Period Trackers Are Leaking Your Health Data to Advertisers

A new Mozilla Foundation report, shared exclusively with the BBC, takes a hard look at the privacy practices of six popular period tracking apps: Flo, Clue, Stardust, Spot On, Period Calendar, and Euki. The findings are a mixed bag—some apps are squeaky clean, others are sharing your most intimate health data with companies you've never heard of.

Who Gets Your Health Data?

Stardust, an app that blends menstrual tracking with astrology, promises on its website that “your data is private. Period.” But Mozilla found that Stardust sends detailed reproductive health information—including pregnancy status, birth control use, mood, alcohol consumption, and specific symptoms like tender breasts and stomach cramps—to a data management company called RudderStack. RudderStack isn't even mentioned in Stardust's privacy policy. A Stardust spokesperson says RudderStack is used only as a “technical pipeline” to route data into Stardust's own analytics, and that RudderStack is contractually prohibited from selling or using the data for its own purposes. Still, as Mozilla's Shoshana Wodinsky puts it, “People deserve better.”

Planned Parenthood's Spot On app doesn't share health data directly, but when you tap certain features—like the AI chatbot Roo or a provider search tool—you're taken to Planned Parenthood's website, which shares information about what kind of care you're looking for (HIV testing, gender-affirming care, etc.) with analytics company AB Tasty. Wodinsky says this could probably be fixed in an afternoon.

Who Sees That You're Using the App?

Even when apps don't share health details, many leak the fact that you're using a period tracker. Mozilla found that most apps send basic user information—device IDs, advertising identifiers—to platforms like Google, Meta, Microsoft, and TikTok. This can be used for targeted ads and cross-site tracking. As Sara Geoghegan of the Electronic Privacy Information Center notes, simply revealing that you use a reproductive health app can tip off law enforcement that there's a trove of data to subpoena.

Period Calendar (also called “Period Tracker Period Calendar”) sends device IDs to Google and InMobi with no opt-out. Stardust shares similar data with Facebook and AppsFlyer, though you can opt out via phone settings. Spot On's website shares data with Google, Microsoft, TikTok, and Pinterest, with no opt-out available.

Where's the Data Stored?

Euki is the standout: it stores all health data locally on your device, doesn't require an account, and even offers a decoy feature that shows fake info if someone snoops on your phone. Mozilla recommends it without reservations. Flo and Clue also score well—they don't share health data with third parties, and their privacy controls are transparent and easy to use.

The bottom line: if you're using a period tracker, check what data leaves your phone and where it goes. The safest bet is an app that keeps everything local.