Period tracking app, Flo, found to be selling user data to Meta(femtechdesigndesk.substack.com) |
Period tracking app, Flo, found to be selling user data to Meta(femtechdesigndesk.substack.com) |
If you put data onto a networked device it may be sent to some place else.
If you don't want your data being shared:
Use a device that does not have any networking capability (both hardware and software wise)
Use a pen and paper, you can shred and destroy as you see fit.
If you're using an application on a mobile device with mobile data/wifi, the chances are, your data is being uploaded.
| I don't actually see this as a problem
Okay, go on, perhaps you have an interesting point
| and instead it's a PSA everyone needs to internalize
If it's not a problem, it's not a PSA because nobody needs to know or care. If it's something worthy of a PSA, then it must stem from a problem.
Further, a view that ignores many real world digital data risks faced by those considered to be useful targets; eg: compromised supply chains delivering "pre hacked" hardware with discreet wifi chips or hidden out of band comms, etc.
It's not a medical requirement from a doctor, so just keep a diary if you want to. Not everything needs to be an app. All the money spent on regulations and regulators to cover increasingly niche opt-in services that are entirely unnecessary is a waste.
Just like banning drugs and murder did!
Also: Why blame the victims, not the perp?
This is a bit of a revealing phrasing, but I'll bite anyway. If someone shot themselves in the toe because they were being careless, am I blaming the victim by saying that they shouldn't have been careless? Not everything is cops and robbers.
Look at say zuckenberg - a typical sociopath lying again and again through his nose with big grin just to get what he wants (ie scandals how FB employees go to DB to spy on their exes or enemies is popping up for 10 years at least and there is no stop, every time there is another assurance how it can't be done now blablabla... and thats just specific meta employees).
Nobody likes that, but just sitting and waiting for almighty regulators while blindly trusting apps in good faith to do their jobs is... not working much, is it. Be smart, adapt to real environment out there, not some wishful thinking. In parallel push for change as much as you can, vote with wallet and your time. Once sought-for paradise comes then feel free to use anything anyhow. At least that seems like smarter approach to me.
That isn't what's happening. The regulations don't get little niche cases added to them, they're writen to be generally applicable to all niches.
> It's not a medical requirement from a doctor, so just keep a diary if you want to.
"Just don't use the computer if you don't want companies to rat you out to the fascist government that'll imprison or kill you for having a miscarriage" is a ridiculous victim-blaming position.
It's the practical reality of a fascist government that they won't enact privacy laws. And yes, women really shouldn't be using period tracking apps in the US, or made by the US. But that doesn't mean privacy laws are some "silly waste of my tax money".
It's not a "medical requirement" except for the many many many cases where it is. Similarly, this position extends to literally everything. Nothing "needs to be an app". But unless we want to pack up and discard the entire software industry, it really ought to be better about privacy like this.
No-one's saying this, and based on your wording you seem to be trained on some very predictable and narrow corpuses.
> It's not a "medical requirement" except for the many many many cases where it is.
Flo is not a medical device. It's not prescribed. It's just a consumer app, no different medically or legally to writing your feelings diary into Google Keep. If you have an actual medical device app then this would be a problem.
So add liability for the buyers of the data or any services derived from the data (e.g. targeted ads). Make it so large advertisers demand audits showing privacy laws are being followed. Also have personal criminal liability for people building and maintaining systems that collect, store, or process data for illegal purposes. Executives, PMs, engineers, the whole lot. Put them in prison if they continue.
No-one was saying it explicitly. I merely took what you said and re-stated what it concretely meant in the real world.
The generalization to "all computers" is an assumption, but you appear to maintain a narrow view of what is "medically necessary" and just now generalize to things like dairies, so I believe I am correct in asserting that you would generalize this to all "non-essential" software.
Having said that, you're right to be suspicious of commercial services, even that you pay for. Someone can found a startup with a strong commitment to customer privacy and the best of intentions, but a few acquisitions or near bankruptcies later, those commitments will go out the window.
The small chance that they might go out of their way to not sell premium users data doesn't seem worth much.
I've been for a "corporate death penalty" (if companies are people, they can be executed) which would result in the shareholders losing everything along with executives being perp-walked.
The trick is to "give a tool for 1-2 generations of customers" , and then they'll be fully dependent on the tool.
kids today cannot navigate without turn-by-turn. nobody looks at the map to get names of major streets, they just blindly follow the directions. I learned how to navigate as a kid just by being bored and staring out the window and being able to recognize things. Now, kids don't even look out the window as they keep their heads down and eyes glued to a screen.
