Mozilla finds Stardust shares user health data with analytics firm

“Your data is private. Period,” Stardust says on its website. But research from Mozilla found the period-tracking app is sharing users’ sensitive health information with third-party analytics company RudderStack. The shared data includes the user’s birthdate, birth control type, reproductive goals, and specific symptoms, tied to a unique identifier rather than a name. The Federal Trade Commission (the US consumer protection regulator) has long warned that unique identifiers do not make data anonymous or prevent it from being linked back to a person.

Mozilla security researcher Shoshana Wodinsky analyzed the network traffic of six tested period trackers, including Stardust, to understand how the apps collected and shared data, if at all, with third parties. She found Stardust was the only app out of the six apps tested that shared a user’s sensitive health data with another company. By contrast, Mozilla recommended Euki as “squeaky clean,” since the app did not share any data with third parties through its core features, keeping health data on the user’s device. The finding echoes a 2022 TechCrunch investigation, prompted by Stardust’s surge in downloads after the overturning of the constitutional right to seek an abortion in the United States: Stardust claimed it was end-to-end encrypted — meaning that not even the company could access its users’ data — but TechCrunch found by analyzing the app’s network traffic that the company’s claim was false.

As quoted by BBC News, a Stardust spokesperson said RudderStack is “contractually prohibited from selling or using it for its own purposes.” Even so, as U.S.-based companies, both Stardust and RudderStack can still receive demands for users’ information from law enforcement. Sharing users’ information with third parties inherently carries risks such as potential security lapses, data breaches, or law enforcement access. Stardust founder Rachel Moranis did not respond to TechCrunch’s request for comment on Thursday, including questions about whether the company has received such demands from law enforcement; a spokesperson acknowledged receiving the email but did not provide a comment.

Why it matters

The findings underscore the persistent privacy and security risks of period-tracking and other health apps that share data with third parties, exposing users to potential security lapses, data breaches, or law enforcement access to sensitive health records.