Period app Maya leaks data on women to Facebook: Privacy Watchdog

In a large scale data breach, women-focussed app Maya shared sensitive personal data about the menstrual health of its users with Facebook according to reports. A leading watchdog, UK based Privacy International noted that Maya, owned by Sheroes India would share data with Facebook as soon as the app was installed, without even waiting for the user to read the privacy policy.

Reports say women users share information with Maya that they would normally not disclose to even their closest friends or family members because this would include information about the start of their periods, mood swings, sexual health and the use of contraceptives.

“Even though you are asked to agree to their privacy policy, Maya starts sharing data with Facebook before you get to agree to anything,” Privacy International On Data Breach by Maya by Sheroes India

“This is an outrageous breach of trust, they have crossed the line," said Monica a user to MoneyControl.com. Monica, who has been using the app since 2018 said to the publication, "The information I use the app for is very personal and private that I don’t discuss with anybody else.”

The app is used to track pregnancy, the cycles, to have or avoid having a baby, and to track period cycles and overall sexual health. Privacy International noted:

In December 2018, Privacy international exposed the dubious practices of some of the most popular apps in the world. Out of the 36 apps we tested, we found that 61% automatically transfer data to Facebook the moment a user opens the app.

Reports say Maya shared contraceptive pill usage data with Facebook among other trends on sexual health. It also picks information on sexual life. Menstruation apps collect some of the most intimate data imaginable - from general health, to information about sex, moods, what the user eats, drinks and even what sanitary products she uses.

Privacy International Further Noted on its website:

Maya is the kind of app that wants you to share. A lot. The problem is what you share won’t stay between you and Maya. Our traffic analysis reveals, first of all, that Maya informs Facebook when you open the app. There is already a lot of information Facebook can assume from that simple notification: that you are probably a woman, probably menstruating, possibly trying to have (or trying to avoid having) a baby. Moreover, even though you are asked to agree to their privacy policy, Maya starts sharing data with Facebook before you get to agree to anything. This raises some serious transparency concerns.

On being shown the study, the app informed PI that it had "removed both the Facebook core SDK and Analytics SDK from Maya" with the changes coming into effect almost immediately.

A release by Merrill Diniz of Sheroes said, "Maya absolutely does not use any data for commercial purposes. Maya does not sell data to Facebook or ANY third party. Our users are made aware of our Terms and Conditions and Privacy Policy prior to signing up on Maya."

This is not the first expose of apps sharing data with third parties like Facebook. Last year, Privacy International revealed​ that a large group of apps across categories was sharing data with third parties. In India, other apps, like mother and child app Healofy has also been under the radar for violations of trust and information of its users and was dropped from the Google playstore.