A recent audit by the Mozilla Foundation, conducted in partnership with Harvard's Berkman Klein Center, has revealed significant privacy concerns with several popular period tracking applications, with one app, Stardust, scoring particularly low. The audit examined six widely used trackers, finding that most engaged in data sharing practices that could compromise user privacy.
Stardust, an astrology-themed period tracker, received a score of 2 out of 10. The audit found that the application transmits sensitive reproductive health information, including birth control type, pregnancy status, moods, and specific symptoms like tender breasts and stomach cramps, to a data firm not disclosed in its privacy policy. Mozilla researcher Shoshana Wodinsky observed that Stardust initiates third-party tracking immediately upon opening, even before a user inputs any data. Once a symptom is logged, these details are sent to the analytics firm RudderStack, along with a persistent user ID, without any in-app option to disable this sharing. RudderStack is designed to further route data to other destinations that Mozilla could not monitor. Additionally, Stardust provides Facebook with an advertising identifier, linking in-app behaviors to existing Facebook profiles. The company has stated to TechCrunch that it has never received a legal demand for user data.
In contrast, Euki, a period tracker operated by a nonprofit organization, achieved a perfect score of 10. This application does not require an account, and all health data remains stored locally on the user's phone. Euki offers robust privacy features, allowing users to set a PIN, schedule automatic data deletion, and even display a decoy screen if forced to open the app. Its only minor privacy consideration is an in-app browser for educational content, which loads standard web trackers, though it resets identifiers between visits.
The findings highlight a broader issue of data privacy within health and wellness applications, particularly those handling highly personal information. The audit underscores the importance of scrutinizing privacy policies and understanding data flow when using such tools.
