{"id":63897,"date":"2026-07-18T19:54:30","date_gmt":"2026-07-18T23:54:30","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=63897"},"modified":"2026-07-18T19:54:30","modified_gmt":"2026-07-18T23:54:30","slug":"stardust-period-tracker-privacy","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/stardust-period-tracker-privacy\/","title":{"rendered":"Stardust Period Tracker Sends Health Data to Facebook"},"content":{"rendered":"

The astrology-themed period tracking application Stardust transmits sensitive reproductive health information\u2014including birth control type, pregnancy status, moods, and specific symptoms such as tender breasts and stomach cramps\u2014to a data analytics firm not disclosed in its privacy policy, according to a Mozilla Foundation<\/a> audit conducted in partnership with Harvard’s Berkman Klein Center. The audit, which evaluated six popular period trackers, awarded Stardust a score of two out of ten, the lowest in the group, and revealed patterns of data sharing that extend to Facebook and third-party analytics infrastructure with no in-app mechanism for users to stop the transmission.<\/p>\n

Stardust Period Tracker Sends Health Data to Facebook and RudderStack<\/h2>\n

Mozilla researcher Shoshana Wodinsky discovered that Stardust pings third-party trackers from the moment the application opens, before a user enters any information. The instant a symptom was logged, the details were transmitted to the analytics firm RudderStack<\/a> alongside a persistent user identifier, with no in-app setting available to disable the sharing. RudderStack is designed to route data onward to additional destinations that Mozilla could not observe, creating an opaque chain of data transmission beyond what the audit could track. Stardust also sends Facebook an ad identifier that links in-app behavior to the platform’s existing user profiles, effectively connecting intimate health data with Meta’s advertising ecosystem. The company told TechCrunch that it has never received a legal demand for user data.<\/p>\n

What the Mozilla Audit Revealed About Period Tracker Privacy<\/h2>\n

The audit, produced by the Mozilla Foundation in partnership with Harvard’s Berkman Klein Center, examined six popular period tracking applications and found significant variation in privacy practices. Stardust’s score of two out of ten reflected the absence of meaningful data controls, the presence of third-party tracking from launch, and the lack of transparency about data flows. By contrast, Euki, a nonprofit-run tracker, earned a perfect score of ten: it requires no account, health data never leaves the device, and users can set a PIN, schedule automatic deletion, or display a decoy screen if someone forces the phone open. The only identified soft spot in Euki is an in-app browser used for educational pages that loads standard web trackers, though the application resets identifiers between visits.<\/p>\n

How Stardust Period Tracker Shares User Data With Third Parties<\/h2>\n

The data-sharing mechanism operates automatically and without user consent options within the application. When a user opens Stardust, tracking begins immediately. When a symptom is logged, the record\u2014including the specific symptom, timing, and a persistent user identifier\u2014is sent to RudderStack, an analytics platform that can forward data to additional services. Simultaneously, an ad identifier is transmitted to Facebook, enabling the platform to associate in-app reproductive health activity with the user’s broader digital profile for advertising purposes. The audit found no disclosure of the RudderStack relationship in Stardust’s privacy policy, and no method within the app for users to review, export, or delete the data being shared.<\/p>\n

Broader Cybersecurity Threats This Week<\/h2>\n

In a separate incident with implications for digital privacy, Russia’s FSB was identified by Western intelligence agencies as the perpetrator of a cyberattack against the Polish electric grid that came close to causing blackouts and water utility outages. The attack, initially attributed to the GRU-affiliated Sandworm<\/a> group, marks a rare instance of the FSB carrying out disruptive infrastructure hacking. Separately, the Russian cybersecurity firm Kaspersky faces renewed scrutiny after reports that Denis Obrezko, a man charged with hacking NATO governments and US companies, worked at the company between stints at the FSB. Kaspersky stated that the charged offenses cannot be related to the individual’s role during his employment. In the US, DHS<\/a> officials twice dismissed signs of a breach in the Homeland Security Information Network as false positives before confirming a real intrusion that exposed highly sensitive unclassified data. Meanwhile, AI music startup Suno<\/a> suffered a breach that exposed account information for hundreds of thousands of customers, including emails, phone numbers, and Stripe payment records, alongside internal data showing the company scraped millions of songs and podcasts from YouTube Music, Deezer, and other platforms to train its models.<\/p>\n

What Affected Users Should Do Now<\/h2>\n

Anyone who has used Stardust should immediately change their password and revoke any third-party application permissions tied to the account. Enable two-factor authentication on all accounts that support it, particularly those connected to health or reproductive data. Monitor financial accounts and credit reports for signs of identity misuse, especially if the same credentials were reused across services. For those seeking a period tracker with stronger privacy guarantees, choose an application that processes health data entirely on the device, requires no account creation, and has been independently audited by a reputable security research organization. Read the privacy policy before entering any health information, and verify that the application provides a clear, in-app method to disable all third-party data sharing. Consider using a reputable no-log VPN service when accessing sensitive health applications on public or untrusted networks to reduce the risk of traffic interception and additional data leakage.<\/p>\n","protected":false},"excerpt":{"rendered":"

The astrology-themed period tracking application Stardust transmits sensitive reproductive health information\u2014including birth control type, pregnancy status, moods, and specific symptoms such as tender breasts and stomach cramps\u2014to a data analytics firm not disclosed in its privacy policy, according to a Mozilla Foundation audit conducted in partnership with Harvard’s Berkman Klein Center. The audit, which evaluated […]<\/p>\n","protected":false},"author":7,"featured_media":83853,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/63897.png","fifu_image_alt":"Stardust Period Tracker Sends Health Data to Facebook","footnotes":""},"categories":[349],"tags":[],"class_list":["post-63897","post","type-post","status-publish","format-standard","has-post-thumbnail","category-articles"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/63897.png","fifu_image_alt":"Stardust Period Tracker Sends Health Data to Facebook","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/63897","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=63897"}],"version-history":[{"count":0,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/63897\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/83853"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=63897"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=63897"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=63897"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}