The first seems like it could be resolved with an escalating fine schedule, and the second could be mitigated by requiring Apple/Google to remove it from the app store (one of the rare cases walled gardens are on consumers' side).
Malicious compliance. For example: https://en.wikipedia.org/wiki/Epic_Games_v._Apple
"While Apple implemented App Store policies to allow developers to link to alternative payment options, the policies still required the developer to provide a 27% revenue share back to Apple, and heavily restricted how they could be shown in apps. Epic filed complaints that these changes violated the ruling, and in April 2025 Rogers found for Epic that Apple had willfully violated her injunction, placing further restrictions on Apple including banning them from collecting revenue shares from non-Apple payment methods or imposing any restrictions on links to such alternative payment options. Though Apple is appealing this latest ruling, they approved the return of Fortnite with its third-party payment system to the App Store in May 2025."
Or https://developer.apple.com/support/dma-and-apps-in-the-eu/
"UPDATE: Previously, Apple announced plans to remove the Home Screen web apps capability in the EU as part of our efforts to comply with the DMA."
(This one resulted in enough fuss they backed down.)
No. In a paper contract, you can scratch off things you don't agree with. You can negotiate.
You can't do that in Ts & Cs. For example, Ts & Cs often unilaterally change with no ability for you to review or cancel or undo. It's trivially easy to write software which uses services without ever agreeing to Ts & Cs. So it's not really a legal contract.
> And that makes sense - otherwise how else do you agree to things or not agree to them?
Through a real negotiation. With a paper contract, that both parties sign, and both parties receive a copy of, and that can't be unilaterally changed.
No, many can feel it beforehand, and you notice it when you go to the bathroom before as well, as certain things change their properties slightly, it's not a "nothing" phase and then "floods out of your body".
It's borderline parody how little education there is for males when it comes to things like this.
You seem to forget that there is about a third of the day when shockingly enough a person is not conscious to feel blood leaking out of them. I mentioned staining furniture for a reason - I promise you that menstruation does not wait for you to wake up to start.
I expect all humans to treat other humans with dignity and respect. I acknowledge that many people will likely fail to meet that expectation, quite often I'm sure. But I'm never going to accept or become an apologist for this asshattery.
It's wrong to violate the privacy and dignity of other people. The correct response when you see people hurting others is not to make up an excuse about "business need", instead some anger, disappointment, and loud condemnation is required.
Stop making excuses for those hurting others so they can make money.
If the authorities that are supposed to enforce GDPR (and other data protection laws around the world) were doing their job, app makers would be a lot more careful with what they embed and what data they send where. Because these authorities don't seem to have been doing anything useful, it's now so normalized that you could probably send a $20M fine to every major app and be right about it.
There are apps that are designed so they literally can’t access your data not because they’re more trustworthy, but because the architecture removes that possibility.
The problem is those approaches don’t map well to common business models (ads, subscriptions tied to engagement, etc.), so they’re much less common.
For instance, if you need to track your period, the built in iOS apps are secure, especially if you're using advanced icloud encryption.
https://help.flo.health/hc/en-us/articles/4411278780564-What...
- around since 2019. Last update 2 months ago
- iOS, Android
- React Native
- around since 2024. Last update 2 weeks ago
- Android
- Kotlin
- around since 2015. Last updated 3 weeks ago.
- iOS and Android
- Dart
- around since 2023. Last updated 2 years ago.
- iOS
- Swift
I think the biggest thing I'd like to see is a data format standard defined. You should be able to "take your data with you" and go anywhere you like. If you decide an app is unethical or if your favorite OSS app stops being updated, it should be simple to switch. Many apps let you export your data. Maybe someone can make a converter between popular proprietary apps and a common data structure spec
I can't accept that premise. They'll take any revenue they can get, including reselling that same data to Palantir or to RFK Jr's health department. Did you skip several periods and then suddenly start having them again? Sounds like you've had an illegal abortion. SWAT raid on your home, incoming. And so on.
“User privacy is important to Meta, which is why we do not want health or other sensitive information and why our terms prohibit developers from sending any.” Meta maintains that any transmission of sensitive health data is due to a failure to comply with its terms of use.
