Anonymous Mode: The Gold Standard for Female Health Privacy

Yes. 

When you use Anonymous Mode, there is no technical way for Flo to identify you or link your health data to your identity.

Here's what we cannot see:

• Your IP address (hidden by the OHTTP relay)
• Your email, name, or technical identifiers (not collected in Anonymous Mode)
• Any other information that could identify you

Technical verification:
Our implementation of OHTTP has been reviewed by security researchers and is open source, so anyone can verify these claims.

We know many women are worried about how their personal health data could be used in today’s political climate. Let’s be clear: there is no legitimate medical or public health reason for a state government to demand someone’s menstrual cycle data. The only context we are aware of where this could be requested is in connection to prosecuting or intimidating women over their reproductive choices.

Flo has never shared menstrual or reproductive health data with any government, and we are committed to ensuring it stays that way. If a government authority ever demanded access, we would:

• Challenge the request if it was overly broad, unlawful, or aimed at policing women’s health decisions.
   
• Exhaust every legal avenue to avoid or limit disclosure to the absolute minimum required by law.
   
• Protect users through design — features like Anonymous Mode mean your cycle logs aren’t tied to your name, email, or phone number, making them impossible to connect to you personally.

Your reproductive health information belongs to you. Flo will never be complicit in efforts to use it against women.

No. 

When you use Anonymous Mode, no one can identify you — not even Flo.

Here’s how that works:

• The OHTTP relay (operated by Cloudflare) may see limited identifiers, such as your IP address, but it cannot access your health information.
• Your health information is encrypted on your device and sent through the relay to our servers without any identifying details. Since Cloudflare never has the encryption keys, it can’t read or access this data.
• Our servers receive your health data, but they do not receive information that identifies you, so we cannot link the data back to you.

This design ensures that no single party ever has access to both your identity and your health information, making them impossible to connect. This separation is built into the system architecture and cannot be altered without you creating a new account.

Why we designed it this way:
Flo accelerated the launch of Anonymous Mode in response to the U.S. Supreme Court decision to overturn Roe v Wade. We believe that now, more than ever, everyone deserves to access, track, and gain insight into their personal health information without anxiety or concern. 

In addition to robust privacy and security best practices, Flo’s Anonymous Mode introduces an even deeper layer of privacy for reproductive health data.

To enable Anonymous Mode:

1. Open the Flo app
2. Tap your avatar in the top left corner of your screen 
3. Tap "View profile"
4. Select "Anonymous Mode” and read the information about how it works.
5. Tap "Use Anonymous Mode"

Important notes:

• Once enabled, we will create a new account and transfer any non-identifiable data (like your cycle information)
• Your old account will be deleted, and you won’t be able to disable Anonymous Mode for the new anonymous account
• You won't be able to use features that require identity
• Anonymous Mode is free for all users globally

Can I switch back?
To protect your anonymity, switching to Anonymous Mode has been designed so that it is permanent and cannot be undone. Once you have switched, we won’t be able to recover your old account. 

User choice and control are central to how we design Flo. We believe you should be able to decide how you use the app based on your own needs, preferences, and comfort level. That’s why Anonymous Mode is available to all users worldwide, regardless of subscription status, and can be turned on at any time with just a few steps.

Flo offers a range of advanced features, including personalized health insights and predictions, tailored content, daily stories, and symptom tracking. However, if you choose to enable Anonymous Mode, some features that rely on account identification won’t be available. For example, Partner Mode requires account identifiers so we can securely link the correct accounts to each other and ensure the right information is shared. 

It should always be our users’ choice how they use the services Flo offers, rather than something decided for them by default.

✅ Features that work:

• Cycle and period tracking
• Symptom logging
• Pregnancy tracking
• Health insights and predictions
• Educational content
• Chatbot flows 

❌ Features that don't work:

• Secret Chats (requires account identity to support moderation and keep our community safe)
• Flo for Partners (requires linked accounts)
• Cross-device sync (no account to sync across devices)
• Email notifications (no email on file)
• Flo for Family Subscriptions (requires linked accounts) 
• Web subscriptions (where you have signed up to Flo via our website) 
• Wearable devices (requires device pairing)
• Partnership accounts (where you sign up to Flo through one of our partners and account linkage is required to verify eligibility for the benefit)  

Please also be aware that if you use Anonymous Mode, the Flo support team will always be here to help you with generic advice about Flo’s services. However, in Anonymous Mode, the support team won’t be available in the app, and they won’t be able to help with certain requests that require your identity:

• Data recovery (for example, if your device is lost or stolen, we will not be able to transfer historic data to a new phone) 
• Deleting your account 
• Accessing and exporting your data 
• Amending your data 

Remember: If you switch to Anonymous Mode, you can still delete, access, and update your information directly within your Flo app.

No. 

Anonymous Mode is designed to maintain the same speed and performance as regular app mode. The OHTTP relay adds minimal latency (typically less than 200 milliseconds), which is imperceptible to most users. Cloudflare's global network ensures the relay is geographically close to you, minimizing any potential delay.

Anonymous Mode provides stronger privacy than a VPN for health tracking.

With a VPN:

• Your IP address is hidden from Flo
• BUT device identifiers are still linked to your data
• AND your account email is still linked to your data
• PLUS you have to trust your VPN provider

With Anonymous Mode:

• Your IP address is hidden
• Your identifiers (such as your email) and technical identifiers aren’t linked to your health data

Bottom line: A VPN hides your location. Anonymous Mode hides your entire identity.