How private is your habit tracker? What to check before you log your life

Think about what a year of habit logs says about someone. “No alcohol” with a broken streak every Friday. A daily medication check. Bedtimes. A mood score that drops every February. “Cigarettes: 4.” None of it looks dramatic on its own, but together it reads like a health record, and in many apps it sits on a server you’ve never seen, next to an email address.

This guide is about checking where that record goes. It doesn’t name or rate any habit tracker. It describes what has gone wrong in health and wellness apps generally, what the App Store privacy label can and can’t tell you, and how to weigh an app that syncs to the cloud against one that keeps everything on the phone.

Why habit logs count as health data

European law already treats much of this as a special case. Under the GDPR, “data concerning health” and data about a person’s “sex life or sexual orientation” are special categories of personal data (GDPR, Art. 9): processing them is prohibited unless one of a short list of exceptions applies, the most common being the person’s explicit consent for a specified purpose. A habit called “take antidepressant” is not a step count. Whether a given log legally counts as health data depends on context, but the people who wrote the rule clearly had this kind of information in mind.

In the US the picture is patchier. In April 2024 the Federal Trade Commission updated its Health Breach Notification Rule (FTC, 2024) to make clear that it applies to health apps and similar technologies not covered by HIPAA, and it now treats an unauthorized disclosure of identifiable health information, not only a hack, as a “breach of security”.

What has actually gone wrong with health apps

The cases below involve period, prescription and therapy apps, not habit trackers. They matter here because the mechanism is the same one any app can use: a software kit from an analytics or ad company, built into the app, quietly reporting what you do.

• Flo Health (2021). The FTC alleged that the period and ovulation tracker, used by more than 100 million people, promised to keep health data private and then shared it, including the fact that a user was pregnant, with the analytics divisions of Facebook and Google and with other marketing and analytics firms through “app events”. The settlement required Flo to get users’ consent before sharing health data and to tell recipients to destroy what they had (FTC, 2021).
• GoodRx (2023). The FTC’s first case under the Health Breach Notification Rule. It alleged that the prescription discount service shared users’ medications and health conditions with Facebook, Google, Criteo and others, and in 2019 uploaded the contact details of people who had bought heart and blood pressure drugs to Facebook to target them with ads. GoodRx agreed to a $1.5 million civil penalty (FTC, February 2023).
• BetterHelp (2023). The online counseling service allegedly passed email addresses, IP addresses and answers to a health questionnaire (which asked about depression, suicidal thoughts and medication) to Facebook, Snapchat, Criteo and Pinterest for advertising. It agreed to pay $7.8 million for partial refunds (FTC, March 2023).

Researchers find the same pattern when they test apps themselves. Grundy and colleagues (2019) ran 24 top medicines-related Android apps in a lab, fed them dummy data and watched the network traffic.

Those recipients also advertised that they could pass data on to 216 further “fourth parties”. The authors’ summary: sharing of user data is “routine, yet far from transparent.” When Mozilla’s *Privacy Not Included team reviewed 32 mental health and prayer apps in 2022, 28 got its privacy warning label and 25 failed its minimum security standards (Mozilla Foundation, 2022). A year later, about a third had improved, 40% had got worse, and 59% of the apps reviewed got the warning (Mozilla Foundation, 2023).

A private habit tracker checklist: seven things to check

You can do all of this from the App Store page and the privacy policy, before installing anything.

1. Does it require an account? An account links your logs to an email address, and usually means a copy lives on the company’s servers. A sign-in may be worth it for sync, but an app that won’t let you start without one is collecting something from minute one.
2. Where is the data stored? Look for a plain sentence in the policy: on the device only, on the company’s servers, or synced through your own iCloud. If it’s on their servers, check whether they say it is end-to-end encrypted (so they can’t read it) or only “encrypted”, which can mean they hold the keys.
3. Which third parties are in the app? Search the policy for “analytics”, “advertising”, “partners” and “SDK”. Every analytics or ad SDK is another company whose code runs inside the app, which is exactly the route the Flo complaint described.
4. What does the privacy label say? “Data Used to Track You” is the section to read first for a health-adjacent app. Anything listed under Health & Fitness or Sensitive Info in “Data Linked to You” means it leaves your phone tied to your identity. More on reading the label below.
5. What permissions does it ask for? A habit tracker needs notifications for reminders. Location, contacts or your Health data should come with a reason you agree with.
6. Can you export everything? A readable export (CSV or JSON) lets you leave without losing years of history. If there is no export, the app owns your record in practice.
7. Can you delete everything? Deleting the app only clears the phone. If there is an account, look for “delete account” in the app and a statement that server copies and backups are removed. In the EU you also have a legal right to erasure under the GDPR.

