New research from Mozilla has raised significant privacy concerns regarding the period tracking application, Stardust, alleging the app shares sensitive user health information with a third-party analytics company, RudderStack. Despite Stardust's website stating, "Your data is private. Period," Mozilla's findings suggest that users' birthdates, types of birth control, reproductive goals, and specific symptoms are being transmitted to RudderStack, linked to a unique identifier rather than a name. Regulators, including the US Federal Trade Commission (FTC), have long warned that such identifiers do not truly anonymise data and can still be traced back to individuals.
This revelation underscores the broader security and privacy risks associated with many health and period tracking apps that engage in data sharing with external parties. While sharing data for purposes like storage, analytics, or payments is common for many applications, the transmission of highly personal health information carries inherent dangers. These include the potential for security vulnerabilities, data breaches, or even demands for user information from law enforcement agencies, particularly for US-based companies like Stardust and RudderStack.
Stardust has previously come under scrutiny. In 2022, following a surge in downloads after the overturning of abortion rights in the United States, TechCrunch reported that the app's claims of end-to-end encryption were false, after analysing its network traffic. Mozilla security researcher Shoshana Wodinsky employed a similar methodology, analysing the network traffic of six different period trackers. Stardust was identified as the sole app among those tested that was found to be sharing sensitive health data with another company.
A spokesperson for Stardust, as quoted by BBC News, stated that RudderStack is "contractually prohibited from selling or using it for its own purposes." However, this contractual agreement does not prevent either company, as US entities, from receiving legal demands for user data from law enforcement. Stardust founder Rachel Moranis did not provide a comment to TechCrunch regarding these findings or whether the company has received such demands.
In contrast to Stardust, Mozilla's research highlighted the app Euki as a privacy-conscious alternative. Euki was described as "squeaky clean," with its core features not sharing any data with third parties and ensuring that users' health information remained securely on their own devices. This distinction serves as a critical reminder for consumers to carefully evaluate the privacy policies and practices of health apps before entrusting them with personal and sensitive information.