data locally with optional sync. It's technically possible, but there's very little in the way of revenue generation there. So it's same issue as always, capitalism corrupts.

This one seems clear cut as a HIPAA violation. Glad to hear that interpretation was upheld.

However, regardless, we really need to just kill the data broker business model.

Speaking as someone who implemented GDPR for my startup when the law first came into effect, there were certainly rough edges.

But the core premise that you simply cannot sell user data to sub-processors without consent is a powerful one that I believe would fix a lot of broken things in the US system.

(Not least because the USG buys private data that would be unconstitutional for it to directly collect, but also things like the incentives for your cell phone provider to sell your location data to advertisers.)

• haldujai

  today at 4:23 PM

  > This one seems clear cut as a HIPAA violation. Glad to hear that interpretation was upheld.

  Health and wellness apps aren’t covered entities under HIPAA so these disclosures are not violations of it.

• russdill

  today at 3:43 PM

  Seriously, we have a country where a large fraction of our ad spend is for services that promise to remove your private data from data brokers. We could literally just pass laws so companies could not do this.

• Cider9986

  today at 3:29 PM

  HIPAA makes our medical privacy worse, unfortunately.

  Same video, different platforms:

  (https://odysee.com/@NaomiBrockwell:4/HIPAA:7)

  (https://invidious.nerdvpn.de/watch?v=4sfIBRTcRpU)

  (https://youtube.com/watch?v=4sfIBRTcRpU)

  • culi

    today at 4:32 PM

    Great video, thanks for sharing.

    TL;DW: HIPAA was actually created to allow insurance companies to share patient data without having to get patient consent. Before HIPAA, data was more fractured and less commonly shared. The only privacy protections it offers is, e.g., your doctor not giving your data to your boss. But about 1.5 million private entities can legally access your data (everything from health startups to insurance companies to hospitals)

Why would anyone think that a non-HIPPA compliant app would keep medical information private to the level of security needed for medical data? Flo has definitely breached user trust, but that trust seems misplaced from the get-go.

• gizmo686

  today at 12:42 PM

  People are used to living in highly regulated markets. When they go to a grocery store to buy lettuce, people don't stop to ask "what regulatory regime is this lettuce being sold under?". They just trust that food being sold in a food store will meet our societal standards for food. I can go to Amazon and order a raw steak for delivery, and still trust it will meet standards.

  The situation with wellness apps is that they are a product that are designed specifically to exist outside of the regulatory regime that people associate with them.

  • tissuefarmer

    today at 1:00 PM

    [dead]

• john_strinlai

  today at 12:36 PM

  >Why would anyone think that a non-HIPPA compliant app would keep medical information private to the level of security needed for medical data?

  because lots of people dont know what HIPPA is, and (naively to us more familiar with tech) assume that a medical-related app on a curated app store would be safe for medical-related stuff.

  • ceejayoz

    today at 12:40 PM

    > lots of people dont know what HIPPA is

    Ironically, it's HIPAA.

    You're right, though; it's much more limited than people think. During COVID people claimed everything violated HIPAA (masks, vaccine requirements, testing), but it only applies in a very narrow subset of patient/provider relationships.

• xbar

  today at 2:53 PM

  "Because Apple and Google said my data was safe, so it must be safe in the apps. What's hippa?," said more than 50% of the population.

• elAhmo

  today at 12:44 PM

  People just wanna track stuff, they don't really look into is something HIPPA compliant or read the ToS. App store push, recommendation, word of mouth are what makes the app like this spread, not really details HIPPA compliance.

Now is a good time to bring up.

https://bloodyhealth.gitlab.io

A secure open source period tracking app.

It's really sad that we have all this technology but we can't trust any of it.

• jumpconc

  today at 12:50 PM

  I'll make a period tracker for you for 5 bucks a month. You won't buy it, because it costs 5 bucks a month. So I'll have to find alternative monetisation strategies.

