Live data from Hacker News

The privacy problems hidden in your period tracker

bbc.com

21–30 of 73 posts

Re: The privacy problems hidden in your period tracker

#21

RudderStack founder here. Although the article doesn't accuse us of doing anything improper, we weren't contacted for comment, so I'd like to clarify our role. We are customer data infrastructure, not a data broker. We do not buy, sell or monetize the customer data that passes through our systems. Our role is analogous to infrastructure: customers choose what data to send, and RudderStack routes that data to the dest…

[deleted]

Re: The privacy problems hidden in your period tracker

#22

Whenever this issue comes up I feel the need to relay a story about a meeting with a databroker in 1998 who was tracking menstrual cycles using purchasing records of a wide variety of consumer goods. They will track you to optimize their manipulative, targeted advertising whether you have an invasive app or not.

I've heard rumors, maybe that far back, of women getting mail ads for baby clothes a couple weeks before having a positive pregnancy test.

You are misremembering, what it you're referring to is the Target pregnancy prediction score which was advertised a lot in the early 2010s as the way "big data" was going to change the world because they figured pregnant women bought similar things

https://www.forbes.com/sites/kashmirhill/2012/02/16/how-targ...

Re: The privacy problems hidden in your period tracker

#23
Why not something p2p and encrypted? https://peerloomllc.com/pearpetal/ No servers, no problem. You fear losing your device? I'm sure you have more than one, any additional one you have is a fully functional backup.

The technology it is built on is extremely cool. http://pears.com/

Or better yet. Why trust this one (even though the source is on github)? You can just ask your AI agent to build you your custom one on the basis of this technology.

Re: The privacy problems hidden in your period tracker

#24
post #16

RudderStack founder here. Although the article doesn't accuse us of doing anything improper, we weren't contacted for comment, so I'd like to clarify our role. We are customer data infrastructure, not a data broker. We do not buy, sell or monetize the customer data that passes through our systems. Our role is analogous to infrastructure: customers choose what data to send, and RudderStack routes that data to the dest…

The article did not accuse you of anything and went so far as to say “There's nothing unlawful going on, and there's no reason to think RudderStack (or any company mentioned in this story) is doing something nefarious.” I’m struggling to understand why you would feel the need to comment. Or why you even think the BBC would have contacted you. This is one of those moments in PR where a response with no reason makes re…

My concern is that terms like "data management company" (and another article described us as an "analytics company") are broad enough that many readers could reasonably infer we're collecting, storing, or monetizing sensitive end-user data.

I wanted to clarify that distinction because we've already had people reach out asking whether we were involved in collecting or using this data.

Its bad PR for us

Re: The privacy problems hidden in your period tracker

#25
post #13

RudderStack founder here. Although the article doesn't accuse us of doing anything improper, we weren't contacted for comment, so I'd like to clarify our role. We are customer data infrastructure, not a data broker. We do not buy, sell or monetize the customer data that passes through our systems. Our role is analogous to infrastructure: customers choose what data to send, and RudderStack routes that data to the dest…

Awesome insight. Thanks for clarifying! @bbc please update because there's definitely an implicit complicity in your article.

Will do. Thanks

Re: The privacy problems hidden in your period tracker

#26
post #15

RudderStack founder here. Although the article doesn't accuse us of doing anything improper, we weren't contacted for comment, so I'd like to clarify our role. We are customer data infrastructure, not a data broker. We do not buy, sell or monetize the customer data that passes through our systems. Our role is analogous to infrastructure: customers choose what data to send, and RudderStack routes that data to the dest…

Are analytics tools, data warehouses, and marketing platforms the only types of destinations you support? Because if that's the case then your system appears to only be useful for privacy invasions.

[deleted]

Re: The privacy problems hidden in your period tracker

#27

I use Macrofactor (macro tracking app for lifters with good privacy/UI) as a weight/period tracker, and occasional macro tracker. I don't think anybody is going to go to the effort to hack their databases to find the 100 women tracking our periods on it. The one downside is that they do days since last period as days since the end of your last period, not days since the start, unlike literally every woman and gynecol…

MacroFactor is very rare in the modern software world, probably because it was created by fitness science junkies rather than VCs or engineers. Greg was extremely adamant from the start that they're charging money, take it or leave it, but selling the product itself is all they're ever going to sell. No monetizing user data. No dark patterns to drive engagement and keep you in the app. All they're trying to drive is…

Greg isn't the only person who owns MF, there are people like Nippard who call it (my app and are either shareholder or promoter with a lot of influence), if you look at the whole hussein and julian fiasco and solomon nelson episode well...

This is kinda misleading. First of all, MacroFactor uses the Gemini API for photo to calorie/macro estimation, so the data does leave their premises. It does not work completely offline, so it does call home, and after that, you never really know what happens with the data.

MacroFactor charges roughly $70 a year. MacroCodex is free and doesn't require an internet connection to work. It can also offset random weight gain due to PMS or other short term hormonal cyclical issues, as well as other water retention issues. It doesn't even ask for your phone number or email or even date of birth!! (it just asks age) on Android. On the web app, an email is required only for storing your data (due to the volatile web storage offered in PWAs, where the OS/browser can evict storage under memory pressure).

If an app doesn't collect your personal identifiable data it cannot sell it, if it's capable of running offline it can be put behind a firewall rule and/or diagnostic/telemetry data disabled in setting though i'd argue if it's not collecting your personal info and want data for improvement of specific app feature (which benefit from data analysis) then you should perhaps analyze the risk of this decision.

Re: The privacy problems hidden in your period tracker

#28
This is the second time [1] that analytics in period apps have been problematic, and also follows the recent hack of MixPanel [2] exposing OpenAI usage data. Seems like 3rd-party analytics are becoming a new frontier for security issues.

[1] https://www.thebureauinvestigates.com/stories/2025-09-03/met...

[2] https://openai.com/index/mixpanel-incident/

Re: The privacy problems hidden in your period tracker

#29
Period trackers are the perfect usecase for homomorphic encryption, where the system can operate on the data without knowing what the data says. It's slow and has a lot of overhead, but it's an active area of research. That way, the platform doesn't know what you're telling it. You have to trust the platform to have implemented it properly, and it's rather nerdy a detail, so it's no surprise there isn't one yet.

Re: The privacy problems hidden in your period tracker

#30

Period trackers are the perfect usecase for homomorphic encryption, where the system can operate on the data without knowing what the data says. It's slow and has a lot of overhead, but it's an active area of research. That way, the platform doesn't know what you're telling it. You have to trust the platform to have implemented it properly, and it's rather nerdy a detail, so it's no surprise there isn't one yet.

I love this stuff, even though its way over my head

> We are a community of researchers and developers interested in advancing Fully Homomorphic Encryption (FHE) and other secure computation techniques.

https://fhe.org/

(edit: formatting)

Post reply on HN