Mozilla's 2026 Period Tracker Privacy Report: Stardust Shared Health Data, Euki Was the Only Safe App

Mozilla Foundation's July 2026 "Nothing Personal" research tested six popular period tracking apps — Euki, Clue, Flo, Period Calendar, Planned Parenthood's Spot On, and Stardust — and found a wide spectrum of privacy practices, from severe data-sharing violations to a single app that keeps everything on-device .

Key findings by app

• Stardust (score: 2/10) — The most alarming finding. Stardust transmits users' detailed reproductive health data — including pregnancy status, birth control type, moods, alcohol consumption, and specific symptoms like tender breasts and stomach cramps — to the analytics company RudderStack . This data sharing is not disclosed in Stardust's privacy policy . The app also sends basic user data (device IDs, advertising identifiers) to Facebook (Meta) and AppsFlyer from the moment it is opened, even before the user enters any information .

• Period Calendar (score: 6/10) — Sends device ID numbers and other identifying information to Google and the advertising company InMobi. Mozilla reports there is no way for users to prevent this data transmission .

• Planned Parenthood's Spot On (score: 5/10) — The app itself does not share health data, but when users access certain features — such as the AI chatbot "Roo" or a healthcare provider search tool — they are redirected to Planned Parenthood's website via an in-app browser. That website shares information about what kind of healthcare the user is seeking (including whether they are looking for HIV testing or gender-affirming care) with the analytics company AB Tasty, and also sends browsing data to Google, Microsoft, TikTok, and Pinterest .

• Flo (score: 7/10) — Collects extensive health data (cycle details, moods, symptoms, fertility goals) on its own servers but does not share that health data with third parties. Optional ad tracking sends encrypted data to partners like AppsFlyer, Moloco, and Google Firebase, but the privacy toggle works as advertised .

• Clue (score: 8/10) — Stores user health data on its own servers under German/EU privacy law and does not share sensitive health data with third parties during normal app use. However, it does transmit enough metadata (timestamps, in-app behavior) that outside services can tell when a device is using Clue .

• Euki (score: 10/10) — "Squeaky clean" rating — The only app that stores all health data locally on the user's device. No account creation is required. Mozilla's testing found no health data leaves the device during core features like cycle and symptom tracking. The only minor caveat is that certain educational resources open in an in-app browser that loads web trackers, but those trackers are assigned fresh identifiers each time and cannot see the user's health data .

Summary

Euki was the clear standout — the sole app that earned a "squeaky clean" rating by keeping all health data on the user's device and requiring no account . Stardust was the worst performer, sharing detailed reproductive health information with RudderStack without disclosing it in its privacy policy . Period Calendar, Stardust, and Spot On (via its in-app browser) all transmitted basic user data and advertising identifiers to platforms like Google, Meta, Microsoft, TikTok, and InMobi . Flo and Clue collected health data on their own servers but did not share it with third parties, though Clue still leaks metadata about app usage .