On July 16, 2026, the Mozilla Foundation published research finding that period-tracking app Stardust — which advertises "Your data is private. Period." on its website — was sharing users' sensitive reproductive-health data with a third-party analytics company, RudderStack. According to Mozilla, the shared data included users' birthdate, birth-control type, reproductive goals, and specific logged symptoms, tied to a unique identifier rather than a name. As the FTC has repeatedly warned, pseudonymous IDs of this kind do not make health data anonymous, nor do they prevent it from being re-linked to an individual.

Why It Matters

Period and fertility tracking is one of femtech's largest consumer categories, and trust is the whole product — users hand over the most legally sensitive data imaginable on the promise it stays private. A named, reproducible finding that a "private, period" app was quietly piping symptom and birth-control data to an analytics vendor is exactly the kind of evidence that fuels state privacy enforcement, shopper migration to on-device alternatives, and investor due-diligence questions. For the category, Mozilla's Euki callout also signals where the market is heading: local-first, zero-third-party architectures are becoming a competitive differentiator, not just a compliance checkbox.

Mozilla security researcher Shoshana Wodinsky analyzed the network traffic of six popular period trackers and found Stardust was the only one of the group transmitting sensitive health data to an outside company. It's not the first time Stardust's privacy claims have come under scrutiny: after the app surged in downloads following the 2022 Dobbs decision that ended the federal right to abortion, TechCrunch analyzed its traffic and found its "end-to-end encrypted" claim was false at the time. A Stardust spokesperson told the BBC that RudderStack is "contractually prohibited from selling or using [the data] for its own purposes," and told TechCrunch after publication that the company "has never received any requests, demands, or legal process for user data from authorities or third parties."

The privacy stakes are specific to this category. Both Stardust and RudderStack are US-based, meaning cycle data on their servers remains reachable by law-enforcement demand — a live concern in a post-Dobbs landscape where menstrual timing can be evidence of a pregnancy or its end. Mozilla singled out one app, Euki, as "squeaky clean," noting it kept users' health data on-device and shared nothing with third parties through its core features. The report lands the same month a raft of coverage (BBC, Digital Trends, SC Media) revisited how routinely femtech apps leak intimate data in the background, invisible to users.

The finding extends an intensifying accountability wave around reproductive-data handling. It follows a May 2026 complaint against Flo in the Netherlands (see flo-privacy-campaign-netherlands-complaint) and broader regulatory attention to the gap between femtech privacy marketing and technical reality.

Sources

Update — 2026-07-24

Initial entry — story first created.