Period-Tracking App Promises Privacy, Then Ships Your Data Out: Birth Date, Contraception, Symptoms

The period-tracking app Stardust promises on its own website: „Your data is private. Period.” Researchers at Mozilla opened up the app's network traffic and found that this data travels to an analytics company called RudderStack.

We are not talking about anonymous statistics of the „how many people opened the app” variety. According to the findings, what went out was date of birth, type of contraception, reproductive goals and symptoms - tied not to a name, but to a unique identifier. That is the distinction marketing departments lean on when they tell you the data is anonymous. The identifier does not know your name, but it knows everything else about you, and it outlives any password you will ever set.

Security researcher Shoshana Wodinsky analysed six cycle-tracking apps. Only one was sharing sensitive health data with an outside company - Stardust. Mozilla singled out Euki as the clean one: it sent nothing to third parties and kept health information on the user's own device. So it can be done. The other five somehow managed not to.

The company's answer is that RudderStack is „contractually prohibited from selling the data or using it for its own purposes”. A contract is a lovely thing right up until a warrant shows up. Both firms can receive a demand from law enforcement for the data they hold, and at that point the contract between them means nothing - it just means there are now two doors instead of one. Stardust founder Rachel Moranis did not answer the question of what the company would do if such a demand arrived.

This is not the first time. Back in 2022, research showed that the same app's claims about full encryption were not accurate. Four years on, the promise has been reworded, the receiving company is a different one, and the substance is identical: the advertising says one thing, the traffic shows another.

It is easy to write this off as an American story about American laws. But cycle-tracking apps are downloaded from the same stores here too, with the same privacy text run through the same translation tool. The difference is that over there, at least somebody opens up the traffic and measures what goes out. The question for the reader here is simpler and more uncomfortable: when was the last time any institution in this country checked what the app on your phone is sending - and to whom?