  • deltoidmaximus

    today at 1:11 PM

    Why would me giving you 5 bucks a month assure you didn't also sell all of the data from the period tracker app? That's money you'd just be leaving on the table.

  • nemomarx

    today at 1:13 PM

    Doesn't flo charge ten dollars a month?

    https://help.flo.health/hc/en-us/articles/4411278780564-What...

  • GuinansEyebrows

    today at 4:35 PM

    there is a third option: don't make one at all if you feel your only recompense involves selling this data. that's what creeps do.

  • postalrat

    today at 1:06 PM

    Nobody is going to trust your $5 a month service.

  • mghackerlady

    today at 1:59 PM

    why does it have to be 5 bucks a month and not a one time purchase?

• Schiendelman

  today at 1:28 PM

  I think that kind of thinking is similar to the "both sides" stuff in politics. There's a meaningful difference in trustworthiness between different options.

  For instance, if you need to track your period, the built in iOS apps are secure, especially if you're using advanced icloud encryption.

  • JohnFen

    today at 1:48 PM

    The trouble is that it's literally impossible to tell what applications are trustworthy and what applications are not, or whether they'll remain trustworthy over time. So you have to treat them all as untrustworthy. It's a fair rule of thumb because the majority of them can't be trusted.

That's incredibly creepy.

> It seems like we can’t just necessarily leave it up to companies – or their ragtag teams of crackpot lawyers rewriting privacy policies every few months – to keep our private data private.

It's not a medical requirement from a doctor, so just keep a diary if you want to. Not everything needs to be an app. All the money spent on regulations and regulators to cover increasingly niche opt-in services that are entirely unnecessary is a waste.

• ksenzee

  today at 1:03 PM

  I've never used Flo specifically, so I don't know what kind of data analysis it has available, but period data is the #1 most useful health data to have an app crunch for you, and "your period starts tomorrow" is a pretty darn useful notification to get.

  • JohnFen

    today at 1:44 PM

    Most of the women I know well enough to know this about them track and predict the onset of their next period without needing an application. It isn't exactly rocket science.

    • newtwentysix

      today at 2:02 PM

      Well, until some years ago we remembered dozens of phone numbers, birthdays, routes, physical addresses, due dates, etc.

      The trick is to "give a tool for 1-2 generations of customers" , and then they'll be fully dependent on the tool.

      • dylan604

        today at 2:55 PM

        1-2 generations? give an advanced anything to anyone with no true knowledge of how to do it without the tool and you'll have people fully dependent in hours.

        kids today cannot navigate without turn-by-turn. nobody looks at the map to get names of major streets, they just blindly follow the directions. I learned how to navigate as a kid just by being bored and staring out the window and being able to recognize things. Now, kids don't even look out the window as they keep their heads down and eyes glued to a screen.

  • embedding-shape

    today at 1:41 PM

    We're using Flo specifically, mostly for sharing stuff like "her period starts tomorrow" to the both of us, she doesn't really need a notification for that :)

• today at 1:03 PM

• justonceokay

  today at 1:07 PM

  Even if it was a requirement, doctors do not generally have legal authority to compel action. Hell, the average doctor would probably agree that the average patient hardly ever does what they’re told…

• johnny22

  today at 12:04 PM

  privacy legislation would just solve the problem by itself though.

  • Zak

    today at 12:11 PM

    Privacy legislation by itself does not solve the problem; what Flo did was already illegal. Effective enforcement is also necessary.

    • kortex

      today at 12:49 PM

      They need to make an example out of these companies. If your whole business model is built around handling sensitive data, and you are caught shipping off that data to brokers, you should be liquidated or at least fined to within an inch of bankruptcy, as basically all of your profits are a sham.

      • inetknght

        today at 1:11 PM

        Fined into bankruptcy and all managers up to and including the CEO criminally charged.

