← IoT Privacy Database

Clue

BioWink GmbH · Fertility / Period Tracker

Staff Reviewed — a person at DeSpy reviewed this rating.

2.6Surveillance
Index
Policy — what its policy permitsB
Evidence — what research provesC

Clue tracks menstrual cycles, symptoms, moods, sexual activity and fertility windows — reproductive-health data that is acutely sensitive in the post-Dobbs U.S. legal landscape. Because BioWink is based in Germany, Clue is bound by GDPR restrictions on sharing health data, and independent testing found it comparatively restrained about transmitting cycle entries to outside partners. It still logs detailed in-app analytics and, like its peers, must comply with lawful subpoenas.

Why this rating

Deductions: reproductive-health data is maximally sensitive here (-15); the company acknowledges it must comply with law-enforcement subpoenas (-5); internal analytics log symptom values and timestamps, adding some vagueness (-7). Bonuses: GDPR-backed data-minimization posture and granular, revocable per-purpose consent for research, analytics, recommendations and advertising (+4). One of the stronger policies in this slice.

What it is

Manufacturer
BioWink GmbH
Category
Fertility / Period Tracker
Model years
2013-present
Market status
Current
Companion app
Clue

The evidence 2

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S3Data privacy after Dobbs: Is period tracking safe?
    Journalism · Stateline · 2024-07

    Reporting on how reproductive-tracking data could be subpoenaed to build abortion-related prosecutions; notes Clue's Germany/EU basis offers extra protection but that it, like peers, must honor lawful requests.

    Why it matters here: Contextualizes the law-enforcement subpoena risk specific to reproductive-tracking apps such as Clue.

  2. S2Clue Privacy Review: Is the Clue Period Tracker Safe?
    Ngo review · Mozilla Foundation · 2026

    Mozilla scored Clue 8/10, praising granular privacy controls and finding it did not broadly transmit sensitive cycle data to partners, while noting internal analytics logging and past data-broker exposure of period-app device lists.

    Why it matters here: Independent, largely positive review of this exact app that also flags residual analytics and broker-list exposure.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database