Mozilla: Period Tracker Stardust Shares Data With RudderStack
17 Jul 2026
The gist
A new Mozilla research review has found that Stardust, a popular period-tracking app, shares users' sensitive health data—including birthdate, birth control type, reproductive goals, symptoms, pregnancy status, moods, and alcohol consumption—with a third-party analytics firm called RudderStack. Notably, RudderStack is not named anywhere in Stardust's privacy policy, according to BBC reporting.
Mozilla researcher Shoshana Wodinsky tested six period tracking apps for data-sharing practices. Stardust was the only one of the six found to share sensitive health data with another company.
The contradiction
Stardust's website states plainly: "Your data is private. Period." That claim sits uneasily alongside the Mozilla research and reporting from TechCrunch and BBC, both of which found the app sharing detailed health information with RudderStack. A Stardust spokesperson responded that RudderStack is "contractually prohibited from selling or using it for its own purposes"—though the report notes it remains unclear how RudderStack actually uses or stores the shared data beyond that contractual assurance.
This isn't the first time Stardust's privacy claims have come under scrutiny. TechCrunch previously reported on the app in 2022, after downloads surged following the U.S. Supreme Court's decision overturning federal abortion protections. At the time, TechCrunch's analysis of Stardust's network traffic found the company's claim of being end-to-end encrypted was false. It's unclear whether Stardust has updated its privacy policy or practices since those 2022 findings.
How the other apps compared
Mozilla's review offered a broader picture of the period-tracking app landscape:
- Euki was flagged as "squeaky clean"—it wasn't seen sharing data with third parties for core features, keeps all health information stored on-device rather than sending it to company servers, and even offers a "decoy" feature that shows fake, harmless information if someone else accesses the phone.
- Flo and Clue do not share health information with third parties under any circumstances, per Mozilla. However, both store health data on their own servers, which the report notes could expose users to breaches or government data requests. Flo offers an "Anonymous Mode," where no one—including Flo itself—holds both a user's identity and health data simultaneously, and states it has never received a subpoena for user data.
- Period Calendar sent ID numbers and device information to Google and advertising firm InMobi with no way to opt out. Stardust also shares ID and device information with Facebook and AppsFlyer, though users can opt out via phone privacy settings.
- Planned Parenthood's website was found to share information about the type of healthcare users seek—such as HIV testing or gender-affirming care—with analytics company AB Tasty.
The report does not specify the identities of the two other apps tested beyond Stardust, Euki, Flo, and Clue, nor does it detail Mozilla's full testing methodology.
Why it matters now
Since the 2022 Supreme Court decision overturning federal abortion protections, experts have raised concerns that period tracker data could be used in criminal cases. That context has raised the stakes for how femtech apps handle reproductive health data—and for how transparent they are about it.
Why founders should care
- Health-data startups, particularly in femtech, likely face elevated reputational risk when public privacy claims don't match independently verifiable practices—Stardust's gap between its "private" branding and Mozilla's findings illustrates how quickly that disconnect can become a news story.
- Mozilla's decision to single out one app among six tested may signal that external scrutiny of data-sharing practices in health apps is intensifying, and founders in this space should probably expect more of it.
- Design patterns highlighted favorably in the research—on-device-only storage (Euki) and identity/data separation (Flo's Anonymous Mode)—suggest an emerging privacy-by-design expectation that health app founders may increasingly need to meet, not just claim.
- Given the post-2022 legal environment around reproductive health data, investors and users may be more sensitive than before to how apps store, share, and potentially expose data to subpoenas—a factor worth weighing into product and vendor decisions early.
No information is available yet on regulatory or legal consequences Stardust may face, or whether Period Calendar or Planned Parenthood have made changes since these findings surfaced.