Key facts
- Period tracking app Stardust shared sensitive user health data with third-party analytics firm RudderStack.
- The shared data included birthdate, birth control type, reproductive goals, and specific symptoms.
- Mozilla's research indicated Stardust was the only app tested that shared sensitive health data with another company.
- Stardust's previous claim of end-to-end encryption was found to be false.
- Stardust and RudderStack, as U.S. companies, can receive demands for user information from law enforcement.
Period tracking app Stardust has been found to be sharing sensitive user health data with a third-party analytics firm, according to new research by Mozilla. The app, which claims on its website that 'Your data is private. Period.', was discovered to be transmitting details such as users' birthdates, birth control types, reproductive goals, and specific symptoms to RudderStack.
Mozilla's findings highlight the inherent privacy risks associated with health apps that share data with external services. While data sharing for storage and analytics is common, it exposes users to potential security lapses, data breaches, or requests from law enforcement. This practice is often conducted in the background, invisible to the user.
This is not the first time Stardust's privacy claims have been questioned. In 2022, TechCrunch reported that the app's assertion of being end-to-end encrypted was false, based on an analysis of its network traffic. Mozilla security researcher Shoshana Wodinsky employed a similar method to uncover the current data-sharing practices.
A spokesperson for Stardust stated that RudderStack is contractually prohibited from selling or using the data for its own purposes. However, as both companies are U.S.-based, they remain subject to law enforcement demands for user information stored on their servers. Stardust founder Rachel Moranis did not respond to requests for comment.
Mozilla recommended Euki as a privacy-focused alternative, noting that its core features do not share user data with third parties, and health information remains on the user's device.