The situation with wellness apps is that they are a product that are designed specifically to exist outside of the regulatory regime that people associate with them.
because lots of people dont know what HIPPA is, and (naively to us more familiar with tech) assume that a medical-related app on a curated app store would be safe for medical-related stuff.
Ironically, it's HIPAA.
You're right, though; it's much more limited than people think. During COVID people claimed everything violated HIPAA (masks, vaccine requirements, testing), but it only applies in a very narrow subset of patient/provider relationships.
.. To be clear, "wired app to standard ad-tech surveillance plumbing, sending concepts like user logged period and pregnancy mode entered, through its pipes, to improve ad revenues through Meta's targeting platform" .. ad-events .. this is the kind of behavior that happened, in plain-ish speaking terms, per what I read in my non-expert capacity.
Q: (answered) Now I want to know who runs (ran?) Flo - can we find their Board of Directors & C-level people on LinkedIn to profile what kind of industries lead to this kind of (I believe) privacy violating behaviors? It's a biased question on my part, as Correlation is not Causality! Onwards ..
My limited, biased, AI-driven research suggests the violating behavior ran from June 2016 through February 2019, and that generally the Company was designed to be consumer-app with subscriptions and is healthcare-adjacent, targeting an unregulated non-HIPPA market.
- INVESTORS = consumer subscription apps with ad-driven growth loops
- BUSINESS MODEL =
(1) free or freemium consumer apps where
(2) growth depends on paid acquisition through Meta/Google/TikTok ad platforms, which
(3) requires sending conversion events back to those platforms to optimize ad spend, and
(4) the SDKs that do this are designed by ad networks to hoover up everything by default.
- EXECUTIVE =
* No Privacy / Data Protection C-level officers during violating period
If the app sold the data to Meta through extremely automated Meta platforms. Doesn't the bulk of legal liability and social backlash lie on the app instead of on Meta?
Like sure if a company is caught buying stolen goods, maybe they could tighten up due diligence, but the actual thief is the main culprit.
I think FLOSS apps often forget that not everyone is a developer or a nerd who prioritizes privacy and ethics over design, which is a real problem since people end up using proprietary apps that data-mine them.
https://bloodyhealth.gitlab.io
A secure open source period tracking app.
However, regardless, we really need to just kill the data broker business model.
Speaking as someone who implemented GDPR for my startup when the law first came into effect, there were certainly rough edges.
But the core premise that you simply cannot sell user data to sub-processors without consent is a powerful one that I believe would fix a lot of broken things in the US system.
(Not least because the USG buys private data that would be unconstitutional for it to directly collect, but also things like the incentives for your cell phone provider to sell your location data to advertisers.)
Health and wellness apps aren’t covered entities under HIPAA so these disclosures are not violations of it.
Same video, different platforms:
(https://odysee.com/@NaomiBrockwell:4/HIPAA:7)
TL;DW: HIPAA was actually created to allow insurance companies to share patient data without having to get patient consent. Before HIPAA, data was more fractured and less commonly shared. The only privacy protections it offers is, e.g., your doctor not giving your data to your boss. But about 1.5 million private entities can legally access your data (everything from health startups to insurance companies to hospitals)
At this point I am a privacy nihilist, and I expect all information about anyone to be exploited all the time. Everyone should do the same.
If you use GrapheneOS, you can enable or disable internet access for each app.
This can also be done on Android with certain apps such as Netguard and PCAPDroid
(Using either a blacklist or whitelist approach)
Disabling internet access is not necessarily a hard requirement to stop this type of spying
Controlling what DNS data apps can access, if any, will usually suffice
Not sure what information you're expecting the app in question to surface if you disable internet access for it.
There are almost certainly other apps in the space that don’t need a server, don’t phone home to Meta, and are lower priced, but they probably aren’t as good at marketing.
From my experience in the startup world, I would wager that this developer probably wanted to track marketing campaign installs (Meta library is required to close the loop on Facebook/Instagram ad conversions after app install) or wanted a feature from some Meta library they integrated but didn’t realize or care about the consequences.
I guess you could do it with some sort of P2P sync with cryptography involved locally instead, and/or E2E for stuff sent via the servers. Kind of surprised me they didn't have E2E already, but I guess I shouldn't be surprised anymore.
If you have an irregular period, does this app help "guess" when it's going to start/end?
If you have a regular period, why do you need an app at all?
