For privacy-first people
A period tracker that can't leak what it never collects
The short answer: Mori keeps your records on your phone — by architecture, not by promise. There's no account, no ads, no tracking SDKs, and nothing that connects your cycle history to an identity. The only data that can leave the device is an encrypted sync snapshot you explicitly turn on.
Why "privacy" claims are usually weak
Most period apps call themselves private while running an account system, analytics SDKs and ad infrastructure. Their privacy is a policy — a promise they could change, or break under pressure. Flo settled with the FTC in 2021 for sharing health data with Facebook and Google after promising it wouldn't; Mozilla's 2026 review found data-sharing problems in other major trackers too.
Mori takes the stronger position: architecture over policy. If the data doesn't exist on a server, it can't be sold, breached or subpoenaed from us.
What Mori's architecture guarantees
- No account, no identity. Your records aren't attached to an email, phone number or login — there is none. Anonymous install identity stays on-device and is never transmitted.
- On-device storage by default. Periods, predictions, statistics and settings live in the app's local database. Without sync enabled, nothing leaves the phone.
- No ads, no trackers. The app contains zero advertising or analytics SDKs. (This website uses GA4; the app does not.)
- Encrypted sync, optional. If you enable sync, records are encrypted on your device before upload. Honest caveat: the server stores the wrapped recovery key alongside the ciphertext so password reset can work — it's encrypted at rest, not end-to-end zero-knowledge, and the privacy policy says so plainly.
- Deletion that deletes. Remove a single day, a category, or everything — records, derived predictions, caches, reminders — instantly, on-device, no support ticket.
Side by side
| Typical tracker | Mori | |
|---|---|---|
| Account | Required — identity attached to records | None |
| Records stored | Company servers | Your phone |
| Ads/trackers in app | Common (analytics, ad SDKs) | None |
| What a breach exposes | Identified health timelines | Nothing — no server copy exists by default |
| Sync option | Default on, plaintext to provider | Opt-in, client-encrypted snapshot |
| Deleting data | Account deletion request | In-app, instant, granular |
The honest limits
Privacy has edges worth stating:
- OS backups are outside the app's control. If your phone backs app data up to Google Drive, Android's own backup system may include Mori's local data. The app opts out of cloud backup where the platform allows it, but device-level backup settings are yours to manage.
- Sync trades a little privacy for recovery. Enabling sync means an encrypted copy exists on our server plus the wrapped key needed for password reset. It's still far less exposed than plaintext account data — but it is a real trade-off, which is why sync is opt-in and priced as a feature.
- We're small and new. No independent security audit yet; the strongest evidence today is architecture (nothing to leak) plus a privacy policy written to be verifiable, not just reassuring.
FAQ
Does Mori upload my period data?
No — by default nothing leaves your phone. If you opt into cloud sync, records are encrypted on your device before upload; the server stores ciphertext plus the wrapped recovery key, not readable health data.
Does Mori have ads or tracking SDKs?
No. There are no ads, no analytics SDKs and no third-party data sharing inside the app. (This website alone uses GA4 — the app itself contains no tracking.)
Can I prove my data stays local?
Yes: the privacy policy describes exactly what is collected, stored and transmitted; the app asks for no account and no network use in the core flow; and you can inspect its traffic yourself with standard tools.