Mozilla Research Says Stardust Shared Sensitive Health Data With RudderStack

Mozilla researchers reported that period-tracking app Stardust transmitted users’ sensitive health information to third-party analytics company RudderStack, despite the app’s privacy-focused branding. According to the findings, the shared data included birthdate, birth control type, reproductive goals, symptoms, and a unique identifier that could link records back to individual users. The report said the practice exposed highly personal reproductive-health data to an outside company and contradicted claims that the app was designed to protect user privacy.

The disclosure renewed scrutiny of health-app data handling and echoed longstanding warnings that techniques such as hashing do not make personal data anonymous if records can still be tied to individuals. Researchers said such sharing can create legal and security risks, including exposure through breaches, commercial reuse, or law-enforcement demands. In Mozilla’s testing of six period-tracking apps, Stardust was the only app observed sending sensitive health data to another company, while Euki was highlighted for keeping core health data on the user’s device.