“Your data is private. Period,” period tracker Stardust says on its website. As new research from Mozilla found, some users may find that claim overstated.

According to Mozilla’s latest findings examining the privacy practices of period tracking apps, Stardust was found to be sharing users’ sensitive health information with third-party analytics company RudderStack. This data included the user’s date of birth, type of birth control, reproductive goals, and specific symptoms the user was experiencing, and linked that record to a unique identifier instead of the person’s name. (The FTC has long cautioned that this does not make the data anonymous or prevent it from being linked to a person.)

Mozilla’s research highlights the security and privacy risks that come with using period tracking and other health apps that share data with third parties. This often happens as background activity within the app and is not visible to the user. It’s not uncommon for apps to share data with other services for storage, analytics, and payments, but sharing user information with third parties inherently carries risks, such as potential security breaches, data breaches, or the data being sought by authorities.

TechCrunch previously wrote about Stardust in 2022 after the app surged in downloads following the repeal of the constitutional right to request an abortion in the United States. Stardust claimed that it was end-to-end encrypted, meaning that not even the company could access its users’ data, but TechCrunch discovered, by analyzing the app’s network traffic, that the company’s claim was false.

Mozilla security researcher Shoshana Wodinsky used a similar technique to analyze network traffic from several vintage trackers, including Stardust, to understand how the apps collected and shared data (if at all) with third parties. Wodinsky found that Stardust was the only app of the six tested that shared sensitive user health data with another company.

As quoted by BBC News, a Stardust spokesperson said RudderStack is “contractually prohibited from selling it or using it for its own purposes.” As US-based companies, both Stardust and RudderStack may still receive demands for user information from law enforcement about users’ health information stored on their servers.

Stardust founder Rachel Moranis did not respond to TechCrunch’s request for comment on Thursday, or to questions about whether the company has received lawsuits over its users’ data. A spokesperson acknowledged receipt of an email but had no comment.

Of the six apps tested by Wodinsky, Mozilla recommended Euki as “absolutely clean,” as the app was not seen to share any data with third parties with its core functions, and the user’s health data did not leave their device.