As for why people may want to track menstrual cycles specifically, it is because bodies can be greatly influenced by what phase of the menstrual cycle we are in. From regular physical and mood changes to disorders like PMDD. The different parts of the cycle can also impact ideal exercise and even food choices for some. There are women and couples who gain insights (and often useful predictions) into how their moods coincide with menstrual phases, and that is much easier to track in a dedicated app designed to do so (which can also flag cycle irregularities, bleeding variation, or other changes), just as with other purpose-built applications. All of that is before we even get to the whole fertility tracking thing. One such app is a certified birth control method in my country. Tracking periods in a notes app is not.
The main useful feature of the apps (or Apple Health’s tracker which is entirely adequate) is that it sends reminders on the estimated period start date, and then a few days afterwards if you haven’t recorded the end date.
Even “regular” periods often aren’t perfectly regular, or can become irregular when they were regular. (Which is often very important health information.)
It also automatically calculates median period length and typical variation/range.
All unnecessary for some people but very useful for others.
You probably don't need to use it if your cycle is completely regular and it doesn't really impact your daily life, but it's not as common as you might think: about 10% of women have PCOS, which is the leading cause of oligomenorrhea; about 10% have endometriosis, which often causes debilitating pain and irregular periods (with a small overlap with PCOS population); 20% to 30% live with PMS - and that's only the portion that has clinically significant symptoms. Even if you were lucky enough to avoid all of these, your cycle length will change as you age, gain or lose weight, and inevitably reach menopause.
Still, you'll have to at least mark the dates. Someone here in the comments compared it to tracking completely optional fitness metrics like sleep or steps, but period data is not really in the same bucket. Just as an illustration: it's hard to see a doctor without being asked "when was your last period?" or "any chance you might be pregnant?", no matter what brought you into the office. In fact, it is such a common experience that it became a subject of many jokes [1]. Also, if you only rely on your memory, you might not notice if/when you do experience changes, some of which might be medically significant.
But let's say you've already decided to track your data somehow.
> what does the app give [...] does it do anything you can't do with a simple notebook app?
Valid question. Some people do just use notes, especially when they don't experience any problems and don't care much about when their next period is coming. But for many others, there are plenty of valid use cases:
1. Reminders for ovulation and next periods. The app can also remind you to enter the data if it thinks you should've had a period but you didn't enter anything. 2. Sharing with your partner. You could, theoretically, write it in a shared document or hand over your paper notebook in person, but it's much easier to see this type of data in a calendar rather than do mental math every time. Having this option gets even more important if you are trying to conceive and track fertility windows. 3. Not having to do the aforementioned mental math is also convenient for the woman herself. A lot of women, even completely healthy ones, experience an array of various unpleasant symptoms in the luteal phase, as well as changes in mood, physical and even cognitive performance during the cycle. It's just really useful to be able to quickly see the calendar and have an idea of what to expect while making your plans (for example, people might want to adjust their workout routines, book a vacation on a more convenient date, or avoid taking extra responsibilities when they know they are going to feel shitty).
And now for those who were not as lucky.
> If you have an irregular period, does this app help "guess" when it's going to start/end?
It does! Though surprisingly, a lot of apps, including Flo, are still abysmally bad at this: they either give you a median of past cycles, at best unhelpfully telling you that your periods are "late," or require you to enter lots of sensitive and subjective data daily to get useful predictions. It is well-known in medical literature that there are other metrics like resting heart rate and skin temperature that are predictive of different phases, especially when they are combined with other data. I've always wondered why the integration with consumer wearables that track a lot of those indicators with good-enough precision is not commonplace. As far as I know, only Apple Health's cycle tracking feature, Samsung Health, and Oura Ring do that among the major players. A few others like Natural Cycles use temperature, but they are all focused on fertility & conception.
That said, using an app like Drip that allows you to export data freely in a universal format can be incredibly valuable for personal analysis. You can find patterns in your data to make your own "predictor" or determine whether certain medications or lifestyle changes were effective. It can also be helpful at your next doctor visit.
[1] https://www.linkedin.com/posts/thefemalelead_wendi-aarons-a-...
I'm guessing P2P technology isn't really sufficiently easy for developers yet, so when you have two users using an app that are supposed to share something between the two, most of us default to building server-side services. That + the "dynamic" list of articles and "help" Flo offer I'm guessing is the main reason for them having servers in the first place.
