Stardust

Strengths

• **Is the privacy policy easy to find?** Yes. Links to both policies appear in the website footer, the app's “Your Data” section, and app store descriptions.
• **Is it written in plain, understandable language?** Yes. Formal in places, but generally direct and uses bullet points to categorize data types.
• **Does it specifically name what data types are collected?** Yes. Lists clear categories: Identifiers, Health Data, Financial Information, Transactional Information, and Internet Activity Information.
• **Are purposes stated for each type of data collected?** Yes, at the category level. The “Use of Information” section maps data to purposes (service delivery, communication, marketing/advertising, R&D, legal protection). Note: purposes are stated per category, not mapped to each individual field.
• **Does the product state that it uses encryption?** Yes, Stardust describes generating a unique encryption key locally on the user's phone, storing health data against a random account ID, and using a third-party auth provider (Rownd) to hold contact info (email, phone, login) separately from health data, intended to prevent linking reproductive health details to a real-world identity. A genuinely better-than-average design in principle, though it is a company claim that can't be independently verified, and the Mixpanel incident below shows the wall has leaked in practice.
• **Can users request deletion of their data?** Yes. Users can delete data in-app via a “delete” button in their profile, or by emailing support. WA/NV residents also get an appeal path to the state Attorney General.
• **Can users withdraw consent after granting it?** Yes, with unspecified exceptions.
• Users may withdraw consent to health-data processing at any time “subject to certain exceptions,” which the policy does not enumerate.
• **Are there granular privacy controls?** Partial. Cookie controls (web banner; advertising vs. analytics) and device-level tracking settings are separable, and third-party integrations are opt-in per connection. But there's no granular control over the core health data processing that's bundled with using the app.

Weaknesses

• **Overstated encryption claims (E2E walk-back).** After Roe v. Wade was overturned, Stardust marketed end-to-end encryption. Experts and reporters disputed whether AWS built-in encryption plus SSL/TLS qualifies as true E2E (where only the user holds the decryption key), and Stardust reportedly scrubbed the E2E language from its site and policy after media inquiries. For the record, the underlying claim is SSL/TLS in transit and AES-256 at rest on AWS — standard, but not what “E2E” implies. Sources: Gizmodo, ScreenRant.
• **Have there been any documented data breaches or security incidents?** Yes, unencrypted phone numbers. No “hack,” but an investigation found the app periodically sharing unencrypted phone numbers with analytics company Mixpanel — directly contradicting the “privacy-first” marketing and the identity-separation design above. Stardust stated these mechanisms were removed in later versions (a company statement, not independently confirmed). Sources: ScreenRant, Gizmodo, Candid, TechCrunch.
• **Is there any public controversy about this product's data handling?** Yes. Post-Roe, Stardust faced backlash for a clause saying it would share data with law enforcement “whether or not legally required.” The phrase was removed after public outcry — but note that was removed under pressure, not a clean resolution: the current policy still contains broad disclosure-to-legal-authorities language. Sources: Candid, Vice.
• **Is data sharing limited to named, specific partners?** No. Stardust names some entities (AppsFlyer, Firebase, Apple HealthKit, Rownd), but Privacy International found third parties not named in the policy — Mixpanel, OneSignal, RevenueCat, Cloudflare. (Mixpanel appears twice in this review: unnamed here, and the recipient of the unencrypted phone numbers above.)
• **Does the company hold relevant security certifications?** No. No mention of SOC 2 or ISO 27001. For a consumer health app, SOC 2 Type II is the baseline expectation; its absence is a gap. (Note: HIPAA generally does not apply to a direct-to-consumer tracker, so its absence is not itself a red flag.)

What We Couldn't Find

• **Collects only data necessary for its purpose?**  Unclear — leans no. Health data collected is typical for the category, but the app also auto-collects technical data — device motion parameters, CPU/battery info, time zone, advertising identifiers — and shares Internet Activity Information with ad networks (AppsFlyer, Firebase, Meta AEM, Google ODM). That's collection for growth/advertising, beyond what period tracking strictly requires.
• **Explicit opt-in consent before collecting health data? ** Unclear. The policy treats health data you type in as consent-by-entry and reserves explicit-consent language for “other purposes.” A discrete opt-in step isn't described for users outside GDPR / WA / NV regimes. Would need to check the actual onboarding flow to confirm.
• **Can users opt out of third-party data sharing?**  Unclear. Users can opt out of direct marketing and restrict some device data via phone settings, but the unnamed third parties make the true scope of opt-out impossible to confirm from the policy alone.
• **Is only de-identified / aggregated data shared? ** Unclear — contradicted in practice. Stardust claims health data is stored against a random ID and not linked to identity. But the Mixpanel phone-number leak shows identifiable data did escape, which could enable re-identification. The claim and the evidence don't fully agree.
• **Can users export or download their data?**  Unclear — access ≠ export. The policy grants an access right, not a portability/export right (even GDPR's Article 20 export isn't spelled out). Onboarding lets users migrate in from other trackers, and Privacy International observed cycle data hitting Stardust's API — but that's an inference about technical accessibility, not a stated user-facing export feature.