        • bombcar

          today at 1:16 PM

          There needs to be penalties that piece the "limited liability" because otherwise it's just "pay to get away with it" as we currently have.

          I've been for a "corporate death penalty" (if companies are people, they can be executed) which would result in the shareholders losing everything along with executives being perp-walked.

          • ndriscoll

            today at 1:39 PM

            Not just executives. They don't will these things into existence. Someone had to build functionality to send user data to Facebook.

  • ceejayoz

    today at 12:05 PM

    They've been thumbing their noses at EU privacy legislation and fines for quite some time already.

    • arijun

      today at 12:34 PM

      What does thumbing their noses mean? They have been paying while continuing their behavior, or not paying at all?

      The first seems like it could be resolved with an escalating fine schedule, and the second could be mitigated by requiring Apple/Google to remove it from the app store (one of the rare cases walled gardens are on consumers' side).

      • ceejayoz

        today at 12:37 PM

        > What does thumbing their noses mean? They have been paying while continuing their behavior, or not paying at all?

        Malicious compliance. For example: https://en.wikipedia.org/wiki/Epic_Games_v._Apple

        "While Apple implemented App Store policies to allow developers to link to alternative payment options, the policies still required the developer to provide a 27% revenue share back to Apple, and heavily restricted how they could be shown in apps. Epic filed complaints that these changes violated the ruling, and in April 2025 Rogers found for Epic that Apple had willfully violated her injunction, placing further restrictions on Apple including banning them from collecting revenue shares from non-Apple payment methods or imposing any restrictions on links to such alternative payment options. Though Apple is appealing this latest ruling, they approved the return of Fortnite with its third-party payment system to the App Store in May 2025."

        Or https://developer.apple.com/support/dma-and-apps-in-the-eu/

        "UPDATE: Previously, Apple announced plans to remove the Home Screen web apps capability in the EU as part of our efforts to comply with the DMA."

        (This one resulted in enough fuss they backed down.)

        • arijun

          today at 1:00 PM

          Ah you mean generally, not in this specific case.

        • today at 1:13 PM

  • ceejayoz

    today at 1:09 PM

    > privacy legislation would just solve the problem by itself though

    Just like banning drugs and murder did!

  • krystalgamer

    today at 12:30 PM

    "would just solve", lol.

• SlinkyOnStairs

  today at 1:09 PM

  > All the money spent on regulations and regulators to cover increasingly niche opt-in services that are entirely unnecessary is a waste.

  That isn't what's happening. The regulations don't get little niche cases added to them, they're writen to be generally applicable to all niches.

  > It's not a medical requirement from a doctor, so just keep a diary if you want to.

  "Just don't use the computer if you don't want companies to rat you out to the fascist government that'll imprison or kill you for having a miscarriage" is a ridiculous victim-blaming position.

  It's the practical reality of a fascist government that they won't enact privacy laws. And yes, women really shouldn't be using period tracking apps in the US, or made by the US. But that doesn't mean privacy laws are some "silly waste of my tax money".

  It's not a "medical requirement" except for the many many many cases where it is. Similarly, this position extends to literally everything. Nothing "needs to be an app". But unless we want to pack up and discard the entire software industry, it really ought to be better about privacy like this.

• sdoering

  today at 12:04 PM

  Why is it a waste? If you want to provide an app, one should follow the law and the regulations. It isn't the wild west (and even that had regulations).

  Also: Why blame the victims, not the perp?

  • kakacik

    today at 12:19 PM

    Nobody is blaming victims, please stop these wild fabulations. OP meant that you can't trust app owners especially long term, as you write its worse than wild west, literally nobody.gives.a.fuck. till they are dragged to the court, then they fight, dissolve company, still sell the data, start a new one and rinse and repeat. People are simply way more greedy than moral on average if there is any lesson in current times.