Term of services are irrelevant as they are breached all the time, major companies are getting fined all the time for it, we must rely on cryptography, not human trust and people needs to stop being surprised the moment they learn that the data they accepted to leave in cleartext is used, that would be a first step toward forcing the change and using proper security standards.
Want a useful action? Let's change the law to force cryptography regarding user data, attestation, SGX or whatever method (there is plenty), that would be a great start, the fact that in 2026 it's still legal to process user chats in plaintext is mindblowing.
This was what my partner found useful to share with her doctor while trying to figure out a medical issue. Of course it could have been done typing dates and notes into excel, and manually creating charts, but the chance that she (or most people) would consistently follow that workflow (pun not intended, but I like it) is nil.
This. Life is busy and some people just want an app to tell them when they're ovulating.
Somewhat. They are allowed to access it "for treatment purposes", not just to nose around out of curiosity.
I found myself explaining this to a number of my patients (I used to be a paramedic) who were irate about disclosures they'd made to their therapist, doctor, etc., that they had said they didn't want revealed to other providers (but were actually germane to their care).
"Does the HIPAA Privacy Rule permit doctors, nurses, and other health care providers to share patient health information for treatment purposes without the patient’s authorization? Answer: Yes. The Privacy Rule allows those doctors, nurses, hospitals, laboratory technicians, and other health care providers that are covered entities to use or disclose protected health information, such as X-rays, laboratory and pathology reports, diagnoses, and other medical information for treatment purposes without the patient’s authorization."
https://www.hhs.gov/hipaa/for-professionals/faq/481/does-hip...
S8.E5 The Package
(https://redlib.catsarch.com/r/seinfeld/comments/168m2d9/anyo...)
I doubt it was a critique of HIPPA, although the episode was published a little under 2 months after HIPPA was signed.
How great would it be for our privacy if they went back to paper records, though.
No, investors have.
This is an important point.
Society did not choose freemium, it did not choose high fructose corn syrup. It was content with the products straight, the way they were.
"Does the HIPAA Privacy Rule permit doctors, nurses, and other health care providers to share patient health information for treatment purposes without the patient’s authorization? Answer: Yes. The Privacy Rule allows those doctors, nurses, hospitals, laboratory technicians, and other health care providers that are covered entities to use or disclose protected health information, such as X-rays, laboratory and pathology reports, diagnoses, and other medical information for treatment purposes without the patient’s authorization."
Source: https://www.hhs.gov/hipaa/for-professionals/faq/481/does-hip...
I agree that it's not and never should be a free-for-all with PHI just "because you can".
But if I, as an EMS provider, are treating someone for, say, an overdose, it is rather germane to my treatment of you that you have a history of suicidal ideation or attempts, even if you'd rather I wasn't able to gather that information from another provider's records (because you'd "rather not" be subject to a mandated hold/evaluation if it appears that your overdose was intentional).
I don't need to know, and don't care, if you're transitioning and I'm seeing you for a seizure, for example, it's not relevant. If you're unconscious and I need to see if I can see history or diagnoses or etc., as I'm determining the risk of an intervention to perform on you, then, I may discover that detail, again, in the course of your treatment.
It's not a blanket "I don't care whether you consent or not, I'm pulling your records from the EHR. Sucks to be you."
You're already contributing a lot of personal investment to society with developing and maintaining FOSS and now you have to feed one of the world's richest companies' bottom line too just to make it available to their particular users? Yeah, no. Most FOSS devs simply won't publish there. Mac and homebrew can already be a pain, but iOS is just evil. Sucks for the users, but that's generally what you get for buying Apple. If they wanted this stuff on their platform, they'd make it easier, not harder. But they care more about making money with other people's software than offering a genuinely good service.
I also do not use any Apple, Google, Meta, or Microsoft products and exclusively use open source software for all of my work.
It turns out none of this is incompatible, everyone just convinces themselves it is.
Step one, and I am serious, is just use cash. Every time you pay with cash at a drug store, a liquer store, a casino, donation boxes, clothes, that is a tiny bit less information corpos and politicians can buy about how healthy you are, what causes you support, and how to manipulate you.
Just use cash, falling back to cash-purchased prepaid gift cards for edge cases like parking. You will pay more attention to how much you spend, you are helping ensure the unbanked can still participate in society, you are opting out of funding surveillance capitalism with your data, and at a busy restaurant you can just leave cash on the table and leave whenever you want.
