“Your knowledge is personal. Interval,” says interval tracker Stardust on its web site. As new analysis by Mozilla found, some customers may discover that declare to be a stretch.
In line with Mozilla’s latest findings analyzing the privateness practices of period-tracking apps, Stardust was discovered to be sharing customers’ delicate well being data with third-party analytics firm RudderStack. This knowledge included the person’s birthdate, contraception kind, reproductive objectives, and particular signs that the person was experiencing, and it tied that file to a novel identifier rather than the individual’s title. (The FTC has long warned that this doesn’t make the information nameless or stop it from being linked again to an individual.)
Mozilla’s analysis underscores the safety and privateness dangers with utilizing interval monitoring and different well being apps that share knowledge with third events. Oftentimes this occurs as background exercise inside the app, and isn’t seen to the person. It’s not unusual for apps to share knowledge with different companies for storage, analytics, and funds, however sharing customers’ data with third events inherently carries dangers, similar to potential safety lapses, knowledge breaches, or having the information sought by regulation enforcement.
TechCrunch beforehand wrote about Stardust in 2022 after the app surged in downloads following the overturning of the constitutional proper to hunt an abortion in america. Stardust claimed it was end-to-end encrypted — which means that not even the corporate might entry its customers’ knowledge — however TechCrunch discovered by analyzing the app’s community site visitors that the company’s claim was false.
Mozilla safety researcher Shoshana Wodinsky used an identical strategy of analyzing the community site visitors of a number of interval trackers, together with Stardust, to know how the apps collected and shared knowledge (if in any respect) with third events. Wodinsky discovered that Stardust was the one app out of the six examined that shared the person’s delicate well being knowledge with one other firm.
As quoted by BBC News, a Stardust spokesperson mentioned that RudderStack is “contractually prohibited from promoting or utilizing it for its personal functions.” As U.S.-based firms, each Stardust and RudderStack can nonetheless obtain calls for for customers’ data from regulation enforcement for customers’ well being data that’s saved on their servers.
Stardust founder Rachel Moranis didn’t reply to TechCrunch’s request for touch upon Thursday, or questions on whether or not the corporate has obtained calls for for its customers’ knowledge. A spokesperson acknowledged receipt of an electronic mail however didn’t present remark.
Of the six apps examined by Wodinsky, Mozilla beneficial Euki as “squeaky clear,” because the app was not seen to be sharing any knowledge with third events with its core options, and the person’s well being knowledge didn’t depart their machine.
Whenever you buy via hyperlinks in our articles, we may earn a small commission. This doesn’t have an effect on our editorial independence.