    Look at say zuckenberg - a typical sociopath lying again and again through his nose with big grin just to get what he wants (ie scandals how FB employees go to DB to spy on their exes or enemies is popping up for 10 years at least and there is no stop, every time there is another assurance how it can't be done now blablabla... and thats just specific meta employees).

    Nobody likes that, but just sitting and waiting for almighty regulators while blindly trusting apps in good faith to do their jobs is... not working much, is it. Be smart, adapt to real environment out there, not some wishful thinking. In parallel push for change as much as you can, vote with wallet and your time. Once sought-for paradise comes then feel free to use anything anyhow. At least that seems like smarter approach to me.

    • ndriscoll

      today at 12:32 PM

      > still sell the data

      So add liability for the buyers of the data or any services derived from the data (e.g. targeted ads). Make it so large advertisers demand audits showing privacy laws are being followed. Also have personal criminal liability for people building and maintaining systems that collect, store, or process data for illegal purposes. Executives, PMs, engineers, the whole lot. Put them in prison if they continue.

• HumblyTossed

  today at 1:34 PM

  Forest for the trees, dude.

its crazy to me that Flo is used so widely, as its started by Russian men and their treatment of data has bee public for a while, it just hasnt spread fast enough. I know theres at least one other option called Calessa (http://Calessa.app)

• sevenseacat

  today at 3:01 PM

  There's a whole heap of different period tracking apps these days. I've been using Clue for probably a decade.

Does anyone happen to know if Meta and Google have ever recovered these judgements from the app developers? All of the industry terms of service specifically forbid SDK licensees from sending sensitive personal data to the platforms, and they require the licensee to indemnify the platform against any judgement that arises from violating those terms. See Meta's statement on this verdict, which seems pretty reasonable to me. This 100% looks like the fault of the app developer:

“User privacy is important to Meta, which is why we do not want health or other sensitive information and why our terms prohibit developers from sending any.” Meta maintains that any transmission of sensitive health data is due to a failure to comply with its terms of use.

• ozlikethewizard

  today at 1:37 PM

  I mean this seems like an attempt at a get out of jail free card. If meta didnt want this info, why are they accepting and processing it?

  • jeffbee

    today at 1:43 PM

    It's just a generic key-value API.

    • ndriscoll

      today at 1:47 PM

      That doesn't answer the question. It just restates the problem. Why aren't they doing diligence on what they're accepting from their business partners, or what types of partners they're working with? There's no reason they couldn't know the company deals with health data and place it under additional scrutiny.

I don't actually see this as a problem, and instead it's a PSA everyone needs to internalize:

If you put data onto a networked device it may be sent to some place else.

If you don't want your data being shared:

Use a device that does not have any networking capability (both hardware and software wise)

Use a pen and paper, you can shred and destroy as you see fit.

If you're using an application on a mobile device with mobile data/wifi, the chances are, your data is being uploaded.

• elsjaako

  today at 12:43 PM

  There are four open source period tracking apps on F-droid. I didn't do a full investigation of the source code, but unless your data is being uploaded outside the app (e.g. for backups), I feel safe assuming it will stay local only.

• reorder9695

  today at 12:53 PM

  It sounds like the real solution to this is to be able to control permissions at an OS level for network per app, as you would be able to do if you had root access. I have no idea why regular Android distros don't allow you to do this, it seems like a really sensible thing to expose in app settings given the permissions model of Android.

• tsukikage

  today at 1:03 PM

  Also: if you are not paying the service provider for the service, you are not their customer - you are their product.

  • nemomarx

    today at 1:20 PM

    If you do pay for a subscription, how can you be sure you're still not the product? What stops them from double dipping here?

    • loudmax

      today at 1:28 PM

      If you're paying for a subscription, the company might sell your data. If you're using a commercial service for free, they are certainly selling your data.

      Having said that, you're right to be suspicious of commercial services, even that you pay for. Someone can found a startup with a strong commitment to customer privacy and the best of intentions, but a few acquisitions or near bankruptcies later, those commitments will go out the window.

