Period tracking app Stardust transmits sensitive user health data to a third-party analytics provider called RudderStack, according to Mozilla research published on July 16, 2026. Mozilla security researcher Shoshana Wodinsky analyzed the network traffic of several period and ovulation trackers and found that Stardust was the only app out of six tested that shared users' health data with another company TechCrunch.

The data Stardust shared with RudderStack included the user's birthdate, birth control type, reproductive goals, and specific symptoms, tied to a unique identifier. Mozilla published its findings on the Mozilla Foundation website under the 'Nothing Personal' project TechCrunch.

Stardust's website displayed the claim 'Your data is private. Period.' Stardust founder Rachel Moranis did not respond to TechCrunch's request for comment on the data-sharing allegations. A Stardust spokesperson told BBC News that RudderStack is contractually prohibited from selling or using the shared data for its own purposes TechCrunch.

This is not the first time Stardust's privacy practices have faced scrutiny. In June 2022, TechCrunch found that Stardust's claim of end-to-end encryption was false by analyzing the app's network traffic TechCrunch.

The broader problem extends beyond a single app. A 2025 academic study published in PMC found that Mozilla had labeled 18 of 25 popular period and pregnancy tracking technologies with a '*Privacy Not Included' warning PMC. Mozilla recommended the period tracking app Euki as an alternative, noting that it does not share any data with third parties and keeps users' health data on their device TechCrunch.

For those familiar with how apps handle data, the technical details here matter. The data transmitted to RudderStack was tied to a unique identifier rather than directly to a name or email. Think of a unique identifier as a serial number: it doesn't say "Jane Smith," but it can often be matched to a real person by combining it with other data sets that use the same identifier. The contractual prohibition on RudderStack selling or using the data is a legal control, not a technical one. The data still leaves the user's device and travels to a third-party server.

This distinction between legal and technical safeguards is worth examining. A contractual obligation depends entirely on the analytics provider's compliance and the app vendor's enforcement. It offers no cryptographic guarantee, meaning there is no mathematical or software-based protection preventing the data from being used or shared once it reaches that third-party server. If the data were truly private, as Stardust's marketing language suggested, the technical architecture would keep it on the device or use client-side encryption with keys the user controls. Sending raw health attributes, including birth control type and reproductive goals, to a third-party analytics endpoint is a design choice that prioritizes data collection over user privacy.

The history here compounds the concern. When an app vendor has previously been found misrepresenting its encryption posture, a subsequent finding that it shares sensitive data with an analytics firm raises a straightforward question about whether the vendor's public statements can be relied upon at all.

The fact that five of the six apps Mozilla tested did not share this data is the genuinely useful signal. Building a period tracker that keeps sensitive health information on the device is technically feasible. Euki's on-device approach shows that the functional requirements of cycle tracking do not inherently require sending data to third-party servers. Vendors choosing to transmit that data are making an active decision to do so.

Health data is among the most sensitive categories of personal information a person can generate. The specific fields involved here, birth control type and reproductive goals, carry implications that extend well beyond advertising analytics. When my own children were navigating early adulthood and installing apps with little scrutiny, I saw firsthand how a polished interface and reassuring privacy slogan can override any technical due diligence a user might otherwise perform. Most users, regardless of technical literacy, will not intercept their own network traffic to verify what an app actually transmits.

Mozilla's research provides that verification. The 'Nothing Personal' project and the PMC study both point to a sector where lax data practices remain common enough that a significant share of popular apps carry explicit privacy warnings. For users selecting a tracker, the technical question is not what the privacy policy says but where the data actually resides. On-device storage with no third-party transmission remains the strongest available architecture for this category of application.