Period tracker Stardust shares users’ health data with analytics firm, says Mozilla research

“Your information is private. Period,” says play tracker Stardust connected its website. As caller probe by Mozilla discovered, immoderate users mightiness find that assertion to beryllium a stretch.

According to Mozilla’s latest findings examining the privateness practices of period-tracking apps, Stardust was recovered to beryllium sharing users’ delicate wellness accusation with third-party analytics institution RudderStack. This information included the user’s birthdate, commencement power type, reproductive goals, and circumstantial symptoms that the idiosyncratic was experiencing, and it tied that grounds to a unsocial identifier successful spot of the person’s name. (The FTC has long warned that this does not marque the information anonymous oregon forestall it from being linked backmost to a person.)

Mozilla’s probe underscores the information and privateness risks with utilizing play tracking and different wellness apps that stock information with 3rd parties. Oftentimes this happens arsenic inheritance enactment wrong the app, and isn’t disposable to the user. It’s not uncommon for apps to stock information with different services for storage, analytics, and payments, but sharing users’ accusation with 3rd parties inherently carries risks, specified arsenic imaginable information lapses, information breaches, oregon having the information sought by instrumentality enforcement.

TechCrunch antecedently wrote astir Stardust successful 2022 aft the app surged successful downloads pursuing the overturning of the law close to question an termination successful the United States. Stardust claimed it was end-to-end encrypted — meaning that not adjacent the institution could entree its users’ information — but TechCrunch recovered by analyzing the app’s web postulation that the company’s assertion was false.

Mozilla information researcher Shoshana Wodinsky utilized a akin method of analyzing the web postulation of respective play trackers, including Stardust, to recognize however the apps collected and shared information (if astatine all) with 3rd parties. Wodinsky recovered that Stardust was the lone app retired of the six tested that shared the user’s delicate wellness information with different company.

As quoted by BBC News, a Stardust spokesperson said that RudderStack is “contractually prohibited from selling oregon utilizing it for its ain purposes.” As U.S.-based companies, some Stardust and RudderStack tin inactive person demands for users’ accusation from instrumentality enforcement for users’ wellness accusation that’s stored connected their servers.

Stardust laminitis Rachel Moranis did not respond to TechCrunch’s petition for remark connected Thursday, oregon questions astir whether the institution has received demands for its users’ data. A spokesperson acknowledged receipt of an email but did not supply comment.

Of the six apps tested by Wodinsky, Mozilla recommended Euki arsenic “squeaky clean,” arsenic the app was not seen to beryllium sharing immoderate information with 3rd parties with its halfway features, and the user’s wellness information did not permission their device.