Women-focussed app Maya has been sharing sensitive data about the menstrual, emotional and sexual health of its users with Facebook, according to a report published on September 9 by a leading privacy watchdog.

Maya, owned by Delhi-based Sheroes, a social network for women, would share data with Facebook as soon as the app was installed, without even waiting for the user to read the privacy policy, according to the UK-based Privacy International.

“Even though you are asked to agree to their privacy policy, Maya starts sharing data with Facebook before you get to agree to anything,” the report, focussed on menstruation apps, said.

Facebook is in the middle of a storm of protests about its privacy policies, especially after the Cambridge Analytica episode where it was found to have exposed sensitive private data about its users without their consent.

Women users share information with Maya that they would normally not disclose to even their closest friends or family members. This would include information about the commencement of their periods, their mood, sexual activity and the use of contraceptives.

“This is an outrageous breach of trust, they have crossed the line," said Monica, 37, who has been using the app since 2018. "The information I use the app for is very personal and private that I don’t discuss with anybody else.” Monica did not want her second name to be used for this story.

Such information can be used by advertisers to create virtual personas of users so that they can be targeted more precisely for marketing campaigns. For instance, in this scenario, it would not be too difficult for an analytics model deployed by these companies to understand the probable purchases that a user would make during a particular mood or mental state.

​Sheroes has raised $2.6 million from prominent angel investors, including Paytm Founder Vijay Shekhar Sharma, Flipkart co-founder Binny Bansal, Freshworks Founder Girish Mathrubootham, Sequoia India Managing Director Rajan Anandan and Slideshare Co-founder Amit Ranjan.

Sheroes told Privacy International that it had removed the core Facebook software and the analytics software responsible for leaking the data and targeting ads at women. This was after Maya, with over five million downloads on the Google Play Store, was outed as a privacy violator.

Responding to Moneycontrol's questions on the matter, Maya founder and CEO John Paul said: "Maya does not sell data to Facebook or any third party. We have in the past used tools from Facebook, strictly to improve our product experience. We have proactively removed these tools from all versions of the app due to concerns about privacy.

All data accessed by Maya is essential to the proper functioning of the product. Predicting information pertaining to menstrual cycles is complex and dependent on thousands of variables. Our users are made aware of our Terms and Conditions and Privacy Policy prior to signing up on Maya. Post sign up, our users can export their data and delete their account whenever they choose to.​”

However, Facebook is yet to respond to an email seeking comment.

“Although Maya’s privacy policy says that no personal data is disclosed to advertisers, it then states that users' personal data may be used to comply with our advertisers’ wishes by displaying their advertisement to that target audience.’ They don’t specify whether this involves health-related data,” the report read.

This is not the first expose of apps sharing data with third parties like Facebook. Last year, Privacy International revealed​ that a large group of apps across categories was sharing data with third parties even if the user did not have a Facebook account or were not logged into their Facebook account.

The article has been updated with the response of Maya founder and CEO