Period tracker Stardust shares users’ health data with analytics firm, says Mozilla research
Mozilla Foundation research has found that period-tracking app Stardust shares users' sensitive health data with third-party analytics firm RudderStack, despite the app's website stating "Your data is private. Period." The finding is significant because Stardust markets itself as privacy-focused and previously claimed to use end-to-end encryption, a claim TechCrunch disproved in 2022 by analysing the app's network traffic; sharing health data with third parties raises risks around data breaches and law enforcement requests, particularly sensitive given the app's popularity following the overturning of the US constitutional right to abortion.
The shared data included users' birthdates, birth control type, reproductive goals and specific symptoms, linked to a unique identifier rather than a name, which the FTC has warned does not amount to true anonymisation. Mozilla researcher Shoshana Wodinsky tested six period trackers and found Stardust was the only one sharing such data with another company; a Stardust spokesperson said RudderStack is contractually barred from selling or using the data itself, and later stated the firm has never received any data requests from authorities. Mozilla named rival app Euki as "squeaky clean", as it shares no data and keeps health information on the user's device.
In short
- Stardust shares users' health data with analytics firm RudderStack, Mozilla finds.
- Data included birthdates, birth control type and symptoms, tied to unique IDs.
- Stardust was the only app of six tested to share such data.
- Rival app Euki was rated "squeaky clean" with no data sharing.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Third-party analytics providers are standard infrastructure for app development and improvement, permitting developers to operate free or affordable services whilst maintaining contractual safeguards over sensitive information. Stardust's approach—employing pseudonymisation, contractual restrictions on data misuse, and transparency regarding law enforcement requests—reflects established privacy practices widely implemented across the software industry and benefits users through better-engineered products.
The case against
Stardust explicitly marketed itself as private with the statement 'Your data is private. Period' whilst sharing sensitive reproductive health data with a third party, directly violating that core commitment. The company's documented history of false privacy claims—misrepresenting end-to-end encryption capabilities—severely undermines credibility in contractual assurances. Given reproductive data's exceptional sensitivity in the current US legal landscape and evidence that competing apps operate without such sharing, contractual safeguards cannot justify breaking explicit privacy promises to users.
Explained simply
Stardust is an app that helps women track their menstrual cycles and reproductive health. The company markets itself as privacy-focused, claiming to protect users' personal information rather than share it with other organisations.
The information collected by period trackers is highly sensitive, including details about reproductive health and decisions. This sensitive information could potentially be accessed through data breaches or law enforcement requests, a particular concern given the overturning of abortion rights in the United States, which has intensified scrutiny of reproductive tracking tools.
RudderStack is a company that collects and analyses user information on behalf of other businesses. Mozilla is a non-profit organisation known for researching how technology companies handle user data, particularly regarding privacy and security.
Business Celebrity Companies Entertainment Markets Software Technology