Analysis of Stardust period tracking app, the top free app on the US App Store on June 25, shows it shares users' phone numbers with analytics company Mixpanel

This Privacy Policy explains how Stardust App LLC. Tweets: @motherboard : Menstrual tracking app Stardust is one of Apple's top three most-downloaded free apps right now. It's also one of few apps that has said it will voluntarily—without being legally required to—comply with law enforcement if it's asked to share user data. https://www.vice.com/... @stardusttracker : What we did was implement an encrypted wall between our users personally identifiable information (email/phone/apple id/ etc) and what they actually do on the Stardust app. When you create an account on Stardust you generate a unique encryption key (on your phone) (4/8) Joseph Cox / @josephfcox : New: we asked tech companies if they would provide data to police about users + abortions Facebook, Twitter, Snapchat, TikTok, Google, Amazon, Discord, Verizon, AT&T, T-Mobile, Binance, Kraken, CashApp, Coinbase, Venmo, Uber and Lyft. None answered https://www.vice.com/... Zack Whittaker / @zackwhittaker : Stardust said it would roll out end-to-end encryption so it would “not be able to hand over any of your period tracking data” to the government. After we reached out, Stardust quietly removed any mention of end-to-end encryption from its privacy policy. https://techcrunch.com/... Zack Whittaker / @zackwhittaker : New: Period tracker Stardust rocketed to the top of Apple's app store over the weekend after Roe v. Wade was overturned. But the app shares the phone number of users (who give it when signing up) to a third-party analytics firm Mixpanel. w/ @sarahintampa https://techcrunch.com/... Morgan Sung / @morgan_sung : a few people recommended stardust when i put out a call for trustworthy period trackers, and on tiktok the company made a show of promising to protect its users :/ https://twitter.com/... https://twitter.com/... @notshenetworks : TechCrunch asked the founders for more information about how the app is implementing end-to-end encryption. Stardust founder Moranis told TechCrunch that “all traffic to our servers is through standard SSL (hosted on AWS) and subsequent data storage on AWS RDS” jfc https://twitter.com/... Danielle Abril / @danielledigest : “People should not give up, even though this ... may seem like a lot. [They] should take advantage of what they can do.” How to avoid leaving a digital trail when seeking an abortion. Via @heatherkelly, @Tatum_Hunter_, and me. https://www.washingtonpost.com/ ... https://twitter.com/...

TechCrunch 2022-06-28

Context & Ripple Effects

Stardust's data handling lands as [[a:980256|privacy advocates warned that period-tracking data could be shared with partners or affiliates and become evidence]] after Roe's reversal. The concern has a longer record: reporting on period apps found sensitive reproductive-health information flowing through third-party analytics and advertising systems.

The immediate tension is between Stardust's stated plan for end-to-end encryption and its disclosed use of Mixpanel for users' phone numbers, alongside its position that it would voluntarily comply with law-enforcement requests. Its removal of encryption language from the privacy policy makes the implementation details central to user trust.

First-order effects

Stardust users' phone numbers are shared with Mixpanel, creating a third-party analytics exposure separate from the app's claimed protections for period-tracking activity.
Stardust must reconcile its encryption rollout and AWS-based storage disclosures with its stated willingness to provide data to law enforcement; Mixpanel becomes part of the app's privacy scrutiny.

Second-order effects

Other period-tracking apps face pressure to audit analytics SDKs and distinguish account identifiers from health data, following earlier reporting that sensitive app data was sent through Facebook's analytics SDK.
Apple's top-chart distribution gives privacy-policy and third-party-data disclosures greater commercial importance for reproductive-health apps competing for downloads.

Third-order effects

If reproductive-health apps continue to rely on analytics vendors, privacy protections will increasingly depend on governance of SDK data flows rather than encryption claims alone.
The post-Roe market is pushing location and health-data businesses toward restricting sensitive-data use, as SafeGraph stopped selling visits to family-planning centers; apps that retain identifiable analytics trails face a sharper accountability standard.

The trend: Reproductive-health apps are being judged not just on what they collect, but on whether identifiers escape to analytics partners amid heightened legal-risk concerns.

