Mozilla Research: Period Tracker Stardust Shares Users' Health Data with Analytics Firm
Mozilla's research reveals that the period tracker Stardust shares sensitive health data, including birthdate and reproductive goals, with third-party analytics company RudderStack.
Period tracker Stardust claims on its website: "Your data is private. Period." However, new research from Mozilla suggests this claim may be misleading. According to Mozilla's latest findings examining the privacy practices of period-tracking apps, Stardust was found to be sharing users' sensitive health information with third-party analytics company RudderStack.
The shared data includes the user's birthdate, birth control type, reproductive goals, and specific symptoms the user was experiencing. This data was tied to a unique identifier rather than the person's name. The Federal Trade Commission (FTC) has long warned that this does not make the data anonymous or prevent it from being linked back to an individual.
Mozilla's research underscores the security and privacy risks of using period trackers and other health apps that share data with third parties. Often, this happens as background activity within the app and is not visible to the user. While it is not uncommon for apps to share data with other services for storage, analytics, and payments, sharing users' information with third parties carries inherent risks, such as potential security lapses, data breaches, or law enforcement requests.
TechCrunch previously wrote about Stardust in 2022 after the app surged in downloads following the overturning of the constitutional right to seek an abortion in the United States. Stardust claimed it was end-to-end encrypted, but TechCrunch found that claim to be false by analyzing the app's network traffic.
Mozilla security researcher Shoshana Wodinsky used a similar technique of analyzing network traffic of several period trackers, including Stardust, to understand how the apps collected and shared data with third parties. Wodinsky found that Stardust was the only app out of the six tested that shared the user's sensitive health data with another company.
As quoted by BBC News, a Stardust spokesperson said that RudderStack is "contractually prohibited from selling or using it for its own purposes." However, as U.S.-based companies, both Stardust and RudderStack can still receive demands for users' information from law enforcement. Stardust founder Rachel Moranis did not respond to TechCrunch's request for comment on Thursday.
Of the six apps tested by Wodinsky, Mozilla recommended Euki as "squeaky clean," as the app was not seen to be sharing any data with third parties with its core features, and the user's health data did not leave their device.
