Can I trust The Outsiders Fitness Tracker?
This app did not meet one of the trust checks that applied to it, with no red flags.
- What it means for you
- Yes on the security of the code, with what the build includes code to send worth reading first. The build includes code to send financial data to RevenueCat, and advertising identifiers to RevenueCat. None of the findings recorded rises to the level of putting a user at risk.
- Findings rated low or higher
- 20
Open on the App StoreOpens the app's listing on the App Store in a new tab.
Full findings
Open this scan in your dashboardThe account that ran this scan sees every finding and the Rescan button there.
Trust checks
Secure by Design
StrongStrong security foundation
Why this result
This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.
Every connection the app makes is encrypted, and its transport settings carry no exception that would allow an unencrypted one. No passwords, private keys or service credentials are stored in the app, and there is no code that disables certificate checking, no database or file-path injection weakness, and no risky bridge between web content and app code. Sign-in to the Garmin service is handled by Apple's own secure web authentication component rather than by a hand-rolled flow. The app also offers itself as a viewer for Garmin workout files opened from other apps, which is a normal capability for a training app, and the strongest security signal in the build is a note about that surface rather than any working attack.
Data Minimization
StrongTracking done right
Why this result
The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.
No analytics service, advertising network or marketing tracker is built into the app, so there is no stream of behaviour data waiting on a consent decision. The app does not read the device advertising identifier and ships no cross-app tracking prompt because it does no cross-app tracking. The one value that leaves at launch is the Apple install attribution number the subscription provider uses to tell where a purchase originated, which is tied to the purchase rather than to an advertising profile. Where the app does ask for something personal, an email address, it asks explicitly, links the privacy policy at the point of asking, and offers a Remove My Email control afterwards.
Manifest Mismatch
One criterion not metDisclosure incomplete or contradicted
Why this result
The check compares the app's privacy disclosures against what the code does, and at least one claim did not match in this build. Mismatches of this kind include a data category collected but not disclosed, a recipient the disclosure omits, and an identifier attached to data the disclosure describes as anonymous.
User Control
StrongNo lock-in
Why this result
The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.
There is nothing to be trapped in. The app keeps no account on the developer's side, and the training and health data it produces is written into Apple Health, the system store any other fitness app on the device can read, in standard formats rather than a private one. Uninstalling the app takes its copy of the data with it, and what remains is in Apple Health and the user's own iCloud, both under the user's control. The Garmin connection has its own disconnect control, the subscription is billed through Apple with a direct link to the system subscription settings for cancelling, and a stored email address can be removed from within the app.
Truly Local
StrongStays on the device
Why this result
This app presents itself as working offline or on the device alone. The check looks for any code written to send personal data to a server, including analytics, crash reporting and advertising code. None was recorded in this build.
The app presents itself as running on the device without accounts or servers, and the health side of it holds to that. Heart rate, heart rate variability, breathing rate, blood oxygen, wrist temperature, sleep and readiness are read from Apple Health, calculated on the device, and written into a private storage area that the build configures for access only by the app's own widget and watch complications. Nothing carries those values to a company server or a third party. Longer term storage is the user's own iCloud account, which the user controls and can wipe. The optional Garmin Connect import is the one path that touches a server, and it runs the other way, pulling workouts from the user's Garmin account into Apple Health, with the developer stating the transferred data is encrypted and erased once imported. The app is also set up to write into a second iCloud area used by another product from the same developer, which stays inside the user's own iCloud but is worth a review.
What the app contains
The scan kept no list of third-party services for this build.
Changes since the previous scan
- Version not recorded, score 94.
- Score 90 before, 94 after.
- Version 1.7.8 (Build 144) before, not recorded after.
- Score change since version 1.7.8 (Build 144): +4 points.
- Since the previous scan: 20 findings added, 10 removed.
- Version 1.7.8 (Build 144), score 90.
- Score 94 before, 90 after.
- Version 1.7.5 (Build 131) before, 1.7.8 (Build 144) after.
- Version 1.7.5 (Build 131), score 94.
- Score 97 before, 94 after.
- Version 1.7.5 (build 131) before, 1.7.5 (Build 131) after.
- Version 1.7.5 (build 131), score 97.
- Score 96 before, 97 after.
- Version 1.7.5 (Build 131) before, 1.7.5 (build 131) after.
- Version 1.7.5 (Build 131), score 96.
- Score 83 before, 96 after.
- Version 1.7.5 (Build 131), score 83.
- Score 99 before, 83 after.
- Version 1.7.5 (Build 131), score 99.
- Score 96 before, 99 after.
- Version 1.7.2 (build 127) before, 1.7.5 (Build 131) after.
- Version 1.7.2 (build 127), score 96.
- Score 97 before, 96 after.
- Version 1.7.2 (build 127), score 97.
- Score 91 before, 97 after.
- Version 1.7 (build 120) before, 1.7.2 (build 127) after.
- Version 1.7 (build 120), score 91.
- Score 90 before, 91 after.
- Version 1.6.1 (Build 97) before, 1.7 (build 120) after.
- Version 1.6.1 (Build 97), score 90.
- Score 91 before, 90 after.
- Version 1.6.1 (Build 97), score 91.
- Score 92 before, 91 after.
- Version 1.6.1 (Build 97), score 92.
- First public scan of this app.
Method and limits
Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.
- Scan date
- 10 September 2026
Corrections
No correction is published for this app.
Developer response
No response is published for this app.
Report an error Opens an email to [email protected] that names this app and this scan.