Discussion

@josephfcox Joseph Cox on x
New: we asked tech companies if they would provide data to police about users + abortions Facebook, Twitter, Snapchat, TikTok, Google, Amazon, Discord, Verizon, AT&T, T-Mobile, Binance, Kraken, CashApp, Coinbase, Venmo, Uber and Lyft. None answered https://www.vice.com/...
@zackwhittaker Zack Whittaker on x
Stardust said it would roll out end-to-end encryption so it would “not be able to hand over any of your period tracking data” to the government. After we reached out, Stardust quietly removed any mention of end-to-end encryption from its privacy policy. https://techcrunch.com/...
@danielledigest Danielle Abril on x
“People should not give up, even though this ... may seem like a lot. [They] should take advantage of what they can do.” How to avoid leaving a digital trail when seeking an abortion. Via @heatherkelly, @Tatum_Hunter_, and me. https://www.washingtonpost.com/ ... https://twitter.c…
@zackwhittaker Zack Whittaker on x
New: Period tracker Stardust rocketed to the top of Apple's app store over the weekend after Roe v. Wade was overturned. But the app shares the phone number of users (who give it when signing up) to a third-party analytics firm Mixpanel. w/ @sarahintampa https://techcrunch.com/..…
@notshenetworks @notshenetworks on x
TechCrunch asked the founders for more information about how the app is implementing end-to-end encryption. Stardust founder Moranis told TechCrunch that “all traffic to our servers is through standard SSL (hosted on AWS) and subsequent data storage on AWS RDS” jfc https://twitte…
@martinapennisi Martina Pennisi on x
Flo and Natural Cycles are adopting “anonymous mode.” Here's what to know about period trackers now that Roe v. Wade is overturned. https://www.wsj.com/... via @WSJ
@brettstoelker Brett Stoelker on x
That being said, it's recommended to look at the privacy policy (the little pop up any time you install and use an app for the first time where you have to “Agree") and see how/where/what information is stored and used via 3rd party. Many can sell your information for profit.⤵️
@abortion_finder @abortion_finder on x
⚠️INSTAGRAM HAS TAKEN DOWN OUR PAGE.⚠️ Please help us continue to spread the word that https://abortionfinder.org/ is HERE to help folks access abortion care, and we aren't going ANYWHERE. https://twitter.com/...
@josephfcox Joseph Cox on x
Of course most companies in their privacy policies say they comply with legal requests for data. But it's not binary: Google pushed back in court on the breadth of some location data warrants. But no acknowledgement of whether tech firms will try that here https://www.vice.com/..…
@carnage4life Dare Obasanjo on x
Only 2% of venture dollars in the U.S. go to women. It's thus sad but not unsurprising that the biggest capital allocators in venture capital consider the Supreme Court dialing back 50 years of progress in women's rights as a non-event. The surprise would be if they even noticed …
@samplereality Mark Sample on x
Read ⁦@MistressSnowPhD⁩ on sex workers as early warning smoke detectors of a growing carceral state. It's not surveillance capitalism so much as it is surveillance theocracy. https://www.wired.com/...
@mpower_change @mpower_change on x
Just one of so many ways surveillance capitalism and Big Tech infect our daily lives. (Some good resources here on the tech implications of overturning Roe v Wade: https://mayfirst.coop/...) https://www.vice.com/...
@kwestin Ken Westin on x
Technology that can be abused, will be abused, the only variable is time. Corporate policies change, laws change and leadership changes, if data is collected it's only a matter of time before it can be abused. https://twitter.com/...
@conniewunphd Connie Wun, Phd on x
“This removal of federal protections gives lawmakers a path to criminalizing any online discussion about abortion, restrictions that can easily extend to include reproductive health entirely.” https://twitter.com/...
@timnitgebru Timnit Gebru on x
“Sex workers are typically the first demographic to be targeted because we are excellent scapegoats; we're not only criminalized but also highly stigmatized, so the general public is less likely to hear us let alone believe us.” https://www.wired.com/...
@gbbranstetter Gillian Branstetter on x
“Sex workers, fully aware that the general public is unconcerned with our well-being, have already been forced to develop strategies and guides on how to evade detection...strategies that can help abortion seekers and more as the carceral state expands.” https://www.wired.com/...
@sameifling Sam Eifling on x
“One of the most disturbing aspects of this financial discrimination raises the question: how do they know?” Excellent, alarming piece about the hungry surveillance apparatuses that are ready to track you in the post-Roe world https://twitter.com/...
@ourobororoboruo @ourobororoboruo on x
The infrastructure for the surveillance and punishment of abortion-seekers already exists, and if you want to make sense of it, listen to sex workers who's been navigating and strategizing for survival. https://www.wired.com/...
@neil_neilzone Neil Brown on x
A good (well, not good, the situation is dreadful, but you know what I mean), long read. https://twitter.com/...
@mistresssnowphd @mistresssnowphd on x
I wrote about abortion, FOSTA/SESTA, & why you should be listening to sex workers for @WIRED https://www.wired.com/...
@aevavoom @aevavoom on x
