Period tracker apps expose intimate health data to advertisers, Mozilla warns

A period tracking app called Stardust promises users that their data is private. The company's website is blunt about it: "Your data is private. Period." But according to new research from the Mozilla Foundation, the creators of Firefox, that promise may mean something very different to Stardust than it does to the people using the app.

Mozilla investigated six popular period trackers—Flo, Clue, Stardust, Spot On, Period Calendar, and Euki—to understand how they handle intimate reproductive health information. What researchers found was a landscape of wildly inconsistent privacy practices. Some apps have built strong walls around user data. Others funnel information to Google, Meta, TikTok, and companies most users have never heard of. None of this is necessarily illegal. But it matters now in ways it didn't before. Since the US Supreme Court overturned federal abortion protections in 2022, privacy experts have grown increasingly worried that the detailed menstrual and reproductive information these apps collect could end up in the hands of law enforcement and be used against women in criminal cases.

Stardust emerged as the most troubling case in Mozilla's analysis. The app sends users' health information to a data management company called RudderStack—a detail that doesn't appear in Stardust's privacy policy. The data being transferred includes pregnancy status, birth control use, mood patterns, alcohol consumption, and specific physical symptoms like tender breasts and stomach cramps. A Stardust spokesperson defended the practice, saying RudderStack functions only as a technical pipeline to route data into the company's own analytics systems, and that the data shared doesn't include identifying information like names or contact details. The company also noted that RudderStack is contractually prohibited from selling the data or using it for its own purposes. Still, privacy researcher Shoshana Wodinsky, who conducted Mozilla's tests, argued that the fundamental problem remains: "People deserve better. At the very least, you should know what's happening."

Spot On, an app created by Planned Parenthood, presented a different kind of problem. The app itself doesn't share data with outside companies or attempt to track users. But when people use certain features—an AI chatbot called Roo or a tool to search for healthcare providers—the app opens Planned Parenthood's website in a browser. That website, Mozilla found, is less secure. It shares information about what kind of healthcare users are seeking with an analytics company called AB Tasty. This includes whether someone is looking for HIV testing or gender-affirming care. When users access Planned Parenthood's website through the Spot On app, the site also shares data with Google, Microsoft, TikTok, and Pinterest, with no way for users to prevent it.

Not all the apps studied performed equally poorly. Euki stood out as what Mozilla called "squeaky clean." Unlike the others, Euki stores all health information directly on users' devices, never sending it to company servers. Users don't even need to create an account, so they can remain completely anonymous. The app even includes a decoy feature that displays fake, harmless information if someone gains access to a phone and tries to look at the data. Euki's approach proves that a different model is possible.

Flo and Clue, two of the most widely used period trackers, fell somewhere in the middle. Neither app shares health information with third parties, and both offer granular privacy controls that users can adjust. But both apps collect far more health data than necessary and store it on their own servers rather than keeping it on users' devices. That creates vulnerability. Even if the companies never intentionally share the information, the mere fact that they maintain copies of it creates exposure to data breaches or legal requests from governments. Flo's chief spokesperson, Samantha Wannemacher, pointed to an "Anonymous Mode" feature that ensures no one—including Flo itself—holds both a user's identity and their health data simultaneously. She also noted that Flo has never received a subpoena for user data, which the company said it would fight. Clue's chief executive, Rhiannon White, stated flatly: "We have never disclosed private health data to any authority, and we never will."

But history matters. Flo settled a case with the US Federal Trade Commission in 2021 over allegations that it had shared sensitive user information with Meta, Google, and others despite promising to keep data private. While Flo's practices improved after that settlement, the company later expanded its privacy policy to include new advertising partnerships. The pattern suggests that even when companies tighten their practices, the pressure to monetize user data through advertising can pull them back toward looser standards. Other apps have faced similar scrutiny. A 2022 investigation found lists of individual devices using Clue, Period Calendar, and other period trackers being sold online, though Clue's leadership disputed the source of that data.

The stakes of these privacy failures have shifted dramatically. In a country where abortion is increasingly criminalized, where police have already obtained other kinds of data from tech companies and used it to prosecute women, the intimate details stored in period tracking apps represent a new kind of vulnerability. Mozilla researcher Geoghegan framed the larger issue: "People are rightfully concerned, because we live in a world that has combined ubiquitous surveillance with the criminalisation of abortion." She also noted that privacy fears themselves carry a cost—they cause anxiety that prevents people from using tools designed to improve their health. The research underscores a broader reality: the United States, unlike Europe, has no national privacy law to protect this kind of sensitive information. Without regulation, the choice of which app to use becomes a calculation about which company you're willing to trust with data that could, in the wrong hands, change your life.