Stardust period tracker shares health data, study reveals

Stardust shared sensitive period tracking data with third-party analytics firms, according to new privacy research from Mozilla.

The findings expose a privacy divide in femtech, where users often trust apps with highly sensitive reproductive health information.

The research was carried out by Mozilla’s Privacy Not Included team, which tested several period tracking apps.

It found that Stardust, a period tracker used by millions, shared users’ reproductive health data with analytics companies, a practice the research said contrasted with its privacy-first marketing.

Analytics companies collect and examine information about how people use digital products, often to help businesses understand user behaviour or improve marketing.

The findings raise questions about whether privacy promises made by health apps match what happens to users’ data.

According to research reported by TechCrunch, one other period tracking app tested by Mozilla received what researchers called a “squeaky clean” rating, suggesting similar services can operate without sharing sensitive health data in the same way.

Period tracking apps have come under greater scrutiny in the US since the 2022 overturning of Roe v Wade, which removed federal constitutional protection for abortion.

Some users and privacy advocates have warned that menstrual and reproductive health data could potentially be sought in legal cases.

The research also points to a broader regulatory problem for consumer health apps.

In the US, many health apps are not covered by HIPAA, the health privacy law that applies to medical providers and some healthcare organisations.

That means some consumer apps may be able to collect, share or monetise sensitive health data under rules that differ from traditional healthcare privacy protections.

The femtech market, estimated in the report at US$50bn, has grown quickly, but privacy regulation has not always kept pace with app development.

Stardust had not publicly responded to Mozilla’s findings at the time of the original report, and its privacy policy remained live on its website.

The issue is particularly sensitive for period tracking because the data can reveal patterns around fertility, pregnancy, contraception and reproductive health.

Mozilla’s wider Privacy Not Included initiative has examined consumer technology products for privacy and security concerns since launching in 2017, including connected devices, children’s toys and health apps.

The findings come as US lawmakers continue to debate stronger federal privacy rules for sensitive health information collected by consumer apps.

The American Data Privacy and Protection Act, which has been stalled in Congress since 2023, includes provisions addressing sensitive health information collected by consumer apps.

Experts have also warned that anonymised health data can sometimes be re-identified when combined with other information, such as location data.

Re-identification means linking supposedly anonymous data back to a specific person.

A 2019 study found that menstrual cycle data combined with location information could identify individual users with high accuracy.

State-level privacy laws in places such as California, Virginia and Colorado have also given consumers new rights around personal data, although enforcement can vary.

Privacy advocates say the research underlines the need for clearer data practices, stronger safeguards and greater transparency in femtech.

For users, the findings are a reminder that health apps do not automatically protect health information in the same way as healthcare providers.

The report suggests period tracker companies that put privacy first may be better placed to build trust in a market where long-term use depends on confidence.

Mozilla’s investigation suggests privacy promises in femtech do not always match practice, and that period trackers can function without sharing sensitive user data in the same way.