Skip to content
Menu

Can I trust Gentler Streak Workout Tracker?

TRUSTED 92 iOS Version 5.12.9 (Build 668) Store version released: Last checked: Gentler Stories LLC app.gentler.activity Scanned

This app cleared every trust check that applied to it, with no red flags.

Best for
People who keep workout and activity data on their own
What it means for you
Health and workout metrics stay on the device and are not sent to any third-party service. The app includes code to send app usage and session data to Mixpanel for analytics and to Adjust for attribution. Advertising identifier access requires explicit user consent before it can be activated.
Main concern
HealthKit cache in CoreData lacks file protection, exposing health data in unencrypted backups
The developer's description
Gentler is a fitness and health tracking app that uses HealthKit data to monitor workouts, heart rate variability (HRV), sleep patterns, and other health metrics for personalized fitness insights.
Third-party services
5

How the score and the label work

Open on the App StoreOpens the app's listing on the App Store in a new tab.

Full findings

Open this scan in your dashboard

The account that ran this scan sees every finding and the Rescan button there.

Trust checks

  • Secure by Design

    Strong

    Strong security foundation

    Why this result

    This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.

  • Data Minimization

    Strong

    Tracking done right

    Why this result

    The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.

    The advertising identifier (IDFA) is properly gated behind Apple's App Tracking Transparency consent prompt. The attribution SDK evaluates the user's tracking permission before accessing the IDFA, and the app presents the ATT consent dialog before any advertising identifier is used. Eight consent-specific domains are declared in the app's configuration to handle regional consent requirements. Product analytics (usage events and screen names) does not involve cross-app advertising tracking and the analytics provider's own privacy manifest confirms it does not engage in cross-app tracking. No pre-consent advertising data collection was found.

  • Manifest Mismatch

    Strong

    Everything visible

    Why this result

    The check compares the app's privacy disclosures against what the code does: the data categories collected, the companies named in code as their recipients, and the identifiers attached to each. The comparison covers the store listing, the in-app privacy text and any privacy manifest shipped in the build. Every claim compared matched the code here.

    The app's privacy manifest correctly declares all system APIs it uses, with valid reason codes for each. The attribution SDK's privacy manifest accurately marks it as cross-app tracking and lists the appropriate consent domains. The analytics SDK's manifest correctly states it does not perform cross-app tracking. No gap was found between what the privacy manifest declarations claim and what the code actually does. All third-party SDKs present in the binary are the same categories documented in the manifest.

  • User Control

    Strong

    No lock-in

    Why this result

    The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.

    The app's health and workout data is stored on the device and in Apple's HealthKit, which the user owns and can export through the Apple Health app in standard formats. No health metric values are stored in a proprietary server-side database that would require the developer's cooperation to export. Since the data lives on the device and in the user's own Apple ecosystem, deleting the app removes the local cache and there is no server-side archive to be trapped in.

  • Truly Local

    Strong

    Stays on the device

    Why this result

    This app presents itself as working offline or on the device alone. The check looks for any code written to send personal data to a server, including analytics, crash reporting and advertising code. None was recorded in this build.

    Health metric values — including heart rate variability, blood oxygen, wrist temperature, and menstrual cycle data — are confirmed to stay on the device. The build includes code to pass screen names and interaction labels like 'health metric: HRV screen viewed' to the analytics SDK, not the actual numeric health readings. The build includes code to pass device identifiers for install tracking to the attribution SDK, not health data. The build includes code to pass stack traces and performance metrics to the crash reporting SDK. No code path was found that would transmit actual health measurements to any third-party server.

Strengths

  • Health and workout metric values stay on the device: the build contains no code to transmit numeric HealthKit data to any third-party SDK
  • All network traffic uses HTTPS with no App Transport Security exceptions configured
  • IDFA access is gated behind an ATT consent prompt before any advertising identifier is accessed
  • External URLs are opened in a fully sandboxed SFSafariViewController with no app-controlled JavaScript execution
  • Deep link scheme validates all incoming destinations against a hardcoded allowlist, silently rejecting unknown routes
  • Privacy manifest correctly declares all Required Reason API categories with valid reason codes, consistent with actual SDK behavior

What the app contains

  • 5 services

    Third-party services the scan names in the build:

    • Mixpanel
    • Adjust (AdjustSigSdk)
    • RevenueCat
    • Sentry
    • Lottie

Changes since the previous scan

  • Version 5.12.9 (Build 668), score 92.
  • Score 88 before, 92 after.
  • Score change since version 5.12.9 (Build 668): +4 points.
  • Since the previous scan: 7 findings added, 10 removed.
  • Version 5.12.9 (Build 668), score 88.
  • Score 77 before, 88 after.
  • Version 5.12.8 (build 665) before, 5.12.9 (Build 668) after.
  • Version 5.12.8 (build 665), score 77.
  • Score 86 before, 77 after.
  • Version 5.12.8 (Build 665) before, 5.12.8 (build 665) after.
  • Version 5.12.8 (Build 665), score 86.
  • Score 76 before, 86 after.
  • Version 5.12.8 (Build 665), score 76.
  • Score 89 before, 76 after.
  • Version 5.12.8 (build 665) before, 5.12.8 (Build 665) after.
  • Version 5.12.8 (build 665), score 89.
  • Score 70 before, 89 after.
  • Version 5.12.8 (Build 665) before, 5.12.8 (build 665) after.
  • Version 5.12.8 (Build 665), score 70.
  • Score 83 before, 70 after.
  • Version 5.12.8 (Build 665), score 83.
  • Score 77 before, 83 after.
  • Version 5.12.8 (build 665) before, 5.12.8 (Build 665) after.
  • Version 5.12.8 (build 665), score 77.
  • Score 73 before, 77 after.
  • Version 5.12.8 (Build 665) before, 5.12.8 (build 665) after.
  • Version 5.12.8 (Build 665), score 73.
  • Score 65 before, 73 after.
  • Version 5.12.8 (Build 665), score 65.
  • Score 77 before, 65 after.
  • Version 5.12.8 (build 665) before, 5.12.8 (Build 665) after.
  • Version 5.12.8 (build 665), score 77.
  • Score 76 before, 77 after.
  • Version 5.12.8 (Build 665) before, 5.12.8 (build 665) after.
  • Version 5.12.8 (Build 665), score 76.
  • Score 89 before, 76 after.
  • Version 5.12.8 (Build 665), score 89.
  • Score 87 before, 89 after.
  • Version 5.12.6 (Build 656) before, 5.12.8 (Build 665) after.
  • Version 5.12.6 (Build 656), score 87.
  • Score 92 before, 87 after.
  • Version 5.12.6 (build 656) before, 5.12.6 (Build 656) after.
  • Version 5.12.6 (build 656), score 92.
  • Score 86 before, 92 after.
  • Version 5.12.4 (Build 653) before, 5.12.6 (build 656) after.
  • Version 5.12.4 (Build 653), score 86.
  • Version 5.12 (Build 626) before, 5.12.4 (Build 653) after.
  • Version 5.12 (Build 626), score 86.
  • First public scan of this app.

Method and limits

Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.

Files decompiled
86,934
Scan date
29 July 2026

Corrections

No correction is published for this app.

Developer response

No response is published for this app.

Report an error Opens an email to [email protected] that names this app and this scan.

On this page