Mozilla Audit Finds Period Trackers Still Repeat Flo’s 2021 Mistake

Mozilla Foundation testers watched the period tracking app Stardust send data to a third-party analytics firm the instant they logged a symptom, before ever touching a privacy setting. The firm was RudderStack, and the data included birth control type and reproductive goals, tagged with a persistent ID standing in for a name. It is the same pattern the Federal Trade Commission (FTC) caught Flo Health running five years earlier, and the class action tied to that case is still winding through court today.

The new findings come from a hands-on privacy investigation Mozilla published on July 16, 2026, grading six popular period and ovulation trackers on what they actually do with the health data users log every day. One app scored a perfect 10 out of 10. Another scored 2.

Six Trackers, Six Very Different Scores

Mozilla’s researchers combined manual testing with network traffic analysis, and worked with a Harvard-backed review of each app’s privacy policy history to see how those disclosures changed over time. Testers from the University of Illinois added Android-specific checks.

The results split the field in two.

None of the lower scorers were caught selling menstrual histories outright. What Mozilla found was quieter than that. An app can keep a user’s actual period dates inside its own systems while still telling advertising or analytics companies that a specific device is running a reproductive-health app, which is enough to fold someone’s cycle into an ad profile.

How Stardust Leaks Symptoms the Moment You Log Them

Stardust markets itself as a mystical, younger-skewing tracker that uses astrology and moon phases to explain mood and energy. Its website still promises, “Your data is private. Period.”

Mozilla’s testing tells a different story. The app’s own privacy review found that Stardust sends data to third-party tracking services from the moment it opens, before a user enters anything at all. Once someone logs a symptom, birthdate, birth control type, or reproductive goal, that detail moves to RudderStack, a platform built to route analytics data onward to other destinations, alongside a persistent identifier. Testers said they could not find a clear in-app setting to turn the sharing off. The app also passes Facebook an ad identifier that ties in-app activity back to a user’s existing profile there.

Stardust once marketed itself as an encrypted, privacy-safe option in the wake of Roe v. Wade being overturned. Reporters later found the app used standard transport encryption rather than the end-to-end protection its marketing implied, and Stardust quietly dropped the claim. Its privacy policy has since grown twice in about seven months, each revision disclosing more about the advertising partners it works with, including naming Meta’s and Google’s ad-measurement tools as of May 2026.

Shoshana Wodinsky, the Mozilla researcher who ran the tests, spent a year advising the FTC on privacy cases before joining the nonprofit’s investigative team. A company spokesperson told her team, “Stardust does not provide RudderStack with any information that can identify the user.” Separately, Stardust told TechCrunch it has never received a legal demand for user data from authorities or third parties.

Euki Wins by Collecting Almost Nothing

Euki is a nonprofit, open-source tracker that lets users log periods, pregnancy details, and symptoms without creating an account. It does not run a back-end database of individual cycle histories at all. Everything a user types stays on the device, and the app offers a PIN, scheduled auto-deletion, and a decoy screen for anyone who needs to hide it from a partner or family member checking their phone.

Your period is private. Make sure your app agrees.

That line closes Mozilla’s report, and it doubles as the investigation’s actual thesis. Euki’s perfect score did not come from stronger contracts or better consent screens. It came from never collecting the data centrally in the first place, which leaves almost nothing to leak, sell, or hand over. Mozilla’s one caveat: Euki’s in-app browser for educational content still loads standard web trackers, though it resets identifiers between visits.

Flo Health Already Paid for This Exact Mistake

Flo scored 7 out of 10 in the new audit, a middling grade that still represents years of forced improvement. In January 2021, the FTC accused Flo of promising to keep users’ health data private while quietly disclosing it to marketing and analytics firms, including divisions of Facebook and Google. The agency finalized its order that June, requiring Flo to get affirmative user consent before sharing health data and to submit to independent privacy reviews.

A parallel class action, Frasco v. Flo Health, covered users who entered menstrual or pregnancy information into the app between November 2016 and February 2019. Flo, Google, and Flurry eventually agreed to a combined settlement rather than let a jury decide the case.

