Mozilla's research published in July 2026 found that the period tracking app Stardust shares users' detailed reproductive health data with RudderStack, a third-party data management company not named in Stardust's privacy policy [1, 2, 3, 4]. The data includes pregnancy status, birth control methods, moods, alcohol consumption, specific symptoms like breast tenderness and stomach cramps, birthdate, and reproductive goals linked to unique user identifiers instead of names [1, 2, 3, 4].
Stardust says RudderStack is contractually barred from selling the data or using it for its own purposes and does not store the data long term [1, 3, 4]. The company describes RudderStack as a ‘‘technical pipeline’’ that routes data to Stardust’s internal analytics systems and states no user-identifiable information is shared with RudderStack [1, 4].
Security experts warn sharing sensitive health data with third parties raises risks of security breaches and exposure to legal demands, especially after the 2022 US Supreme Court overturned federal abortion protections, increasing concerns over how such data might be used in criminal cases [1, 2, 3, 4]. Mozilla's network traffic analysis, led by researcher Shoshana Wodinsky, exposed Stardust’s data sharing with RudderStack and showed the app does not implement the end-to-end encryption it once claimed [1, 3, 4]. Wodinsky said, "Users deserve better protections. At least they should know how their data is being used" [1].
Mozilla tested six popular period tracking apps and found Stardust was the only one sharing sensitive health data with another company [1, 2, 3, 4]. Other apps, like Euki, store all health data locally on the user’s device and do not send it to external servers, reflecting stronger privacy protection [1, 4].
Stardust also shares user identifiers and device information with advertising platforms such as Facebook and AppsFlyer, though users can opt out via phone privacy settings [1, 4]. A Stardust spokesperson said, "We do not share any health data with ad platforms. We use AppsFlyer and Meta to measure and optimize advertising campaign performance" [4].
Mozilla’s research found other apps, such as Period Calendar, also share user IDs and device info for advertising or analytics purposes [1, 4]. The Spot On app itself does not share health data with third parties but may direct users to Planned Parenthood’s website, which shares some user search data with analytics firms [1, 4].
While data sharing practices by Stardust and RudderStack appear legal and Mozilla found no evidence of misuse, privacy advocates remain concerned. Sara Geoghegan, EPIC’s Consumer Privacy Program Director, said, "Just letting people know you’re using a reproductive health app can have consequences" [1].
Mozilla’s July 15, 2026, report is the latest in scrutiny of digital privacy risks associated with reproductive health apps, especially after the landmark 2022 Supreme Court ruling that altered abortion rights in the US [1, 2, 4].