Strengths

• **Medical professionals involved in product development? ** Yes — advisory/content role. Stardust lists several experts who “inform the knowledge and wisdom” behind the app, including Dr. Rachel Pope (OBGYN) and Lindsay Mayo (Midwife). Note the wording is advisory/content, not evidence they shape the prediction algorithm or run clinical validation — see “research partnerships” below.
• **Independent expert or media reviews exist?** Yes — mixed in kind. Numerous independent reviews exist (Healthcare Brew, Gizmodo, ELLE, Privacy International, plus tech/wellness blogs). Worth distinguishing: outlets like ELLE and wellness blogs are lifestyle coverage, while Gizmodo and Privacy International are scrutiny. The substantive technical reviews were critical.
• **Clear disclaimers about limitations? ** Yes. Standard disclaimer that the service is for “informational purposes only” and is not a substitute for professional medical advice, diagnosis, or treatment.
• **Distinguishes clinical vs. wellness features?** Yes. The app leans heavily into wellness/entertainment language — “lunar lore,” “moon magic,” “astrological compatibility” — and identifies as a blend of “science, ancient wisdom, astronomy, and AI” rather than a clinical medical tool.
• **FDA clearance or approval (with clearance number)?** No — and appropriately so. Stardust is not an FDA-cleared medical device, and for a cycle-tracking / general-wellness app that is the correct posture — the FDA does not regulate low-risk wellness trackers. Clearance is only required if an app claims contraceptive efficacy (as Natural Cycles did). Stardust explicitly disclaims use as “birth control/contraception,” which keeps it on the unregulated side of that line. Read this “No” differently from “no SOC 2”: this is a thing they correctly don't need, not a missing safeguard.

Weaknesses

• **Registered with other regulators (CE mark, TGA, etc.)? ** No. There are no mentions of CE mark, TGA, or other international device registration in the provided materials — consistent with positioning outside the regulated-device category.
• **Peer-reviewed studies supporting its claims? ** No. The “Stardust Labs” section summarizes menstrual research and conditions like PCOS, but no cited peer-reviewed studies validate Stardust's own algorithms or efficacy.
• **Accuracy/efficacy numbers publicly stated?** No. Stardust markets “accurate predictions,” and one review claims 99% accuracy for period start dates — but that figure comes from a third-party review, not the company, which actually supports the “No”: Stardust publishes no official efficacy numbers. A “99%” claim with no stated methodology is a number to distrust, not to rely on.
• **Named partnerships with hospitals / academic institutions?** No. The policy references partners and research institutions in general terms, but identifies no specific named hospital or academic partnership.
• **Independent reviews positive about accuracy/reliability?** Mixed. Media reviews praise the “whimsical,” “magic-meets-science” approach, but technical reviews and user feedback flag performance glitches, lag, and prediction inaccuracies — particularly for users with irregular cycles.

What We Couldn't Find

• **Research partnerships (not just marketing endorsements)? ** Unclear. The company uses medical experts for content/knowledge, but the materials don't show those experts or any institution engaged in active clinical research using the app's data. Same gap flagged under “medical professionals” above.
• **Marketing language truthful / not overpromising?** Mixed — documented overpromising on privacy. Splits in two. On privacy, this is closer to settled than “unclear”: the end-to-end-encryption claims were walked back and the Mixpanel leak contradicted “privacy-first” — documented marketing outrunning reality. On accuracy, it's genuinely unclear: “accurate predictions” paired with a buried “not for contraception” leans toward a use case that would invite regulatory scrutiny if pushed, but isn't clearly false. The app is consistently clear it's not contraception.

Strengths

• **Leadership information publicly available and verifiable?** Yes. Detailed profiles of leadership and key team members are available on the company website and on financial platforms such as PitchBook and Tracxn.
• **Specific, actionable women's-health mission? ** Yes. Stardust aims to help users “unlock full body literacy” by connecting hormonal cycles with lunar phases, positioning itself against what it calls “clinical, pink-washed, male-made” tracking apps.
• **Mission reflected in actual product decisions?** Yes. The “magic-meets-science” interface, lunar calendar integration, and “Partner Mode” (built because it was the community's most-requested feature) directly reflect the stated vision.
• **Named advisory board / clinical consultants? ** Yes. Stardust lists an expert group including Dr. Rachel Pope (OBGYN), Lindsay Mayo (Midwife), and several wellness coaches (hormone, sexual-wellness, and cycle-syncing experts).
• **Advisors have relevant women's-health credentials?** Yes. A mix of clinical professionals (OBGYN, midwife) alongside holistic practitioners (herbalist, cycle-syncing expert).

