Mozilla research reveals Stardust period tracker shares sensitive reproductive health data with analytics firm RudderStack, violating privacy promises.
In a devastating blow to the millions of users seeking digital privacy in a post-Roe world, a prominent reproductive health app has been caught quietly violating its own core brand promises. Officially published on Thursday, July 16, 2026, a comprehensive privacy investigation by the Mozilla Foundation revealed that Stardust, a popular period-tracking app that markets itself on absolute user confidentiality, has been actively sharing users’ sensitive reproductive health data with a third-party analytics firm. The revelation is a major reality check for consumer trust, proving that even apps wrapped in security-first marketing can expose deeply personal bodily data to outside eyes.
At the center of this controversy was actually being shared behind the scenes. Mozilla’s digital security researchers analyzed the network traffic of six popular menstruation tracking applications. They discovered that Stardust was the only app actively transmitting highly detailed health logs to RudderStack, a commercial data-management and analytics platform. The shared files included users’ exact birthdates, active birth control methods, pregnancy goals, and the specific daily physical symptoms entered into the app. Although Stardust did not transmit users’ literal names to RudderStack, the health profiles were tied to a persistent unique device identifier. Privacy advocates have repeatedly warned that stripping a name does not make data anonymous, as these unique ID strings can easily be cross-referenced with commercial ad networks to pinpoint an individual’s true identity.
The geography of where this data is stored creates a severe bottleneck for legal safety. Because both Stardust and RudderStack are registered in the United States, all data processed on their corporate servers remains fully subject to search warrants, subpoenas, and localized law enforcement demands. Following the U.S. Supreme Court’s decision to overturn federal abortion protections, reproductive privacy has become a major target for state-level surveillance. Stardust capitalized heavily on this anxiety when it exploded in popularity in 2022 by promising end-to-end encryption, a claim that TechCrunch previously debunked after finding the app’s actual software structure was wide open.
This brings us to the crucial part of this development. Stardust relies on third-party integrations to manage application performance, measure user engagement, and run server diagnostics. While utilizing external software development kits (SDKs) is a standard practice in the app industry, Stardust failed to explicitly name RudderStack in its privacy policy. This omission stands in stark contrast to their marketing tagline, which boldly asserts: “Your data is private. Period.” A Stardust spokesperson defended the practice by stating that RudderStack is contractually prohibited from selling or utilizing the data for its own purposes. However, as privacy experts point out, contract clauses do not protect users if a server gets breached, if a company is sold, or if federal agents show up with a court order.
See Also: Ex DeepMind Researcher Scores $300M Valuation for Visual AI Startup
For users looking to reclaim control over their bodies, Mozilla’s researchers highlighted a clear contrast in the market. While apps like Flo and Clue have made notable privacy upgrades under pressure, the open-source, non-profit app Euki was praised as the gold standard of data safety because it stores all reproductive health data locally on the user’s physical device.
About the Author
Jennifer Sakmufuwo Baba is a tech analyst and writer covering artificial intelligence, fintech, and emerging technologies at TechRegard. Based in Nigeria, she's passionate about translating complex tech developments into compelling, accessible stories for diverse audiences. Her work focuses on how technology shapes innovation across Africa and globally.
