By Sue Khan, VP of Privacy
In my role as Flo’s Data Protection Officer, I see the privacy landscape evolving constantly. I also see how much trust you place in us when you track your reproductive health. That trust matters.
What you choose to share should always be your decision. And deciding not to share your identity shouldn’t limit your ability to understand your body. Anonymous Mode was built with that principle in mind — not as a marketing add-on, but as a deliberate redesign of how reproductive health tracking can work without tying data to who you are.
Not all period trackers approach privacy the same way. I’ve reviewed countless policies in this space and often see vague language around “anonymization” that doesn’t fully explain the technical reality. Strong privacy statements are easy to write. Building systems that truly enforce them is much harder.
Anonymous Mode was engineered to truly protect your identity It uses post-quantum cryptography to help safeguard your data not just today, but against future advances in computing. It has been independently audited, and we’ve publicly documented how it works so anyone can review the details and hold us accountable.
Most importantly, it’s designed so that when you track your reproductive health, your identity isn’t part of the system — meaning no one, including us, can identify you.
The Bigger Picture
We created Anonymous Mode in response to the U.S. Supreme Court's decision overturning Roe v. Wade. At Flo, we saw this happening and made a decision. We would accelerate our privacy roadmap. Not because it was easy or cheap to implement, but because reproductive health data privacy had become a matter of safety.
With female-led Privacy and Security teams, we understand what's at stake for your health data. We built Anonymous Mode because you deserve a choice to track your reproductive health without linking to your identity.
1. No Identity Linked: Not Even Flo Can Identify You
Here's what makes Anonymous Mode different from any other privacy settings you've seen in other apps. Many apps claim to be anonymous because they don’t collect your name or email, but they often still collect technical identifiers such as your IP addresses. These technical identifiers are unique and can still identify you.
When you switch to Anonymous Mode, your health data is separated from anything that could identify you. Your identity and your health information are stored in completely separate systems, with no way to link them back together.
Why does this matter? Because if anyone ever asks us to identify someone using the app in Anonymous Mode — whether it’s a government agency, a court, or even someone at Flo — we simply can’t do it. The way our systems are built makes linking that data back to you technically impossible.
2. Post-Quantum Cryptography: Future-Proofing Your Privacy
We spend a lot of time thinking about threat models. Not just the risks we face today, but the risks that could emerge in five, ten, or twenty years.
That’s also why we’ve built post-quantum cryptography into Anonymous Mode. Today’s encryption is strong, and practical quantum computers that could break it don’t exist yet. But technology evolves. In the future, more powerful computers could potentially unlock data that was encrypted years earlier.
We don’t want your past health information to ever become vulnerable. By using post-quantum cryptography, we’re preparing now for the next generation of computing — so your data stays protected not just today, but long into the future.
3. Multi-Layered Privacy: Protection at Every Step
Privacy isn’t a single switch you flip. It’s built into the foundation through a series of architectural decisions at every layer.
Anonymous Mode protects your data at three critical stages:
- On your device. The moment you log a symptom, your health data is encrypted on your phone. That means it’s protected before it ever leaves your device. Even if someone intercepted the data, they wouldn’t be able to read it.
- During transmission. When your information travels across the internet, we use a technology called Oblivious HTTP (OHTTP) through Cloudflare’s App Relay. This does more than hide your IP address. It separates who you are from what you’re sharing. No single party — including Flo — can see both your identity and your health data at the same time.
- On our servers. When your data reaches our systems, it stays anonymized. We’ve designed our infrastructure so your health information is processed and stored on our servers, but we do not process or store your identity.
On our Privacy Portal, we explain it in a way that makes it easier to picture. I’ve included that description here because I think it is a helpful way to understand how it works:
Imagine asking a trusted messenger to deliver a sealed letter for you. The messenger knows who you are, but can’t see what’s inside the letter. When the letter is delivered, the recipient can read the message, but doesn’t know who sent it. This is essentially how OHTTP works.
4. Free for Everyone, Everywhere
Privacy choices are a fundamental right, not a premium feature.
That's why Anonymous Mode is available to every Flo user at no cost. No matter where you are, or whether you're using our free version or a paid subscription, you have access to the same privacy protections.
5. Open-Sourced and Globally Recognized
Transparency is essential to trust, especially when it comes to privacy technology.
We've published a comprehensive white paper detailing the technical architecture of Anonymous Mode, and we've open-sourced the technology so other companies in the femtech ecosystem can implement similar protections. This benefits everyone who tracks their reproductive health, not just Flo users.
Independent experts have validated our approach. Anonymous Mode has received awards and recognition from industry leaders, including the PICCASO Privacy Awards Most Innovative Data Privacy Project 2024, TIME's Best Inventions of 2023, Fast Company's 2023 World Changing Ideas, and IAPP's Privacy Innovation Award 2022.
These aren’t just marketing claims. They’re recognition from independent privacy experts who have carefully reviewed how our technology actually works.
Switching to Anonymous Mode is simple.
Switching to Anonymous Mode is straightforward, but I want you to understand exactly what happens.
- Open the Flo app
- Tap your avatar in the top left corner of your screen
- Go to settings
- Tap “view profile”
- Select "Anonymous Mode"
- Tap “enable Anonymous Mode”
When you switch to Anonymous Mode, your previous account is permanently deleted. We only carry over the essential cycle information you need to keep using the app. Any details that could identify you — such as your name, email address, or IP address — are not transferred to your new anonymized account.
This change can’t be undone. Anonymous Mode also comes with some feature limitations (for example, Partner Mode isn’t available), so make sure you take a moment to decide whether it’s the right choice for you before making the switch.
Your body. Your data.
Related Resources: