Mozilla research examining privacy practices of period-tracking apps found that Stardust was sharing users’ sensitive health information with third-party analytics company RudderStack. The shared data included the user’s birthdate, birth control type, reproductive goals, and specific symptoms, linked to a unique identifier rather than a name. The FTC has long warned that such identifiers do not make data anonymous or prevent re-identification. Stardust markets itself with the slogan “Your data is private. Period,” a claim the findings call into question.
Mozilla security researcher Shoshana Wodinsky analyzed network traffic of several period trackers, including Stardust, to determine how the apps collected and shared data. Stardust was the only app among the six tested that sent sensitive health data to another company. The sharing often occurs as background activity invisible to users. While apps commonly share data for storage, analytics, and payments, doing so with third parties creates risks including security lapses, data breaches, and law-enforcement demands.
TechCrunch previously reported in 2022 that Stardust’s end-to-end encryption claims were false after analyzing its network traffic, around the time downloads surged following the overturning of constitutional abortion rights in the U.S. Both Stardust and RudderStack are U.S.-based and can receive law-enforcement demands for stored health data. A Stardust spokesperson told BBC News that RudderStack is contractually prohibited from selling or using the data for its own purposes; after publication the company also stated it has never received requests or legal process for user data.
Of the six apps tested, Mozilla recommended Euki as “squeaky clean” because it was not observed sharing data with third parties for core features and kept users’ health data on-device. Stardust founder Rachel Moranis did not initially respond to comment requests. The research underscores broader privacy and security risks of health apps that transmit sensitive information to outside parties.