Full Breakdown
Stardust Period Tracker Shares Sensitive Health Data with Third-Party Analytics Firm
7/18/2026, 4:48:41 AM
Core Event
Mozilla’s Privacy Not Included team discovered that the period-tracking app Stardust transmits users’ reproductive-health details—including birthdate, birth-control type, pregnancy status, moods, alcohol consumption and specific symptoms—to the analytics service RudderStack. The data is linked to a unique identifier rather than a name, a practice the FTC warns does not guarantee anonymity. Stardust’s own website claims “Your data is private. Period,” yet network-traffic analysis showed the app routinely forwards this information to RudderStack for processing.
Background & Context
Since the U.S. Supreme Court’s 2022 decision overturning Roe v. Wade, privacy advocates have warned that menstrual-tracking data could be subpoenaed in criminal or civil cases. The heightened scrutiny has led to multiple investigations of femtech apps, with Mozilla testing six popular trackers. While some apps, such as Euki, kept all data on the device, Stardust was the only one found sharing detailed health records with an external company.
Key Figures & Groups
- Stardust – U.S.–based period-tracking app marketed with end-to-end encryption claims.
- RudderStack – Data-management and analytics platform receiving Stardust’s health data.
- Mozilla Foundation – Conducted the privacy audit; researcher Shoshana Wodinsky led the testing.
- Sara Geoghegan – Director of the Consumer Privacy Program at the Electronic Privacy Information Center (EPIC), commenting on surveillance risks.
Data & Statistics
The shared dataset includes:
- Birthdate and birth-control method
- Pregnancy status and reproductive goals
- Daily symptoms (e.g., tender breasts, stomach cramps)
- Mood and alcohol-consumption entries
These fields were paired with a unique device identifier before transmission to RudderStack.
Official Statements & Responses
Stardust’s spokesperson clarified that RudderStack serves only as a “technical pipeline” routing data into Stardust’s own analytics systems and that the firm is “contractually prohibited from selling or using it for its own purposes.” The spokesperson also asserted that the company “has never received any requests, demands, or legal process for user data from authorities or third parties.” Mozilla recommended Euki as “squeaky clean,” noting it does not share any health data with third parties.
Criticism & Opposition
Privacy experts argue that even de-identified health data can be re-identified when combined with other information, posing security and legal risks. EPIC’s Geoghegan warned that such data “can be part of a whole tapestry woven from many different threads of surveillance,” potentially exposing users to law-enforcement requests. The FTC has previously cautioned that removing names does not prevent linkage to individuals.
Conflicting Reports & Gaps
Stardust claims no legal demands have been received, yet the FTC’s longstanding guidance indicates that U.S. companies remain subject to subpoenas. Mozilla’s report notes that RudderStack “doesn’t store the data long-term,” a detail not independently verified. No comment was obtained from RudderStack itself.
Verbatim Quotes
- “Your data is private. Period,” — Stardust, website tagline
- “Additionally, RudderStack is contractually prohibited from selling or using it for its own purposes,” — Stardust spokesperson
- “People deserve better,” — Shoshana Wodinsky, privacy research analyst
- “Someone could probably fix this in an afternoon,” — Shoshana Wodinsky
- “Data collected from a period tracking app can be part of a whole tapestry woven from many different threads of surveillance,” — Sara Geoghegan, EPIC
What’s Next
U.S. lawmakers continue debating the American Data Privacy and Protection Act, which would extend stronger safeguards to sensitive health information collected by consumer apps. Mozilla’s findings are expected to inform ongoing policy discussions and encourage femtech developers to adopt stricter data-handling practices.
