privacy-in-practice

Published by Floriva · Updated 2026-07-31 · How Floriva checks its guides

Period Tracking Privacy for Teens and Students

School devices, campus life, family accounts, and first-period tracking. What schools can actually see, what parents can check without snooping, and how to set an app up safely.

A school device is not a private device. A shared family account is not a private account. Most teen period privacy comes down to picking the right device, turning off lock screen previews, and logging less than the app asks for. Parents can check whether an app is safe without ever opening their teen's data.

Tracking a period is a good habit. MedlinePlus says tracking can help you learn your usual cycle and notice changes. ACOG says cycle patterns can help clinicians spot possible health concerns in adolescents.

The tricky part for teens and students is not the tracking. It is the devices. School laptops are watched. Family accounts are shared. Lock screens face the room.

This page covers what a school can actually see. It shows how a parent can check an app without reading anything private. And it shows how to set things up so the app is the smallest part of the picture.

This is not about hiding health from a caring adult. It keeps body data out of places it does not need to be.

1. School devices are the biggest single risk

A school-issued laptop, Chromebook, or tablet runs management software. Apple says MDM can set up devices and send profiles and commands. It can check whether a device follows the organization's rules. It can wipe or lock a device from a distance. Apple also says a supervised device carries an organization profile. That profile controls which features the device can use.

On a school-owned device, administrators can typically see:

• Browsing history. Every site visited is logged. That includes web versions of period trackers, health searches, and clinic websites. Many filters sort sites into categories and flag some of them even when they are not blocked.

• Installed apps and extensions. MDM shows installed applications. On a managed Chromebook, admins see extensions and web apps.

• Search history. Searches in a managed browser signed into a school account are visible through school admin tools.

• Screen activity. Classroom tools such as GoGuardian, Hapara, Securly, and LanSchool go further. They can view screens live and record activity. They can capture screenshots at set times and flag keywords. A tracker open in a background tab can get captured.

Two things people get wrong about this:

Location does not matter. MDM runs at home too. Using a school device on your own Wi-Fi does not turn monitoring off. The logs sync when the device reconnects.

Deleting does not undo it. Clearing browser history on the device does not clear what was already sent to the admin console.

Incognito does not help. Private browsing may skip local history. The school web filter and MDM still see the traffic. Do not rely on it on a managed device.

What is usually not visible: the contents of encrypted connections. The exception is a school that made you install a security certificate. That certificate lets it inspect traffic. Some schools do this. If you were required to install a certificate, assume inspection is possible.

Personal phone on school Wi-Fi. The network can see which servers you connect to. Connecting to a known period tracker's servers tells the network you use that service. It still cannot read what is inside. It cannot see your screen or your app data, unless you installed a school profile on your own phone.

On iPhone you can check for that. Apple says configuration profiles define settings for organization networks or accounts. You can review them under Settings, General, VPN and Device Management. On Android, check Settings, Security, Device Administrators. Also read your school device policy. Look for any school account or management app.

Do not remove a school profile just to hide period tracking. It may break school access or alert someone. Ask a trusted adult if you are unsure.

The practical rule is short. Use a personal device or paper when you need more privacy. Do that when you can without causing trouble. Do not use a school account, a school device, or a school-managed browser for period tracking.

2. School and campus health apps

Some schools offer their own wellness or health apps. Data you put into one may count as an education record under FERPA.

FERPA is about who can access records. It does not stop the school from collecting the data. It does not govern what the vendor does under its own policy. And it does not protect you from a vendor breach.

When a student turns 18, FERPA rights generally pass to the student. That changes access, not collection.

The safest practice is not to enter period data into school platforms at all. Need a school accommodation for a menstrual condition? Work through the school nurse and counselor. Use the normal accommodation process, not a wellness app.

Campus life adds its own copies. Watch for:

Two campus-specific ones worth naming.

Student health center records. Ask the health center how it handles your records. Ask about confidentiality and portal access. Do not assume the answer.

Insurance under a parent's plan. Call the plan and ask what it can do for your account.

3. If you are a parent: audit the app, not the teen

You can check a period tracker without touching your teen's phone. The information is already public.

Do this:

1. Ask which app they use. That is a fair question and does not require seeing entries. Say you want to check the company's practices, not their notes.

2. Read the privacy policy on the maker's site. Look for what data it collects and where that data is stored. Look for who receives it and how long they keep it. The policy is the binding document.

3. Check the trackers. Exodus Privacy scans Android app packages. It lists the tracking kits inside. Common ones are analytics tools and ad kits. An app with many tracking kits has a different data profile from one with none.

4. Check the store labels. Apple says developers provide App Privacy details about what they and their partners collect. Google says the Play Data safety section explains developer statements about collection, sharing, and security. Read both.

5. Check permissions. An on-device tracker should ask for very little. No location, no contacts, no constant network access for basic features.

