“Your data is private. It's your period,” period tracker Stardust says on its website. As a new study by Mozilla found, some users may find that claim far-fetched.
Mozilla's latest investigation into the privacy practices of period tracking apps found that Stardust shared users' sensitive health information with third-party analytics firm RudderStack. This data included the user's date of birth, type of contraception, reproductive goals, and specific symptoms the user was experiencing, and linked the record to a unique identifier instead of the individual's name. (The FTC has long warned that this does not anonymize the data or prevent it from being associated with an individual.)
Mozilla's research highlights the security and privacy risks associated with using period tracking apps and other health apps that share data with third parties. This often occurs as a background activity within the app and is not visible to the user. While it's not uncommon for apps to share data with other services for storage, analytics, and payments, there are inherent risks in sharing your information with third parties, including potential security flaws, data breaches, and law enforcement searches for your data.
TechCrunch previously wrote about Stardust in 2022, when app downloads skyrocketed following the overturning of the constitutional right to seek abortion in the United States. Stardust claimed it was end-to-end encrypted, meaning even the company couldn't access your data, but TechCrunch's analysis of the app's network traffic debunked the company's claims.
Mozilla security researcher Shoshana Wodinsky used similar techniques to analyze the network traffic of several period trackers, including Stardust, to understand how the apps collected and shared data (if at all) with third parties. Wodinsky found that of the six apps he tested, Stardust was the only one that shared users' sensitive health data with another company.
As quoted by BBC News, a Stardust spokesperson said RudderStack is “contractually prohibited from selling or using it for its own purposes.” As U.S.-based companies, both Stardust and LadderStack may be subject to user information requests from law enforcement agencies regarding user health information stored on their servers.
Stardust founder Rachel Moranis did not respond to TechCrunch's request for comment Thursday or questions about whether the company receives requests for user data. A spokesperson acknowledged receiving the email but had no comment.
Of the six apps Wodinsky tested, Mozilla recommended Euki as “very clean.” The reason is that the app is not considered to share data with third parties in its core functionality, and no user health data was leaked from the device.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.