Short answer: Check the account model, storage location, permissions, recipients, purpose, security statements, export and deletion. Read both the store disclosure and the full privacy policy.

1. Is an account required?

A local-only app and an account-based app make different tradeoffs. Local-only storage can reduce server exposure but may complicate recovery or multi-device use. An account-based app should explain server storage, recovery and access controls plainly.

2. What information is collected?

Look beyond “health data.” A period app may handle dates, symptoms, mood, messages, email and technical activity. The FTC notes that health apps can involve information about menstruation, fertility, mood, sleep and wellness.

3. Which phone permissions does it request?

The FTC recommends reviewing smartphone privacy settings and turning off permissions an app does not need. Ask why a period tracker needs contacts, precise location, photos or microphone access before granting it.

4. Where does information go?

Read the privacy policy for hosting providers, email services, sign-in providers, analytics tools, advertising SDKs and AI processors. “Not sold” is not the same question as “not processed by a service provider.”

5. Is optional processing actually optional?

If an AI or sharing feature sends information elsewhere, look for a clear explanation before the first transfer, a meaningful choice to decline, and a way to withdraw consent later.

6. What do the store disclosures say?

Google Play's Data safety section summarizes data collection, sharing and security practices under Google's definitions. Compare it with the developer's privacy policy. A mismatch or vague explanation deserves a question.

7. Can you export and correct your history?

Export makes it easier to inspect or retain a copy of your information. Correction matters because one mistaken period date can affect a calendar-based history and future estimates.

8. Can you delete the account and data?

Check whether deletion is available in the app or through a documented request, what is deleted, how long it takes and how backups or legally required records are handled.

A one-minute check before installing

  • Open the store's Data safety or privacy section.
  • Open the full privacy policy.
  • Find the account and storage model.
  • Find every named recipient or processor.
  • Find export, correction and deletion controls.
  • Check whether advertising or tracking SDKs are disclosed.
  • Decide whether the tradeoff fits your needs.

How Aavili answers these questions

Aavili requires an account and uses server storage; it is not local-only. Its policy names AWS, Zoho Mail, optional sign-in providers and Google Gemini for Ask Aavili after explicit consent. The app provides PIN lock, export, consent withdrawal and account deletion. Google Play currently says no data shared with third parties under its definitions, data encrypted in transit, and deletion available. Read the full Aavili privacy policy rather than relying on this summary.

Scope: This article provides practical privacy questions, not legal advice or a guarantee that any app is risk-free.

Sources