Privacy concerns around menstrual cycle tracking apps have resurfaced after a Mozilla Foundation audit of six popular trackers. The study, conducted in partnership with Harvard's Berkman Klein Center, found that only one app achieved a perfect score, while the worst performer, Stardust, scored a mere 2 out of 10. The investigation revealed that Stardust shares intimate reproductive health details with third parties from the moment it opens, with no opt-out available for users.
Stardust: a constant data stream to analytics and social networks
According to the Mozilla report by researcher Shoshana Wodinsky, the Stardust app activates third-party trackers upon launch, before the user enters any data. As soon as a symptom is logged, the information is sent to RudderStack, an analytics platform, along with a persistent user identifier. RudderStack is designed to route data onward to destinations that Mozilla could not observe. Additionally, Stardust sends an advertising identifier to Facebook, linking in-app behavior to existing Facebook profiles. Shared data includes birth control type, pregnancy status, mood, and physical symptoms such as breast tenderness and cramps. The company told TechCrunch it has never received a legal demand for user data, but the lack of an option to block sharing raises serious privacy concerns.
Sponsored Protocol
Euki: the only app with full privacy and tamper protection
In stark contrast, Euki, a nonprofit-run tracker, earned a perfect score of 10 out of 10. Euki requires no account, health data never leaves the phone, and the app offers advanced security features: users can set a PIN, schedule automatic data deletion, or activate a decoy screen if someone forces the phone open. The only weak spot is an in-app browser for educational pages that loads typical web trackers, but the app resets identifiers between visits, limiting tracking.
Sponsored Protocol
Privacy implications for health tracking apps
The disparity between Stardust and Euki highlights how app design can radically affect data protection. While Euki adopts a privacy-by-design approach with encrypted local storage, Stardust appears to monetize intimate information through third-party sharing. This case echoes other incidents where sensitive data was inadvertently exposed, such as the recent AWS billing glitch that showed billion-dollar fees to hundreds of customers, underscoring the need for rigorous data management controls. Mozilla, in releasing the audit, urged developers to follow Euki's example to ensure users can monitor their health without sacrificing privacy.
Sponsored Protocol
For women using cycle tracking apps, choosing a secure application is critical. Mozilla recommends checking privacy policies, preferring apps that do not require accounts and store data locally. In an era where health data is increasingly valuable, tools like Euki represent a beacon of transparency, while Stardust demonstrates how easily a useful app can become a surveillance tool. The Mozilla research, available on the foundation's official website, provides a detailed guide to navigate the options.
Source: https://www.wired.com/story/security-news-this-week-your-period-tracker-is-probably-spying-on-you