Listen to the canaries in your communities. LGBTQI+ folks and sex workers been talking about the rise in christofascism for years, but so few ever heard us. Consider this, then, a canary's song. Are You Ready to Be Surveilled Like a Sex Worker? | WIRED https://www.wired.com/...
@inafried Ina Fried on x
Re-upping this column I wrote in May, after the draft Dobbs opinion leaked. Tech companies still aren't saying what they will do when the inevitable data requests come from prosecutors... https://www.axios.com/...
@mcmisoprostol @mcmisoprostol on x
.@Abortion_Finder is one of the easiest and most reliable ways to find information about your closest LEGAL abortion provider. It is a tool that uses data from @ANSIRH at UCSF to ensure folks have access to up-to-date information. Today @instagram removed their account. https://t…
@julibriskman @julibriskman on x
Abortion still is legal in many states. Why would @instagram take down the page!?!? This is censorship in an effort to control women and it needs to stop! If you or someone you know needs to find reproductive healthcare, visit: https://abortionfinder.org/ https://twitter.com/...
@marciabelsky Marcia Belsky on x
.@instagram giving into the “illegality” of abortion immediately rather than even attempting to take a stance is disappointing but not at all surprising. @facebook is very white, very tech bro male https://twitter.com/...
@jmbooyah Johana Bhuiyan on x
The main way to not put people's user data at risk of being handed over to law enforcement is to not collect it or to limit how much you collect and how long you store it for in the first place.
@_shamgod @_shamgod on x
If your only advice around cyber security and privacy in the reproductive justice space is to tell ppl to delete their period apps, politely, tap out of the conversation.
@motherboard @motherboard on x
Menstrual tracking app Stardust is one of Apple's top three most-downloaded free apps right now. It's also one of few apps that has said it will voluntarily—without being legally required to—comply with law enforcement if it's asked to share user data. https://www.vice.com/...
@stardusttracker @stardusttracker on x
What we did was implement an encrypted wall between our users personally identifiable information (email/phone/apple id/ etc) and what they actually do on the Stardust app. When you create an account on Stardust you generate a unique encryption key (on your phone) (4/8)
@pwnallthethings @pwnallthethings on x
Because in the end, they're going to have to comply with legal requests. They can (and probably will) push back on overbroad or ill-formed requests, but there's going to be a non-trivial residual where they're just going to have to comply
@josephfcox Joseph Cox on x
New: #1 period tracking app on App Store says it may simply hand over data to cops without a warrant. Stardust has gained momentum by pitching itself as a privacy period app. But its policy says it may give cops data “whether or not legally required” https://www.vice.com/...
@samleecole Samantha Cole on x
when my period app rolls over for the cops without being legally required to? that's just mercury in retrograde, girlies 🥴 https://www.vice.com/...
@neerajka Neeraj K. Agrawal on x
they have to comply with law enforcement requests. they are going to turn over the data. financial intermediaries too https://twitter.com/... https://twitter.com/...
@derekberes Derek Beres on x
Peak conspirituality: an “astrology-focused” menstrual app has preemptively stated it will turn over data to the government without a warrant. https://www.vice.com/...
@r0wdy_ @r0wdy_ on x
Why are you storing any PII at all? https://twitter.com/...
@motherboard @motherboard on x
Update: In response to our reporting, Stardust changed its privacy policy to omit the phrase about cooperating with law enforcement “whether or not legally required.” https://www.vice.com/...
@carnage4life Dare Obasanjo on x
I don't think these threat models are likely because they are fishing expeditions with too many targets. More likely period app data will be used as a secondary source once a primary reason to investigate is found (e.g. location data, email or chat logs, etc). That's the threat.
@kennwhite Kenn White on x
2 days ago: We spent the last month racing to build this. If we get subpoenaed by the gov't...your data is completely anonymized. You are the only person who can see it. Today: Strike that. We'll tell all. And also, we [silently] removed the end-to-end ref in our privacy policy. …
@morgan_sung Morgan Sung on x
a few people recommended stardust when i put out a call for trustworthy period trackers, and on tiktok the company made a show of promising to protect its users :/ https://twitter.com/... https://twitter.com/...
@notshenetworks @notshenetworks on x
What is an “encrypted wall”? What about the meta data? How are you anonymizing the data? How are you making MONEY? https://twitter.com/...
@malwarejake Jake Williams on x
Seeing an app boasting an “encrypted wall” gives me about as much confidence as a car manufacturer telling me they'll protect me with “exploding crash pillows.” Even if you mean “air bags” and the care is actually safe, you're not inspiring confidence using the wrong term. https:…
@amyhoy Amy Hoy on x
i've seen so many people promoting this shitty period tracking app, stardust. guess what: it's an enthusiastic arm of the law! https://twitter.com/...
@hellahueck Hella Hueck on x
Developers of period trackers and fertility apps are working on ways to anonymize user data in response to the Supreme Court's ruling that struck down the constitutional right to an abortion. https://www.wsj.com/...
@psb_dc @psb_dc on x