1. January 2021: The FTC accuses Flo Health of disclosing users’ health data to Facebook’s and Google’s analytics arms despite promising to keep it private.
2. June 2021: The FTC finalizes its order, requiring consent before data sharing and an independent compliance review.
3. 2022: The Dobbs ruling ends the federal right to abortion, and reproductive health apps become a flashpoint for surveillance concerns.
4. April 2023: Washington signs the My Health My Data Act, the first state law built specifically around health data collected outside HIPAA.
5. 2025: Flo, Google, and Flurry agree to a combined $59.5 million settlement over the same conduct, split roughly $48 million from Google, $8 million from Flo, and $3.5 million from Flurry.
6. May 2026: Stardust’s privacy policy is updated to name Meta and Google ad-measurement tools as partners, per Berkman Klein Center snapshots.
7. July 16, 2026: Mozilla publishes its six-app audit, scoring Stardust 2 out of 10 and Euki 10 out of 10.

The official settlement notice for the case sets an objection deadline of October 8, 2026, barely three months after Mozilla’s newest findings landed. The FTC’s 2021 order against Flo Health reads almost like a preview of what Mozilla just documented at Stardust, minus the astrology branding.

Is There Actually a Law Against This?

Yes, in one state so far. Washington’s My Health My Data Act bans companies from sharing health data, including reproductive health data, without consent, and lets consumers sue directly. Nevada and Connecticut have adopted narrower versions. No federal law does the same thing yet, and most apps’ terms of service are still enforced case by case.

Washington’s law, known as MHMDA, was written with this exact scenario in mind. Its primary sponsor, Rep. Vandana Slatter, described it as part of a legislative package responding directly to Dobbs. The law covers any business that collects health-linkable data, not just hospitals or insurers bound by HIPAA, and it bans geofencing around health clinics for tracking or ad targeting.

Enforcement runs two ways. Washington’s Attorney General can pursue civil penalties, and consumers can sue on their own and collect treble damages. A private right of action like this one is unusual among US state privacy laws, most of which leave enforcement solely to a state attorney general’s office. Whether any of it gets applied to a period tracker specifically is still an open question. No such case has surfaced yet.

More Users Than Ever Are Exposed

This is not slowing adoption. Menstrual health apps were a $2.0 billion global market in 2025, and one industry estimate projects that figure reaching $7.7 billion by 2033, growing at roughly 18% a year. Flo alone reported more than 70 million monthly active users globally as of 2024.

That growth means more people logging sex drives, contraceptive use, moods, and cramps into apps whose back-end data flows most users never see. Every new download is another record sitting somewhere between a phone and an ad network, waiting on a privacy policy update to explain where it actually goes.

What to Check Before You Trust a Tracker

• Look for a local-storage or offline mode. If health data never has to leave the device, there is nothing for a third party to intercept or subpoena later.
• Open the app for the first time and watch what happens before you type anything. Mozilla found some trackers pinging analytics services on launch, before a single symptom is entered.
• Test the in-app browser separately from the core app. Even privacy-conscious trackers can leak location and search details once a user taps into an embedded webpage.
• Read who the named analytics and ad partners actually are. A policy that names Meta, Google, or a data pipeline like RudderStack is telling you exactly where symptom logs can travel.

None of these steps require technical expertise, just a slower first ten minutes with a new app before handing over a birth control history.

Frequently Asked Questions

Which period tracker is the most private?

Mozilla’s testing ranked Euki highest at 10 out of 10 because it requires no account, keeps entered data only on the user’s device, and adds a PIN, scheduled auto-deletion, and a decoy screen for anyone who needs to hide the app from someone checking their phone.

Is Flo safe to use in 2026?

Flo scored 7 out of 10 in Mozilla’s latest audit, an improvement tied directly to its 2021 FTC settlement, which forced the company to get consent before sharing health data and submit to independent privacy reviews. It still stores data on its own servers and runs an AI symptom chatbot, so it is not data-minimal the way Euki is.

Does uninstalling a period tracker delete my data too?

Not automatically. Removing the app only clears what is stored locally. Anything already sent to an analytics partner, ad network, or cloud server generally stays there unless a company is specifically required to delete it, which is exactly what the FTC’s 2021 order forced Flo Health to do for the third parties that had already received user data.

What is RudderStack, and is it only used by period trackers?

RudderStack is a customer data platform that many companies across industries use to collect app events and route them into their own analytics systems. It is not a period tracker-specific tool and is not inherently a privacy violation. Mozilla’s concern was the type of data Stardust chose to send through it, not the platform itself.

Can law enforcement get my period tracker data?

It depends on where the data lives and what the company promises. Apps that keep data only on the device, like Euki, have little or nothing to hand over even if served with a request. Apps that store data on company servers or route it through third parties can be compelled to disclose it, which is part of why Washington’s My Health My Data Act specifically bans geofencing around health clinics and requires consent before sharing.