A Mozilla Foundation investigation found major differences in how six popular period tracking apps handle reproductive health and identifying data. Stardust was the only app found sending detailed health information to another company, while Euki kept users’ health records entirely on their devices.
Mozilla examined Flo, Clue, Stardust, Spot On, Period Calendar and Euki by analysing the data leaving users’ devices. Its period tracker privacy research considered what information each app collected, where it was stored and which outside services received it.
Stardust Sent Health Data to RudderStack
The investigation found that Stardust sent reproductive health information to analytics provider RudderStack, which was not identified in the app’s privacy policy. The data included pregnancy status, birth control use, reproductive goals, moods, alcohol consumption and symptoms such as stomach cramps and breast tenderness.
The information did not include names or contact details, but it was connected to a unique identifier. Privacy researchers have warned that removing a person’s name does not necessarily prevent information from being linked back to them.
Stardust said RudderStack acts only as a technical pipeline that routes information into its own analytics systems. The company added that RudderStack cannot sell or use the information for its own purposes and does not retain it over the long term.
Mozilla also found that Stardust sent device and identifying information to Meta and AppsFlyer for advertising measurement. Stardust said it did not provide health information to advertising platforms and that users could limit the tracking through their phone settings.
Other Apps Shared Advertising and Usage Data
Period Calendar sent device details and identifying numbers to Google and advertising company InMobi, according to the investigation. Mozilla said users had no option within the app to prevent those transfers.
Spot On itself did not share health records or track its users. However, selecting its Roo chatbot or healthcare provider search opened Planned Parenthood’s website, which sent browsing information to several analytics and advertising companies.
Mozilla found that AB Tasty could receive information about the type of healthcare a visitor searched for, including HIV testing and gender-affirming care. The website also shared identifying or device information with services operated by Google, Microsoft, TikTok and Pinterest.
Euki Keeps Health Records on the User’s Device
Mozilla gave Euki its strongest recommendation because the app stores reproductive health information locally rather than sending it to company servers. Users do not need an account, and Euki says it cannot access, share or sell the information entered into the app.
Euki also provides an optional PIN and a decoy function that displays harmless information when someone else opens the app. Deleting the app permanently removes the locally stored records.
Flo and Clue also received relatively favourable assessments because Mozilla did not find either app sharing health information with third parties. Both store users’ records on company servers and send some usage information to advertising or analytics services, although users can disable those transfers.
Flo offers an Anonymous Mode intended to separate a person’s identity from their health information. Clue, which is based in Germany, operates under European data protection requirements and says it has never disclosed private health records to an authority.
Mozilla noted that server-based storage still creates exposure to security incidents and legal demands, even when an app does not sell or voluntarily share health information. The level of risk therefore depends on the information collected, where it is retained and how many outside services receive data from the app.
Featured image credits: Magnific.com
For more stories like it, click the +Follow button at the top of this page to follow us.