Period tracker Stardust shares users’ health data with analytics firm, says Mozilla research

“Your data is private. Period,” says period tracker Stardust on its website. As new research by Mozilla discovered, some users might find that claim to be a stretch.

According to Mozilla’s latest findings examining the privacy practices of period-tracking apps, Stardust was found to be sharing users’ sensitive health information with third-party analytics company RudderStack. This data included the user’s birthdate, birth control type, reproductive goals, and specific symptoms that the user was experiencing, and it tied that record to a unique identifier in place of the person’s name. (The FTC has long warned that this does not make the data anonymous or prevent it from being linked back to a person.)

Mozilla’s research underscores the security and privacy risks with using period tracking and other health apps that share data with third parties. Oftentimes this happens as background activity within the app, and isn’t visible to the user. It’s not uncommon for apps to share data with other services for storage, analytics, and payments, but sharing users’ information with third parties inherently carries risks, such as potential security lapses, data breaches, or having the data sought by law enforcement.

TechCrunch previously wrote about Stardust in 2022 after the app surged in downloads following the overturning of the constitutional right to seek an abortion in the United States. Stardust claimed it was end-to-end encrypted — meaning that not even the company could access its users’ data — but TechCrunch found by analyzing the app’s network traffic that the company’s claim was false.

Mozilla security researcher Shoshana Wodinsky used a similar technique of analyzing the network traffic of several period trackers, including Stardust, to understand how the apps collected and shared data (if at all) with third parties. Wodinsky found that Stardust was the only app out of the six tested that shared the user’s sensitive health data with another company.

As quoted by BBC News, a Stardust spokesperson said that RudderStack is “contractually prohibited from selling or using it for its own purposes.” As U.S.-based companies, both Stardust and RudderStack can still receive demands for users’ information from law enforcement for users’ health information that’s stored on their servers.

Stardust founder Rachel Moranis did not respond to TechCrunch’s request for comment on Thursday, or questions about whether the company has received demands for its users’ data. A spokesperson acknowledged receipt of an email but did not provide comment.

Of the six apps tested by Wodinsky, Mozilla recommended Euki as “squeaky clean,” as the app was not seen to be sharing any data with third parties with its core features, and the user’s health data did not leave their device.