<!-- TRUSTEDVERDICTHEADER -->

Did not meet TRUSTED criteria

The app was assessed and did not meet all of the criteria for the TRUSTED mark. The specific items are listed below so the result can be weighed before installing.

Trust Pillars

• Secure by Design: Strong. Strong result in this area.
• Data Respect: Not met. Did not meet one criterion in this area.
• Honest Experience: Not met. Did not meet one criterion in this area.
• User Control: Strong. Strong result in this area.
• Child-Safe: Not applicable. Does not apply to this app.

---

<!-- /TRUSTEDVERDICTHEADER -->

Security & Privacy Scorecard

Gentler Activity

What This Means for You

Workout, heart rate, and health metrics stay on the device, but the app shares device identity with Adjust, an advertising attribution network, without first presenting the iOS tracking permission prompt.

Recommendation: Solid

Gentler Activity keeps sensitive health data on the device and uses strong encryption for all network communications. The primary concern is that Adjust receives device identity for advertising attribution without the standard iOS user consent mechanism. Four third-party services receive some form of data from the app.

Best For: People who track workouts, heart rate variability, and health metrics and want their fitness data kept on their own device.

Key Findings

Data Security: 0 findings

Network Security: 0 findings

Code Safety: 0 findings

Privacy: 0 findings

Privacy Concerns

What Leaves the Device

• Device identity: shared with Adjust for advertising attribution
• Behavioral and usage analytics: sent to Mixpanel for product analytics
• Crash reports and session data: sent to Sentry for error monitoring. The session replay feature is compiled into the app and may record touch interactions during use.
• Subscription and purchase status: sent to RevenueCat for subscription management

What Stays on the Device

• Health data (workouts, heart rate variability, power metrics, sleep, and other health indicators): accessed from the device's health database and processed locally. This data stays on the device and is not transmitted to third parties.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Adjust - advertising attribution and device identity tracking
• Mixpanel - product analytics and usage tracking
• RevenueCat - subscription and purchase management
• Sentry - crash reporting and session monitoring

Understanding the Scores

Security: 90/100
Privacy: 72/100

Security Breakdown

• Data Security: 87/100. Health and fitness metrics processed by the app remain on the device with no evidence of off-device transmission of the health data itself. Local storage does not apply an additional app-layer encryption beyond iOS defaults.
• Network Security: 100/100. All external communications use HTTPS and network traffic is fully encrypted in transit.
• Code Safety: 95/100. Modern, well-regarded cryptographic methods are used throughout the app, and the in-app browser integration does not expose a JavaScript bridge to native app capabilities.

Privacy Breakdown

• Data Collection: 78/100. Health and fitness data is accessed on the device and kept local. Device identity is shared with an advertising attribution service.
• Data Sharing: 79/100. Four third-party services may receive data, primarily for analytics, attribution, crash reporting, and subscription management.
• User Control: 73/100. The app does not request the iOS App Tracking Transparency permission before sharing device identity with Adjust, limiting users from opting out through the standard iOS mechanism.

Positive Security Features

• Modern cryptographic methods (ChaCha20-Poly1305, Ed25519) used for cryptographic operations throughout the app
• In-app browser integration does not expose a JavaScript bridge, preventing web content from accessing native app capabilities
• Facebook SDK is not integrated despite the advertising attribution library probing for it at runtime
• All external API communications use HTTPS

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. App Tracking Transparency Consent
   The app uses Adjust to track device identity for advertising attribution. Apps that link device identity to advertising or attribution across apps and websites are expected to request the iOS App Tracking Transparency permission before doing so, giving users the choice to opt out.

2. App Privacy Manifest
   Adding an app privacy manifest (PrivacyInfo.xcprivacy) could make the App Store privacy label more complete by declaring the data types the app accesses and the third-party SDKs it includes.

Security Enhancements

1. Explicit Data Protection for Local Health Storage
   Applying explicit iOS data protection entitlements to the local health data store would add protection for these files when the device is accessed in a locked state.

Technical Context

App Type: iOS fitness and health tracker
Classes Analyzed: 0
Third-Party Services: 5
Context Tags: health, sensitive_data, ads

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Not available
Version: 5.12.8 (build 665)
Analysis Date: 2026-07-28
Package: app.gentler.activity

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS version 5.12.8 (build 665) analyzed on 2026-07-28
• May not reflect server-side security controls
• Cannot detect all runtime behaviors