\n<\/p>\n
\u201cYour data is private. Period,\u201d says period tracker Stardust on its website. As new research by Mozilla discovered, some users might find that claim to be a stretch.<\/p>\n
According to Mozilla\u2019s latest findings<\/a> examining the privacy practices of period-tracking apps, Stardust was found to be sharing users\u2019 sensitive health information with third-party analytics company RudderStack. This data included the user\u2019s birthdate, birth control type, reproductive goals, and specific symptoms that the user was experiencing, and it tied that record to a unique identifier in place of the person\u2019s name. (The FTC has long warned<\/a> that this does not make the data anonymous or prevent it from being linked back to a person.)<\/p>\n Mozilla\u2019s research underscores the security and privacy risks with using period tracking and other health apps that share data with third parties. Oftentimes this happens as background activity within the app, and isn\u2019t visible to the user. It\u2019s not uncommon for apps to share data with other services for storage, analytics, and payments, but sharing users\u2019 information with third parties inherently carries risks, such as potential security lapses, data breaches, or having the data sought by law enforcement.<\/p>\n TechCrunch previously wrote about Stardust in 2022 after the app surged in downloads following the overturning of the constitutional right to seek an abortion in the United States. Stardust claimed it was end-to-end encrypted \u2014 meaning that not even the company could access its users\u2019 data \u2014 but TechCrunch found by analyzing the app\u2019s network traffic that the company\u2019s claim was false<\/a>.<\/p>\n Mozilla security researcher Shoshana Wodinsky used a similar technique of analyzing the network traffic of several period trackers, including Stardust, to understand how the apps collected and shared data (if at all) with third parties. Wodinsky found that Stardust was the only app out of the six tested that shared the user\u2019s sensitive health data with another company.<\/p>\n As quoted by BBC News<\/a>, a Stardust spokesperson said that RudderStack is \u201ccontractually prohibited from selling or using it for its own purposes.\u201d As U.S.-based companies, both Stardust and RudderStack can still receive demands for users\u2019 information from law enforcement for users\u2019 health information that\u2019s stored on their servers.<\/p>\n Stardust founder Rachel Moranis did not respond to TechCrunch\u2019s request for comment on Thursday, or questions about whether the company has received demands for its users\u2019 data. A spokesperson acknowledged receipt of an email but did not provide comment.<\/p>\n Of the six apps tested by Wodinsky, Mozilla recommended Euki as \u201csqueaky clean,\u201d as the app was not seen to be sharing any data with third parties with its core features, and the user\u2019s health data did not leave their device.<\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\n