Key Takeaways

  • Stardust shares sensitive health data with RudderStack.
  • Users’ information may not be as private as claimed.
  • Mozilla Foundation’s research highlights privacy risks.
  • Euki app recommended for its strong privacy practices.

Privacy Concerns with Stardust

Stardust, a popular period tracking app, claims on its website that “Your data is private. Period.” However, recent research from the Mozilla Foundation suggests that this assertion may not hold true for all users.

Data Sharing Practices

The Mozilla Foundation’s investigation into period-tracking apps revealed that Stardust shares users’ sensitive health information with RudderStack, a third-party analytics firm. This data includes personal details such as birthdates, birth control methods, reproductive goals, and symptoms experienced by users. Instead of using names, the app ties this information to unique identifiers, which the FTC warns does not guarantee anonymity.

Risks of Third-Party Data Sharing

According to the Mozilla Foundation, the sharing of health data with third parties poses significant security and privacy risks. Many apps engage in this practice without users’ awareness, often for purposes like storage, analytics, or payment processing. Such sharing can lead to potential security breaches or data being accessed by law enforcement.

Previous Findings on Stardust

In 2022, Stardust gained attention after a surge in downloads following the overturning of abortion rights in the U.S. The app claimed to use end-to-end encryption, suggesting that even the company could not access user data. However, an analysis of the app’s network traffic contradicted this claim.

Research Methodology

Shoshana Wodinsky, a security researcher at the Mozilla Foundation, analyzed the network traffic of several period tracking apps, including Stardust. Out of six apps tested, Stardust was the only one found to share sensitive health data with another company.

Company Response

A spokesperson for Stardust stated that RudderStack is “contractually prohibited from selling or using it for its own purposes.” Despite this, both companies, being based in the U.S., could still be compelled to provide user data to law enforcement.

Recommendations for Users

The Mozilla Foundation recommended the Euki app as a more privacy-conscious alternative, noting that it does not share user data with third parties and keeps health information stored locally on devices.