Period Tracker Apps Send Health Data to Third Parties, Audit Finds

Most popular period tracking applications share users' intimate reproductive health information with third-party data firms, according to a privacy audit conducted by the Mozilla Foundation in partnership with Harvard's Berkman Klein Center.

The review examined six widely used menstrual cycle tracking apps and assigned privacy scores ranging from 2 to 10 out of 10. The findings, first reported by the BBC, reveal that only one app—the nonprofit-run Euki—earned a perfect score for protecting user data.

Stardust sends detailed health data to analytics firms

The astrology-themed tracker Stardust received the lowest score of 2 out of 10. Mozilla researcher Shoshana Wodinsky discovered the app transmits users' birth control type, pregnancy status, moods, and specific symptoms like tender breasts and stomach cramps to analytics firm RudderStack—a company not disclosed in Stardust's privacy policy.

The data sharing begins immediately when users open the app, before they enter any information. When Wodinsky logged a symptom, those details were sent to RudderStack alongside a persistent user identifier. The app provides no in-app option to disable this sharing. RudderStack's infrastructure is designed to route data onward to additional destinations that Mozilla could not observe.

Stardust also shares an advertising identifier with Facebook that connects in-app behavior to users' existing platform profiles. The company told TechCrunch it has never received legal demands for user data.

One nonprofit app keeps data on-device

Euki, developed by a nonprofit organization, achieved the audit's only perfect privacy score. The app requires no account creation, stores all health data locally on users' phones rather than transmitting it to servers, and offers security features including PIN protection, scheduled automatic deletion, and a decoy screen that users can display if someone forces them to open the phone.

The app's single privacy weakness involves an in-app browser for educational content that loads standard web trackers. However, Euki resets identifiers between browsing sessions to limit tracking.

Why it matters

The audit arrives as reproductive health data faces heightened legal and political scrutiny. Period tracking apps collect some of the most sensitive personal information—details that could potentially be used in legal proceedings, shared with law enforcement, or exploited by data brokers. With millions of people relying on these apps to monitor their menstrual cycles and fertility, the extensive third-party data sharing documented by Mozilla represents a significant privacy risk that most users likely don't understand when they download these applications.

The findings were first reported by the BBC based on Mozilla Foundation research conducted with Harvard's Berkman Klein Center.