Period tracker Stardust shares users’ health data with analytics firm, says Mozilla research

In a striking revelation, the period tracking app Stardust, which promotes a commitment to user privacy, has come under scrutiny for sharing sensitive health information with a third party. Mozilla's latest research into the privacy practices of period-tracking applications uncovered that Stardust was transmitting data to the analytics firm RudderStack. This information encompassed critical details such as users' birthdates, contraceptive methods, reproductive objectives, and specific health symptoms, all linked to a unique identifier rather than a user’s name. The findings raise significant alarm, especially considering the Federal Trade Commission's (FTC) longstanding warnings that such practices do not ensure anonymity and can lead to personal identification. Mozilla's study highlights the inherent security and privacy risks associated with period tracking and other health applications that engage in data sharing with external entities. Often, these activities occur in the background and remain unnoticed by users. While it’s common for apps to exchange data with third-party services for purposes like storage and analysis, the sharing of sensitive user information can expose individuals to serious risks, including potential data breaches, security vulnerabilities, or even law enforcement requests for information. Stardust, which gained popularity after the Supreme Court's ruling overturning abortion rights in the U.S., previously claimed to implement end-to-end encryption, suggesting that even the company could not access user data. However, past analyses, including one by TechCrunch, revealed discrepancies in these claims. Shoshana Wodinsky, a Mozilla security researcher, employed similar network traffic analysis techniques to scrutinize multiple period tracking apps, identifying Stardust as the sole app among six tested that shared sensitive health data with an external company. In response to the findings, a Stardust representative stated that RudderStack is bound by contract not to sell or utilize this data for its own ends. Nevertheless, as U.S.-based companies, both Stardust and RudderStack remain susceptible to law enforcement requests for health data stored on their servers. Despite attempts to reach out for comment, Stardust's founder Rachel Moranis did not respond to inquiries regarding whether the company has faced any data requests. Mozilla’s analysis also highlighted Euki as a strong alternative, commending it for not sharing any data with third parties while maintaining robust privacy protections for users' health information.