      • nemomarx

        today at 1:30 PM

        Relevant to this case, since they have a free version and premium one, they would probably just sell data from both sets of customers. It would be leaving money on the table otherwise, right?

        The small chance that they might go out of their way to not sell premium users data doesn't seem worth much.

  • nozzlegear

    today at 1:38 PM

    Flo isn't free though, you have to pay a weekly/yearly subscription to use it.

• boesboes

  today at 12:39 PM

  that is a really fucked up view

  • defrost

    today at 12:45 PM

    Less a f-u-view, more a f-u-world, the above is pragmatic advice about the actual IRL challenges of keeping data secure.

    Further, a view that ignores many real world digital data risks faced by those considered to be useful targets; eg: compromised supply chains delivering "pre hacked" hardware with discreet wifi chips or hidden out of band comms, etc.

  • dspillett

    today at 2:19 PM

    Nah. A healthy view when dealing with the fucked up situation that is modern life.

• vachina

  today at 1:12 PM

  You can use a networked device, but make sure the data is stored somewhere you control (and own).

[dead]

[flagged]

• dspillett

  today at 2:18 PM

  That ridiculous bit of “modern” slang… that has been in use for a few hundred years?

  Not a word I use much myself except when referring to “yappy little dogs”, but it is definitely common among those the generation above me and that above them.

• rocketpastsix

  today at 2:41 PM

  seriously? a single word is going to prevent you from reading an article that is well informed and well articulated?

[flagged]

• terrut

  today at 12:20 PM

  My apps are free or freemium with a one time payment. I just started publishing, and my main drive is resentment towards the current state of surveillance in software. It doesn't have to be filled with ads and trackers on top of a subscription.

  • tasoeur

    today at 12:25 PM

    I’ve also started publishing a small collection of what I call “spite apps” (a reference to Larry David’s spite store when he makes his own coffee shop to go against mocha joe).

    These apps are super simple in terms of privacy policy: - we don’t track you (no telemetry) - we don’t show you ads - no account - free with optional tip

    Sure I don’t make much money with them but I feel like I’m pushing back on making humanity worse.

• Zak

  today at 12:09 PM

  I need a way to make money too, but we have laws saying I can't do it by hitting you over the head with a club and taking yours. We also have laws saying Flo can't do it by lying about who they sell private data to.

  I would advise anyone tracking medical data with an app to use something open source and local-only or network-optional if at all possible. I know there are open source cycle tracking apps, but I do not know if they're any good.

• input_sh

  today at 12:10 PM

  It's not even a free app, there's like a €10/month premium.

• sdoering

  today at 12:03 PM

  “They had to find a way to make money” is not a moral blank check.

  By that logic, almost anything becomes defensible. I was out of work, so I became a contract killer. I had to find a way to make money.

  No. Companies still have to follow the law. They also have the option of being decent and not tracking or sharing intimate data like sexual preferences with Meta, Google, TikTok, and the advertising industry.

  I’ve been asked as a contractor to build this kind of thing. I refused, before and after GDPR. It cost me money. Fine. I can live with that.

  What I cannot respect is people who decide that revenue matters more than basic privacy, then hide behind “business needs” as if that ends the conversation.

  • duskdozer

    today at 12:21 PM

    >By that logic, almost anything becomes defensible. I was out of work, so I became a contract killer. I had to find a way to make money.

    Ah, see, that doesn't work because you're a person not a company. The company had to find a way to make money, that's why they denied your chemotherapy. Tough luck for you.

• wat10000

  today at 12:04 PM

  A better way to put this is: if it’s free, you’re the product.

  • duskdozer

    today at 12:22 PM

    If it's not free (like the app Flo Premium), you're still the product.

  • rocketvole

    today at 12:21 PM

    where do open source apps fit into this philosophy?

    • jumpconc

      today at 12:52 PM

      You're the guinea pig