One more clause to skim: the one about mergers and acquisitions. It tells you whether your logs would go to a buyer if the company were sold.

How to read the App Store privacy label, and where it falls short

On an app’s App Store page, the “App Privacy” section sorts data under up to four headings. Apple’s summary (Apple, privacy labels) defines them roughly like this:

• Data Used to Track You: combined with data from other companies’ apps, websites or offline sources for targeted ads, or shared with a data broker.
• Data Linked to You: collected in a way tied to your identity, through your account, your device or details like your phone number.
• Data Not Linked to You: collected, but with identifiers removed and not linked back to you.
• Data Not Collected: the developer says the app collects no data at all.

The definitions are stricter than they look. Apple tells developers that “collect” means sending data off the device and keeping it longer than needed to answer the request, that data processed only on the device doesn’t count, and that the label must include what third-party SDKs in the app collect (Apple, App privacy details). So an app that runs ad SDKs can’t honestly claim “Data Not Collected”.

The catch is the word “honestly”. Apple says plainly that the information is self-reported by the developer. When Koch and colleagues (2022) captured the network traffic of 1,687 apps from the German App Store, at least 276 sent data their label did not declare, which suggests label accuracy isn’t checked in app review. Treat the label as the developer’s signed statement. A label full of tracking is a reliable red flag; a clean label is a good sign that still needs the policy to back it up.

On-device vs cloud: what you gain and what you give up

Cloud sync solves real problems. Your history follows you to a new phone or a tablet, it survives a phone at the bottom of a lake, and you never think about backups. The cost is a second copy, readable by the company unless it is end-to-end encrypted, that can be breached, shared under a policy that changes later, or sold along with the business.

Keeping data only on the phone removes that copy, and with it most of the ways things go wrong in the cases above. But it moves the responsibility to you, and it’s worth being blunt about that:

• If you lose or break the phone and have no backup, the history is gone. Nobody can restore it for you.
• Deleting the app usually deletes its data with it.
• There’s no automatic sync between your phone and another device.
• Backups are your job: either the phone’s own backup or a manual export you remember to make.

Also know what your phone backup actually is. On an iPhone, an app’s local data is normally included in the iCloud or computer backup. With Apple’s default “standard data protection”, iCloud Backup is encrypted but the keys are held in Apple’s data centers; only with Advanced Data Protection turned on is it end-to-end encrypted (Apple, iCloud data security). That is a different trust decision from an app company’s server, since you already rely on Apple for the phone itself, but it is not “nobody can ever see it”.

A sensible rule of thumb: the more sensitive the habits, the stronger the case for local storage plus a regular export kept somewhere you control. If you track water and reading, sync convenience may win. If you track drinking, medication or mood, it probably shouldn’t.

What this checklist can’t tell you

Reading a label and a policy tells you what a company claims. Only traffic analysis like Grundy’s or Koch’s shows what an app actually sends, and few people will run that at home. The research also has gaps worth knowing. Grundy’s study covered 24 Android apps in one category, tested in a lab with dummy users. Mozilla’s reviews covered mental health and prayer apps, not habit trackers, and partly rely on how companies answered questions. The FTC cases are allegations resolved by settlements, and they show what can happen rather than how common it is.

Policies also change. An app that is clean today can add an SDK in next month’s update, and the label is only updated when the developer updates it. Re-checking once a year, or when an app suddenly asks you to create an account, is a reasonable habit in itself.

Privacy is one reason to pick a tracker. Whether tracking helps at all is another question, covered in does habit tracking work, and how an app treats a missed day matters too: see what a missed day does to a streak.