Mozilla's latest privacy review has put the Stardust period-tracking app in the spotlight, after researchers found that some user health details were being shared with a third-party analytics company, RudderStack.
The data reportedly included birthdate, birth control type, reproductive goals, and symptom information, all linked to a unique identifier rather than a name. Mozilla notes that this kind of identifier can still be connected back to a person, making the information far less anonymous than it may appear.
The findings highlight a broader issue facing many health and wellness apps: background data sharing that users may not notice. Even when data is used for analytics, storage, or payments, it can create privacy exposure if it moves beyond the device.
Mozilla security researcher Shoshana Wodinsky examined the network traffic of several period trackers and found Stardust was the only app in the group tested that appeared to send sensitive health data to another company. In contrast, Mozilla described Euki as especially privacy-focused, with core health data staying on the device.
Stardust said RudderStack is contractually barred from selling or using the information for its own purposes. Still, the case reflects how digital health tools are increasingly being judged not only by convenience, but by how carefully they handle personal information.
As health apps continue to evolve, privacy-first design may become a defining standard for trust in the next generation of digital wellness.