From there when you are making a quick trip to the grocery store or something, just leave your phone at home.
Meanwhile, keep your phone in airplane mode full time. Use wifi when you must but do not use cell and see if you can go a month or two without actually having to be reachable every second of every day, but only when you choose to be on wifi.
Whenever you are connected to a cell tower your location is being actively documented and sold at all times, and even worse, you are mentally always ready to be contacted, for a new dopamine hit of information or a new decision to make. When it is off, and you know it is off, you can just focus on driving, on thinking, on processing the shit in the back of your head that wont go away on its own.
Anyway, once you are wifi only, and no longer dependent on your phone for commerce, its just a boring wifi tablet. Now, delete your least productive of your top ten ten most used apps every month until your phone is so boring you find you only use it a couple times a day.
At that point, tackle those final things like GPS and flashlight which could be handled by your own brain plus printed maps, paper maps, and an actual flashlight, a mechanical watch... and then you are free to move about the world comfortably without any electronics at all whenever you want.
People will ridicule you constantly for not having a phone, but those are just addicts feeling threatened.
I'm also interested in the mechanics of how you actually do it: for eg. your mention of paper maps for travel makes me think if a lot of that becomes workable because you're in planned cities with reliable maps. I'm a mid sized town in India where maps are vague guides for the general layout, but are missing the many many alleys and connecting roads that people actually live on (or have shops at). Roads, road names, traffic restrictions - pretty much every part of it is chaotic and incredibly hard to put together without a GPS on a digital map.
On the family aspect too, do you have a Matrix or similar for the larger family to connect through and share news on (their own travel for eg., or difficulties they might be having, or news like child birth), or do you only use phone calls or texts to connect?
In any case, I can definitely relate to:
> even worse, you are mentally always ready to be contacted, for a new dopamine hit of information or a new decision to make.
and feel the negative effects of that, so I'll be moving actively towards what you're suggesting. Maybe to a different point on the line and with different workarounds, but it sounds at least 90% workable and with significant benefits too.
If digital maps on GPS know about directions, then so does the internet, and the directions can be printed or jotted down in advance which is my go-to solution in new cities. A little trip planning makes trips safer and less stressful. You also end up remembering it faster. Regularly using a GPS provably atrophies parts of our brains in MRI scan studies. We were evolved to regularly reason about our position in the physical world and making decisions about where to turn from our own memories.
> On the family aspect too, do you have a Matrix or similar for the larger family to connect through and share news on (their own travel for eg., or difficulties they might be having, or news like child birth), or do you only use phone calls or texts to connect?
We helped move all family to Matrix. Most also use Facebook, but everyone worth talking to understands it is not reasonable to ask us to agree to Zucks terms of service to talk to them. They probably created facebook accounts in the first place for the same reason, so we do not feel bad about this ask.
That said we also ported our cell phone numbers to a voip provider so we can still access calls/texts from any wifi device, or DECT phones around our home.
What seems to be lacking, is a FOSS period-tracking app that also lets you share stuff with a partner, which is the reason me and my partner use Flo in the first place.
That your comment even implied that would be acceptable in this context is appalling.
> only biological women have periods
generally, yes, but there are so many edge cases there with intersex people that it is far easier and more inclusive to just say roughly 50 percent of the human population has periods and avoid having to deal with the million asterisks that come with that statement
You don't have to speak like a lawyer.
There is no intersex person waiting to jump out and yell accusatory things at you because you didn't include sufficient asterisks or you said statements that are 99.9999% true.
What's your reasoning for the conclusion of the app looking the way it does due to this and not due to the developer just subjectively preferring this design?
So it's a perfectly conscious choice, and that's exactly what turns off some women who might prefer a cute, pink app. I have nothing against inclusivity, quite the opposite, but in this case they could offer two themes rather than imposing an app that isn't "cute". Even as a man, you can prefer cute things.
> Not another cute, pink app. drip. is designed with gender inclusivity in mindful
so a FOSS community should bimboify their app because your friend wants her data pinkwashed more than she wants her data safe? sounds like a her problem but she could always fork herself
If Drip had a pink theme, I'd use it (albeit I'm fond of their current design, too!).
iOS/watchOS has had period tracking functionality with completely sterile design and people use it just fine.
I would assume that the app isn’t pink because the devs aren’t worried about getting yelled at. The number of intersex people is minuscule compared to the amount of folks that have Opinions about them online.