6. Search for known problems. Search the app name with "data breach," "FTC," and "privacy lawsuit." Documented failures are public record.

Do not do this:

• Do not install monitoring software to watch the app. That repeats the privacy problem you are trying to solve.

• Do not demand their login. The audit does not need it.

• Do not uninstall the app without a conversation. Removing a tool without explanation teaches that their data can be taken at any time.

• Do not read their symptom entries. Teens log mood, sexual activity, and pain. That belongs between them and a clinician.

How to raise it. Lead with what you found, not with fear. "I read this app's policy and it shares data with ad companies" lands better. "Your app is dangerous" does not. Keep it about the tool, not their behavior. And make it a wider lesson, because free apps funded by data collection are a general pattern they will meet again.

One legal note for families. HHS says the Privacy Rule generally allows a parent to access a minor child's medical records. The parent acts as the child's personal representative. That holds when it is not inconsistent with state or other law. State rules differ, especially around confidential care. Ask the clinic what its policy is.

4. Setting up an app safely

Work through this once at setup.

Account.

• Does it need an email address?

• Does it need a real name?

• Does it need a birthday?

• Does it ask for a phone number?

• Can it be used without a social login?

• Can the account be deleted later?

• Can data be exported later?

Use the least information that works. Do not use a shared family email if the teen needs privacy.

Ads and tracking.

• Look for ads inside the app.

• On iPhone, check tracking settings. Apple says you can manage whether apps may track activity across other companies' apps and websites.

• On Android, check ad privacy settings. Google says you can reset or delete the advertising ID, and notes that apps may still have their own settings.

• Search the privacy policy for "ads," "analytics," and "partners."

Turning tracking off limits some future flow. It does not delete old accounts or old records.

Cloud sync and backup.

• Does the app have cloud sync, and is it required?

• Does the phone back up app data?

• Is the phone on a shared Apple Account or Google account?

• Does a parent control the backup account?

• Can data be exported without turning sync on?

Notifications. This is the highest-value setting on the list. Apple explains how to change notification settings and preview behavior. Google says you can control app notifications and what shows on the lock screen.

• Turn off lock screen previews.

• Use neutral reminder text.

• Turn off fertility, pregnancy, sex, and symptom alerts unless they are needed.

• Check watch, tablet, laptop, and car display alerts too.

Again, this is not about hiding health from a caring adult. It is about what shows on a screen in a room.

Family sharing.

• Can a parent see downloads or purchases?

• Is the subscription shared?

• Is Screen Time or Family Link on?

• Is the phone managed by a school?

• Is the device shared with siblings?

• Does anyone else know the passcode?

Family sharing does not show in-app notes on its own. Shared accounts, shared devices, and shared backups do create exposure.

5. Shared phones and first periods

If the phone is shared, treat everything on it as shared. Mark this list honestly:

• Someone else knows the passcode.

• Someone else can open the phone.

• Someone else owns or pays for the phone.

• It uses a shared Apple Account or Google account.

• Family Sharing or Family Link is on.

• It is a school device.

• It backs up to someone else's account.

Any check means shared. Plan accordingly.

For a first period, start small. Most people can begin with just:

• First day of bleeding

• Last day of bleeding

• A flow word: light, medium, heavy

• A pain score

• Whether it affected school

• Questions for a clinician

Skip the rest until you know you need it. Skip photos. Skip location. Skip long diary entries in the app.

Screenshots deserve their own pass, because they travel. Ask: did it save to Photos? Did it sync to a family device? Did it upload to cloud storage? Did I text it to anyone? Do I still need it?

Keep records you still need for care or school before deleting anything.

If a clinic asks for your tracking, send a short summary rather than a full export:

Period start date:
    Period end date:
    Flow:
    Pain:
    School impact:
    Question:

6. Where the app fits, and where it does not

HHS says mobile health apps may be covered by different laws depending on what the app does and who offers it. HHS also says HIPAA usually does not protect health information stored on a personal phone. The same goes for data typed into a personal mobile app. The exception is an app that comes from a covered entity or business associate.

So a period app is not a medical record and does not carry medical record protections. The FTC tells health app developers to minimize data, limit access and permissions, and build in security. You can use that same checklist to judge an app before you trust it.

One last thing that matters more than settings. If someone checks a teen's phone in a way that feels unsafe, a checklist is not the answer. If you are under 18, talk to a parent or guardian first. They can read the school's acceptable use policy and monitoring notices. They can ask the school IT department what monitoring tools are in use. They can ask that health browsing data be deleted. You can also talk to a school counselor, a clinician, or a local advocate.

What Floriva changes

Floriva keeps basic tracking on the device, without a cloud account. That removes one server from the picture and makes an app account one less thing to manage.

It does not change what a school device can see, what a shared account exposes, or what shows on a lock screen. Do those steps too. If you want to try it, get Floriva and read how our data handling works.