Period tracker Stardust shared sensitive health data with analytics firm, Mozilla finds

Period tracking app Stardust has been found to be sharing sensitive user health data with a third-party analytics firm, according to new research by Mozilla. The app, which claims on its website that 'Your data is private. Period.', was discovered to be transmitting details such as users' birthdates, birth control types, reproductive goals, and specific symptoms to RudderStack.

Mozilla's findings highlight the inherent privacy risks associated with health apps that share data with external services. While data sharing for storage and analytics is common, it exposes users to potential security lapses, data breaches, or requests from law enforcement. This practice is often conducted in the background, invisible to the user.

This is not the first time Stardust's privacy claims have been questioned. In 2022, TechCrunch reported that the app's assertion of being end-to-end encrypted was false, based on an analysis of its network traffic. Mozilla security researcher Shoshana Wodinsky employed a similar method to uncover the current data-sharing practices.

A spokesperson for Stardust stated that RudderStack is contractually prohibited from selling or using the data for its own purposes. However, as both companies are U.S.-based, they remain subject to law enforcement demands for user information stored on their servers. Stardust founder Rachel Moranis did not respond to requests for comment.

Mozilla recommended Euki as a privacy-focused alternative, noting that its core features do not share user data with third parties, and health information remains on the user's device.