“Your data is private. Period,” says period tracker Stardust on its website. As new research by Mozilla discovered, some users might find that claim to be a stretch.
According to Mozilla’s latest findings examining the privacy practices of period-tracking apps, Stardust was found to be sharing users’ sensitive health information with third-party analytics company RudderStack. This data included the user’s birthdate, birth control type, reproductive goals, and specific symptoms that the user was experiencing, and it tied that record to a unique identifier in place of the person’s name. (The FTC has long warned that this does not make the data anonymous or prevent it from being linked back to a person.)
Mozilla’s research underscores the security and privacy risks with using period tracking and other health apps that share data with third parties. Oftentimes this happens as background activity within the app, and isn’t visible to the user. It’s not uncommon for apps to share data with other services for storage, analytics, and payments, but sharing users’ information with third parties inherently carries risks, such as potential security lapses, data breaches, or having the data sought by law enforcement.
