Mozilla 2026 Period Tracker Privacy Report: Stardust Shared Health Data with RudderStack, Euki Rated 'Squeaky Clean'

In July 2026, Mozilla's Privacy Not Included research team published a privacy review of six popular period-tracking apps, revealing a stark divide between apps that quietly share sensitive data with third parties and the one app that keeps everything local. The findings have renewed concerns about how reproductive health data is handled, particularly in a post-Roe legal environment where such data could be requested by law enforcement .

The App Sharing Detailed Reproductive Health Data with an Undisclosed Third Party

Stardust was the only app in Mozilla's review found to be sharing users' detailed reproductive health information with an external company that was not disclosed in its privacy policy . The data was sent to RudderStack, a data management and analytics firm .

According to Mozilla's testing and reporting by the BBC and TechCrunch, the specific data points Stardust shared included :

• Birthdate
• Birth control type (e.g., whether the user uses medication or an IUD)
• Reproductive goals
• Specific symptoms the user was experiencing

This data was tied to a unique persistent identifier, which the Federal Trade Commission (FTC) has long warned does not make the data anonymous or prevent it from being linked back to a specific person . The finding was particularly notable because Stardust markets itself as a privacy-first option, with its website stating "Your data is private. Period."

Apps Sharing Basic User Data with Advertising Platforms

Mozilla found that several other apps sent basic device and usage data to advertising and analytics platforms, often without meaningful user consent.

Period Calendar, the only ad-supported app in the review, was caught sending a "steady stream" of device details to Google immediately upon opening the app, before any user interaction . The data included phone model, screen dimensions, and timezone, feeding ad systems like DoubleClick and AdMob that run the ads inside the app and track their performance .

Flo, one of the most popular period trackers globally, shares basic app and device data with ad and analytics partners when users opt in . Mozilla's testing found that agreeing to data sharing brought in companies like AppsFlyer, Moloco, and Google's Firebase service . Flo also has a significant history of privacy violations. In 2021, the FTC cited Flo for sharing sensitive health information with Facebook and Google after promising not to . More recently, a $59.5 million class-action settlement was reached in 2026 over the same practices . A Canadian class-action lawsuit has also been certified .

More broadly, Mozilla noted that multiple apps in the review sent data to companies including Google, Meta (Facebook), and TikTok .

The Sole Privacy-Focused Alternative Storing Data Locally

The standout exception in Mozilla's review was Euki, which received a "squeaky clean" rating . Euki is created by the non-profit organization Women Help Women and is designed with a radically different data model .

Key characteristics of Euki as identified by Mozilla :

• Collects zero personal information about users
• All health data is stored locally on the user's device — no account is needed, there is no cross-device backup, and no cloud sync exists
• The app can be locked behind a PIN and wiped at any time
• Mozilla's testing described Euki's default setup as "squeaky clean" and noted that no third-party data collection was observed when using core features like cycle and symptom tracking

Euki's architecture means that even if a legal demand were made for user data, there is nothing on Euki's servers to hand over. The only minor caveat Mozilla found was that some of Euki's embedded educational content (opened in a web view) could trigger third-party trackers, but the core tracking features remain fully local .

Implications for Period Tracker Users

The takeaway from Mozilla's 2026 review is clear: most major period tracking apps share data beyond what users expect, and the risks are amplified in jurisdictions where reproductive health data could be subpoenaed. For users seeking the strongest privacy guarantees, Euki remains the gold standard, storing everything on-device and collecting nothing at the server level.