The Period Tracker That Promised "Your Data Is Private. Period." Was Quietly Sharing It Anyway

There's a specific kind of betrayal that happens when a company's actual practices contradict its own marketing tagline, word for word.

Stardust, a period tracking app, has this line right on its website: "Your data is private. Period." Cute. Confident. Also, according to new research from Mozilla, not really true.

What Mozilla actually found

A Mozilla security researcher named Shoshana Wodinsky ran a privacy investigation on six different period tracking apps, checking their network traffic to see what data was actually leaving people's phones and where it was going. Out of all six, Stardust was the only one caught sharing users' sensitive health data with a third-party company.

That company is called RudderStack, and it's a data analytics firm. What got shared wasn't vague or harmless; we're talking birthdate, birth control type, reproductive goals, and specific symptoms someone logged. Each of those records got tied to a unique identifier instead of the person's actual name.

That last part sounds reassuring on paper. It isn't. The FTC has repeatedly warned that swapping a name for an identifier doesn't actually anonymize data or stop it from being traced back to a real person. It's a technicality, not a real protection.

This isn't the first time Stardust got caught.

TechCrunch actually has a history with this app. Back in 2022, right after the constitutional right to seek an abortion was overturned in the U.S., Stardust saw a massive spike in downloads. People scrambled for a period tracker they could trust with genuinely sensitive information. At the time, Stardust claimed it was end-to-end encrypted, meaning theoretically not even the company itself could see users' data.

TechCrunch checked. It wasn't true. They analyzed the app's actual network traffic and found the encryption claim didn't hold up.

So this new Mozilla finding isn't really a one-off slip. It's part of a pattern with this specific app, making privacy promises that don't survive someone actually looking under the hood.

Why does this matter more for period trackers specifically

Health data is sensitive in general, but period and reproductive data carry a particular kind of risk right now. Depending on where someone lives, information about birth control use, reproductive goals, or even just tracked symptoms could theoretically become relevant to law enforcement in ways that didn't used to be a serious concern.

And that risk isn't hypothetical or overblown. Both Stardust and RudderStack are U.S.-based companies, which means both of them are legally capable of receiving law enforcement demands for the health data stored on their servers. It doesn't matter that RudderStack is contractually barred from selling the data or using it for its own purposes; a legal demand from law enforcement is a completely different situation than a company deciding on its own to misuse data.

A Stardust spokesperson told the BBC that RudderStack can't sell or repurpose the data. That may well be true. It just doesn't address the actual concern people have, which is less "will this company profit off my data" and more "can this data be pulled by someone with a subpoena?"

Stardust didn't really answer for any of this

TechCrunch reached out to Stardust's founder, Rachel Moranis, specifically asking for comment and also asking whether the company had ever received demands for user data from law enforcement. No response by the time the story was published. A spokesperson confirmed they'd received the email, then didn't actually answer anything in it.

That silence isn't a great look, especially for a company whose entire brand pitch is built around trust and privacy.

The one app that actually held up

Out of the six apps Wodinsky tested, one came out looking genuinely good: Euki. Mozilla specifically called it "squeaky clean" no third-party data sharing detected with its core features, and critically, users' health data never even left their device in the first place.

That's a meaningful distinction. A lot of apps share data with third parties for pretty mundane reasons storage, analytics, payment processing, and that's not automatically sinister on its own. But every time health data leaves your device and goes somewhere else, you're adding another point where something can go wrong: a breach, a leak, a law enforcement request, a company changing its policies down the line.

Euki apparently just... doesn't do that. The data stays put. Given how sensitive this specific category of information is, "the data never leaves your phone" is about as strong a privacy guarantee as you can realistically ask for from an app.

This keeps happening because most of this data sharing is invisible to the person using the app. Nobody's opening a settings menu and seeing "we send your symptoms to RudderStack." It's background activity, baked into the app's infrastructure, and the only way anyone finds out is when a researcher like Wodinsky actually goes and inspects the network traffic directly.

Which means the gap between what a health app promises on its homepage and what it's actually doing behind the scenes is really only visible to people with the technical skill to check. Everyone else just has to take the marketing at its word.

And in Stardust's case, twice now, that word hasn't held up.