Weaknesses

• **Leaders have relevant healthcare / health-tech experience?** Mixed. CEO Rachel Moranis has experience across hospitality and media (Rosedale Hospitality Partners, Briefly). Key team member Jeremy Fisher has a tech background (Yahoo, Wander). Industry-adjacent, but not health-specific.
• **Marketing respectful and educational?** Mixed. Many users praise the educational insights and whimsical tone, but some criticize the in-app language as “infantilizing” or “cringe” (e.g., “sensititties,” “hump a pillow”).
• **Founders/key leaders have direct women's-health or clinical expertise?** No. Founders Rachel Moranis (CEO) and Molly Young come from architecture/design and book criticism, respectively. The app is “women-built,” but the founders hold no medical or clinical degrees. (Note: clinical credentials sit on the advisory board — Dr. Pope, the OBGYN — not with the founders.)
• **Marketing aligns with stated mission and values? ** Mixed. The brand identity — “privacy-first” tracking plus a connection to ancient wisdom — is consistent and clearly expressed. What pulls this to Mixed rather than Yes is that the “privacy-first” pillar collided with reality: the E2E walk-back and the Mixpanel phone-number leak meant the marketing outran the practice on the value the brand foregrounds most.
• **Marketing free of exploitative or misleading tactics? ** Mixed — documented privacy overpromise. Not “unclear” — there's a documented instance: the “privacy-first” claims were complicated by the discovery that the app shared unencrypted phone numbers with Mixpanel, so its security promises were overstated relative to practice. This is the same finding flagged under Privacy and Accuracy; consistent across all three.
• **Public advocacy or education on women's health?** Mixed. Stardust engages in public discourse on reproductive-data privacy and provides educational content via its “Cycle 101” section and social channels — genuine, though intertwined with brand marketing.

What We Couldn't Find

• **Advisors have active, ongoing roles (not just names on a page)? ** Unclear. The company says it “co-creates Stardust alongside a group of experts” who inform the app's content — but there's no evidence of the depth or cadence of that involvement. Same advisory vs. development gap noted in the Accuracy section.

Strengths

• **Available in multiple languages? ** Yes, it's available in English, Portuguese, and Spanish.
• **Usable across varying tech literacy? ** Yes — with a caveat. Reviews describe it as simple, easy-to-use, and intuitive. Performance issues (lag, freezing) noted by some users may affect usability.
• **Language inclusive of LGBTQ+ and gender-diverse users? ** Yes — a genuine strength. Active, concrete steps: removed gendered terms like “wild woman” after non-binary community feedback, and is recognized as a trans-inclusive tracking option.
• **Free tier with meaningful functionality? ** Yes. Free to download with meaningful core features — cycle/symptom tracking, predictions, and Partner Mode — without a paid subscription.
• **Paid tier reasonably priced? ** Yes. Roughly $3.99/month or $24.99/year — described by some users as not overpriced for the value.
• **Engages with feedback from diverse communities?** Yes. Acted on gender-diverse users' feedback to improve inclusivity, and troubleshoots technical issues raised in reviews.
• **Diverse racial/ethnic representation in marketing imagery? ** Yes. Marketing imagery features racially and ethnically diverse models.

Weaknesses

• **Meets basic accessibility standards (screen reader, contrast)? ** No — website. An accessScan on June 5, 2026 found the website WCAG non-compliant, with serious accessibility issues. Two caveats for precision: the scan tested the website, not the iOS/Android app where the product actually lives, and automated scans catch much but not everything. Still, for an app whose mission is inclusivity, a site that locks out users with disabilities directly contradicts the stated values — the sharpest mission-vs-practice gap in this section.
• **Financial assistance, sliding scale, or insurance coverage? ** No. None mentioned. However, they do offer a referral program that offers a free year of premium for recruiting friends.
• **Outreach to underserved or marginalized communities?** No. No specific outreach programs aimed at underserved or marginalized communities were identified.
• **Representation of diverse body sizes, ages, abilities? ** Mixed. Used across a range of ages (teens to 30s) and supports conditions like PMDD and PCOS, but some users criticize a lack of representation for “non-normative” bodies and cycles (e.g., fibroids, cysts).
• **Accommodates different bodies, cycles, or conditions? ** Mixed
• Accommodates PMDD, PCOS, and endometriosis and includes a Pregnancy Mode — but users with irregular or short cycles report inconsistent or less accurate predictions.
• **Partners with community health organizations?** No named partnerships. Stardust says 2% of proceeds go to organizations supporting women — unverifiable charitable giving rather than a named partnership.

What We Couldn't Find

• **Tested with diverse user groups? ** Unclear. Over 1M downloads and a Community section, but no explicit evidence of formal diverse-user testing during development.