Popular 'Secure' Period Tracker Stardust Shares User Phone Numbers
Despite promises of end-to-end encryption, the period tracking app Stardust currently shares user phone numbers with a third-party analytics firm, raising significant privacy concerns following the overturn of Roe v. Wade.
Period tracking app Stardust shoots to the top of the U.S. Apple App Store after promising to encrypt user data in the wake of the Supreme Court's decision to overturn Roe v. Wade. Worried users abandon other period trackers and flock to Stardust because the company pledges that its upcoming update will prevent it from handing over sensitive health information to the government.
However, TechCrunch discovers that the current version of the booming app shares user phone numbers with a third-party analytics company called Mixpanel. When users log in with their phone number instead of Apple or Google, Stardust periodically sends that identifier to Mixpanel, along with device details like the iPhone model, software version, and cellular carrier.
Although the network traffic analysis reveals that no actual health data goes to the analytics firm, sharing a direct identifier like a phone number creates a major vulnerability. This practice allows prosecutors to potentially compel Mixpanel to turn over the data, which exposes individual users of the period-tracking app exactly when they seek privacy the most.