What do you do when the app you trust to track your most intimate health details turns out to be sharing them with advertisers? A new Mozilla privacy investigation has found that some of the world's most popular period-tracking apps are quietly exposing sensitive reproductive-health data to analytics and advertising systems, with one app scoring a perfect privacy rating and another ranking last due to extensive third-party data sharing.
The investigation, which combined hands-on testing with network traffic analysis of six apps—Euki, Clue, Flo, Period Calendar, Planned Parenthood's Spot On, and Stardust—revealed stark differences in how these services handle the deeply personal information users entrust to them. Euki emerged as the clear winner with a perfect score of 10 out of 10, while Stardust languished at the bottom with a dismal 2 out of 10.
The findings come at a critical time. In the post-Dobbs legal landscape, reproductive-health data carries unprecedented legal and privacy risks. Yet millions of women continue to log their menstrual cycles, pregnancy status, fertility goals, contraceptive use, miscarriages, sexual activity, pain levels, cravings, and emotional changes into apps that may not be as private as they claim.
The perfect privacy app
Euki, an open-source tracker managed by the Euki nonprofit, earned Mozilla's highest rating for a refreshingly simple reason: it keeps your data on your phone. The app requires no account, stores cycle data locally, and avoids requesting unnecessary device permissions such as location or contacts. Additional features like PIN protection, automatic data deletion, and a decoy screen for forced-unlock situations make it a standout choice for privacy-conscious users.
The only caveat is that locally stored data cannot be recovered if the device is lost or the PIN is forgotten. Researchers also found that educational resources opened through Euki's in-app browser could load external analytics and advertising services, though the browser assigns a fresh identifier for each visit to reduce long-term tracking.
The data-hungry giants
Germany-based Clue earned the second-highest score of 8 out of 10, praised for its granular privacy controls that separate consent for research, analytics, recommendations, and advertising. Flo, with 81 million monthly active users, scored 7 out of 10 but continues to face scrutiny over its history of privacy controversies, including a $8 million settlement in 2025.
The worst offender
Stardust, the astrology-themed tracker popular with younger users, ranked last with a score of 2 out of 10. Mozilla observed third-party tracking beginning immediately after launch, with data relating to birth dates, birth control methods, reproductive goals, and symptoms being transmitted through external services. Detailed health information was sent to the analytics platform RudderStack, along with persistent user identifiers that could link activity inside Stardust to existing user profiles.
What this means for you
The investigation concludes that period-tracking apps vary widely in how they collect, retain, and share reproductive-health data. While several apps avoided transmitting sensitive health records to advertisers, device identifiers, analytics services, and in-app web browsers can still expose information users may reasonably expect to remain private.
Mozilla's advice is simple: your period is private. Make sure your app agrees.
