Mozilla Foundation’s testing of six popular apps found that using a period tracker can feed advertisers, that in-app browsers can expose sensitive data, and that at least one app misrepresented its security — while a single nonprofit-run app kept nearly all user data on the device itself.

Mozilla Foundation’s privacy research initiative, “Nothing Personal”, published a hands-on privacy review on July 16, 2026, of six widely used period and ovulation tracking apps: Euki, Clue, Flo, Period Calendar, Planned Parenthood’s Spot On, and Stardust. The investigation, conducted by privacy researcher Shoshana Wodinsky in partnership with Harvard’s Berkman Klein Center’s Transparency Hub and the University of Illinois’s Siebel School of Computing and Data Science, scored each app out of 10 based on how it handles users’ reproductive health data.

The results varied sharply. Euki, an open-source, nonprofit-run tracker, earned a perfect 10/10 because it stores data locally on a user’s phone rather than transmitting it elsewhere. Clue followed at 8/10, Flo at 7/10, the ad-supported Period Calendar at 6/10, Planned Parenthood’s Spot On at 5/10, and the astrology-themed app Stardust trailed the field at 2/10.

Among the report’s central findings: simply having a period-tracking app installed is not privacy-neutral. Researchers found that when an app signals to advertisers that a person uses a period tracker, that identifier can be absorbed into a broader ad profile, meaning a user’s reproductive health status can factor into the ads that follow them across the internet.

The investigation also flagged in-app browsers as a weak point. Even when an app’s core tracking features are locked down, opening a web page inside the app’s built-in browser can expose users to third-party trackers that operate outside those protections.

Researchers additionally found instances of “privacy-washing.” Stardust had previously marketed itself as offering “encrypted” protection in the aftermath of the Dobbs decision overturning Roe v. Wade, language that implied end-to-end encryption. Reporters later determined the app used only standard encryption, and the company quietly dropped the claim.

Mozilla’s researchers argue the burden of protecting this data currently falls disproportionately on users themselves, given inconsistent design choices across the industry. Mozilla recommends Euki as the strongest privacy choice among the apps it tested.