Apps that help people monitor their menstruation and fertility can also be troves of personal data; deleting the app isn't always enough to clean up your #digital breadcrumbs. #data #privacy https://www.wsj.com/... via @WSJ @CordiliaJames @sharatibken https://twitter.com/...
@briannawu Brianna Wu on x
You should, of course, delete your period tracker app and not trust any of this. But, I can't help but note - these are overwhelmingly companies started by women and run by women. And it's just another way women pay the price for men's shitty behavior. https://www.wsj.com/...
@saysdana @saysdana on x
If you think your privacy is under attack, you need to find a way to delete this app and do it NOW. If you need an app to track your periods, you need to learn how to use a calendar (don't @ me). This data will be used against you. https://www.wsj.com/...
@evystadium Evy Kwong on x
the number one period tracker on the app store just put it in writing that they'll voluntarily—without even being legally required to—hand over your info to law enforcement if asked https://www.vice.com/...
@taoofgir @taoofgir on x
So much for their vaunted E2EE... “The data is anonymized” As .@datachick points out with some regularity, it's impossible to fully and truly sanitize and anonymize data like this. There will always be breadcrumbs. https://twitter.com/...
@carnage4life Dare Obasanjo on x
The period tracker discourse post-Roe is fear mongering without a threat model. One threat is Texas of other AG asking for all data they have to see if anyone who missed a period currently doesn't have a baby 9 months later. Another is they ask regularly https://www.vice.com/...
@___incandescent @___incandescent on x
It's being marketed as an app with end to end encryption on tik tok btw that's why it's blowing up, people think it's safe https://twitter.com/...
@blackamazon @blackamazon on x
DELETE THIS SHIT NOW https://twitter.com/...
@olivier_amar Olivier Amar on x
Just so you know, 99% of privacy policies say that they will give up your information if requested by authorities. As such, go over all your apps and start deleting anything everything that isn't a must. https://twitter.com/...
@callumj Callum Jones on x
Why do these apps need to store data outside of the phone? The iPhone has a pretty large hard-disk that is also backed up free (to the developer) of charge. https://twitter.com/...
@leahfeiger Leah Feiger on x
“mercury is in retrograde, also i'm gonna give your period info to the cops” — stardust, basically read @samleecole on the #1 period tracker in the app store that will hand over your data without a warrant, and implications in a post-Roe US: https://www.vice.com/...
@dangillmor Dan Gillmor on x
A reminder that the tech industry isa relentlessly privacy-shredding partner in the surveillance-industrial complex. https://twitter.com/...
@jason_koebler Jason Koebler on x
The top period tracking app on the app store says it will give user data to cops with or without a warrant https://www.vice.com/...
@learmonth Michael Learmonth on x
“We may disclose your anonymized, encrypted information to third parties ... and comply with or respond to law enforcement or a legal process or a request for cooperation by a government or other entity, whether or not legally required.” https://www.vice.com/... via @motherboard
@prestonjbyrne Preston Byrne on x
They don't have a choice unless they're prepared to go to court to quash the request, which they rarely do. They'll comply. https://twitter.com/...
@pernillet Pernille Tranberg on x
Tech companies are silent about their users' data re abortion rights. That's a tacit acknowledgment that data is so valuable, that they would rather keep on collecting it, even if people are thrown in jail, fined or killed https://www.protocol.com/...
@privacydigest @privacydigest on x
With Roe overturned, period-tracking apps raise new worries Period-tracking apps have been criticized for bad privacy practices. Here's how to track your cycle without sharing data with companies, employers, insurers or the government. https://www.washingtonpost.com/ ...
@abortion_finder @abortion_finder on x
WE ARE BACK ON INSTAGRAM! 👏 Thank you to everyone who helped call attention to the situation and uplift https://abortionfinder.org/ as a trustworthy resource for finding access to abortion care. ❤️ https://twitter.com/...
@tinkersec @tinkersec on x
Corporations will hand your info over to law enforcement in a heartbeat. Corporations don't give one single fuck about your rights beyond what they can use for marketing. Your google searches. Your GPS directions. Your period trackers. They'll *automate* turning it over. https://…
@jmbooyah Johana Bhuiyan on x
Tech companies & data brokers collect & store SO much user data for long periods of time which makes them huge targets for subpoenas & law enforcement requests. Tech companies can try to come up with ways to stall or fight these requests but sometimes they literally can't say no.
@kathmschmidt Kathleen Schmidt on x
Meta's new privacy policy goes into effect 7/26. Here's a screenshot of what data they collect. This is why women in states where abortion is banned SHOULD NOT communicate via Messenger or Instagram or post in groups. [Screenshots of Meta's updated privacy policy]
@_zeets Zito on x
“In essence, companies' silence says they think the data collection and sale process is so opaque, users won't raise a fuss about it. And data itself is more valuable to the companies than helping people have access to life-saving health care.” https://www.protocol.com/...

Chronicles