Scan results

Recommendation: Very Secure

A highly secure fitness tracking app with on-device health metrics and HTTPS enforcement throughout. Analytics SDKs are properly gated, external browsing is sandboxed, and HealthKit data never leaves the device. Gentler Activity reflects strong security discipline across its core data flows.

Key Findings

Data Security: 0 findings

Network Security: 0 findings

Code Safety: 0 findings

Privacy: 0 findings

Privacy Concerns

What Leaves the Device

• Behavioral and product analytics: may be sent to Mixpanel for usage insights
• Attribution data: may be sent to Adjust for marketing attribution (advertising identifier access requires ATT consent before any data is sent)
• Crash reports and session diagnostics: may be sent to Sentry for error monitoring
• Subscription and purchase status: shared with RevenueCat to manage in-app subscriptions

What Stays on the Device

• Health and workout metrics (workouts, heart rate, HRV, sleep patterns): accessed from Apple Health and kept on the device. Numeric HealthKit values are not transmitted to any third-party service, keeping this data entirely within the user's control.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Mixpanel - behavioral and product analytics
• Adjust - marketing attribution (gated behind ATT consent prompt)
• RevenueCat - subscription and purchase management
• Sentry - crash reporting and error monitoring
• Lottie - animation rendering library (no data collection role)

Understanding the Scores

Security: 97/100
Privacy: 90/100

Security Breakdown

• Data Security: 87/100. Sensitive health metrics from Apple Health stay on the device. Local data caching is handled through CoreData, and adding explicit file protection to those stores would further guard app data in backup scenarios.
• Network Security: 100/100. Every connection uses HTTPS with no exceptions configured. All network traffic is protected by encrypted transport across every endpoint.
• Code Safety: 100/100. External URLs open in a fully sandboxed browser with no app-controlled scripting. Incoming navigation destinations are validated against a hardcoded allowlist, preventing unauthorized routing.

Privacy Breakdown

• Data Collection: 88/100. Fitness and health metrics from Apple Health are accessed and kept on the device. Analytics SDKs may capture behavioral signals such as feature usage patterns, but numeric health values are not among the data shared.
• Data Sharing: 88/100. HealthKit data does not leave the device. Attribution tracking through Adjust is gated behind the ATT consent prompt, ensuring the advertising identifier is not accessed until the user explicitly permits it.
• User Control: 90/100. The ATT consent framework is correctly implemented, giving users meaningful control over whether advertising-related tracking occurs. The advertising identifier is not accessed until consent is granted.

Positive Security Features

• Workout data and health metrics accessed from Apple Health stay on the device and are not transmitted to any third-party SDK
• All network traffic uses HTTPS with no App Transport Security exceptions configured
• Advertising identifier access is gated behind an ATT consent prompt before any attribution tracking occurs
• External URLs open in a fully sandboxed browser with no app-controlled JavaScript execution
• Incoming navigation destinations are validated against a hardcoded allowlist, silently rejecting unknown routes
• Privacy manifest correctly declares all Required Reason API categories with valid reason codes, consistent with actual SDK behavior

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. File Protection for Cached Health Data
   CoreData stores that hold HealthKit-derived data could be configured with explicit file protection settings, ensuring app data is excluded from unencrypted device backups.

Security Enhancements

1. Remove Development Diagnostics from Release Builds
   A Sentry development transport component is compiled into the release build. Removing development-only diagnostic tooling from production builds is recommended practice for minimizing the app's exposed surface.

2. Scope Review for Error-Reporting Ingest Key
   The Sentry ingest key is embedded in the binary, which is standard practice for client-side error reporting. Confirming that the key's permissions are scoped to error ingestion only is a good operational hygiene step.

3. Review Session Replay Configuration
   A Sentry session replay capability is compiled into the build but does not appear to be active. Confirming it remains disabled or removing it from the build would eliminate any future risk of session capture being inadvertently enabled.

Technical Context

App Type: Health and fitness tracking (high data sensitivity)
Classes Analyzed: 86,934
Third-Party Services: 5 (Mixpanel, Adjust, RevenueCat, Sentry, Lottie)
Context Tags: health, fitness, healthkit, analytics, tracking, attribution

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Not available
Version: 5.12.9 (Build 668)
Analysis Date: 2026-07-29
Package: app.gentler.activity

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS version 5.12.9 (Build 668) analyzed on 2026-07-29
• May not reflect server-side security controls
• Cannot detect all runtime behaviors