You weigh yourself, open the app, and type the number in. It takes half a second. The number is now in two places: on your screen, and somewhere you can't see.
Most people picture their tracking data as a private diary — words on a page only they read. For a lot of apps that picture is wrong in a specific, unglamorous way. The data isn't stolen by hackers in the night. It's sent, on purpose, by the app itself, to companies you've never heard of, the moment you tap save.
The number doesn't stay put
Software is built out of other people's software. A free tracking app usually bolts in a handful of third-party kits — for crash reporting, for analytics, for advertising — and each kit phones home. The trouble is what counts as an "event". Tapping a button is an event. So, sometimes, is the thing you typed.
This isn't theoretical. In 2021 the US Federal Trade Commission settled with Flo Health, maker of a widely used period and ovulation tracker, over exactly this. Flo told users their health data was private. According to the FTC, it was handing that data — including whether a user was trying to get pregnant — to Facebook's and Google's analytics divisions, and to firms called AppsFlyer and Flurry. The sharing only stopped after a reporter noticed in 2019. Years later, Google and Flo agreed to pay a combined $56 million to settle related claims, and a jury found Meta liable for collecting the data without consent.
Brokers buy the boring stuff
The other route your data takes is quieter and harder to picture. It goes to data brokers — companies whose whole business is buying location and behaviour data, bundling it, and selling it on. You don't have an account with them. You've never agreed to anything they would recognise. Your data reaches them through the advertising plumbing most apps sit on top of.
In December 2024 the FTC acted against a broker called Mobilewalla, which it said had collected people's precise location data and used it to build audience segments for advertisers. One segment was pregnant women — identified, the FTC alleged, by tracking phones that had visited pregnancy centres. Mobilewalla gathered much of this from real-time bidding, the split-second auction that decides which ad you see: it was scooping up the data flowing through those auctions and keeping it for itself. Around the same time the agency took similar action against Gravy Analytics and its subsidiary Venntel, and a year earlier against a broker called X-Mode.
The risk to your data was never only a break-in. Most of the time the front door was left open on purpose.
What "don't sell" actually means
Read enough privacy policies and you'll notice a favourite sentence: we do not sell your personal information. It is often true and almost never the point. Sharing is not selling. Passing data to an "analytics partner" is not selling. Letting an advertising kit collect it inside your app is not selling. The word does a lot of quiet work, and the data still ends up in the same places.
None of this needs villains. The engineer who adds an analytics kit is usually just trying to fix crashes and learn which screens people use. The broker selling a segment is following its incentives. But the sum of all those reasonable decisions is a system where a number you typed about your own body can travel further, in a second, than you ever will.
With the marketing stripped out, here is roughly what happens when you save an entry in a typical free tracker:
- It is stored on a server the company owns, under terms it can change.
- It fires off "events" to analytics kits, which may include what you typed.
- Some of those kits belong to advertising companies.
- A portion of the data flows through ad auctions, where brokers can collect it.
- "We don't sell your data" can stay technically true the entire time.
The number can stay put
There is a simpler shape, and it is older than the cloud. A file that lives on your own device, that doesn't phone anyone, that has no analytics kit to feed because there is no business model underneath that needs feeding. You type the number. The number stays put.
That used to be the only option. It can still be one.
OneFileClub makes powerful one-file tools for keeping your own records — habit trackers, training logs, food diaries, sleep logs. One file. One payment. No server to phone home, no analytics kit, no broker on the other end. Your data stays on your device.