<!-- TRUSTEDVERDICTHEADER -->

TRUSTED

This app met every check in this assessment with no open items.

Trust Pillars

• Secure by Design: Strong. Strong result in this area.
• Data Respect: Strong. Strong result in this area.
• Honest Experience: Strong. Strong result in this area.
• User Control: Strong. Strong result in this area.
• Child-Safe: Not applicable. Does not apply to this app.

---

<!-- /TRUSTEDVERDICTHEADER -->

Security & Privacy Scorecard

The Outsiders

What This Means for You

All biometric data, including heart rate, HRV, and workout metrics, stays on the device and is never transmitted to any external server. Subscription status is the only information shared externally, transmitted to RevenueCat to validate in-app purchases.

Recommendation: Very Secure

Exemplary privacy design with zero tracking SDKs and all health data processed on-device using modern encryption. Integrates seamlessly with Garmin and Apple Watch while keeping fitness biometrics fully under user control.

Best For: Privacy-focused fitness users who want local biometric tracking with Garmin and Apple Watch integration, free from advertising or analytics data sharing.

Key Findings

Data Security - 1 finding (1 medium)

Network Security - 0 findings

Code Safety - 1 finding (1 low)

Privacy - 0 findings

Privacy Concerns

What Data is Collected

• Fitness and biometric data: Heart rate, HRV, power output, and workout metrics - accessed from Apple Watch and Garmin devices, kept on the device
• Training goals: Stored locally, kept on the device
• Subscription status: Shared with RevenueCat to manage in-app purchases

Third-Party Data Sharing

Third parties that may receive data from the app:

• RevenueCat - subscription and in-app purchase management

Understanding the Scores

Security: 93/100
Privacy: 95/100

Security Breakdown

• Data Security: 86/100. Health and workout biometrics are stored securely on the device. Applying a stronger data protection class to all local database files would ensure this data remains protected within computer backups even when no backup password is set.

• Network Security: 100/100. All network communications are enforced over HTTPS with no cleartext exceptions configured anywhere in the app.

• Code Safety: 92/100. Modern cryptography is used for all primary security functions throughout the app, reflecting a high standard of implementation quality.

Privacy Breakdown

• Data Collection: 96/100. Fitness biometrics are accessed and processed entirely on the device, with no advertising, analytics, or tracking SDKs present in the app.

• Data Sharing: 100/100. Health and behavioral data is not shared with any third parties. Subscription status flows to RevenueCat solely for payment validation.

• User Control: 97/100. Data sovereignty is fully respected, with health data remaining local and external information flows limited to subscription management.

Positive Security Features

• No third-party analytics, advertising, or tracking SDKs are present, keeping health data off ad networks
• All network connections are enforced over HTTPS with no cleartext exceptions
• Health and workout data stays on the device and is not transmitted to any external server
• Modern cryptography is used for all primary security functions
• Garmin authentication uses a process-isolated browser session rather than an embedded web view
• Privacy-preserving Apple attribution is used instead of third-party tracking SDKs
• No hardcoded secrets or keys were found in the app bundle

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. App Privacy Manifest
   Adding an app privacy manifest (PrivacyInfo.xcprivacy) could make the App Store privacy label more complete by formally documenting which system APIs are used and for what purpose.

Security Enhancements

1. Data Protection Class for Fitness Databases
   Enabling the highest iOS data protection class for all local database files would ensure heart rate, HRV, and workout data remain protected within computer backups, including when no backup password is set on the host computer.

2. Legacy Hash Function Scope
   Legacy hash functions are linked, most likely for Garmin FIT file checksum compatibility. Confirming and documenting that their use is limited to non-security-sensitive checksum computation would eliminate any ambiguity.

Technical Context

App Type: Health and fitness tracker handling sensitive biometric data
Classes Analyzed: 0
Third-Party Services: 3 (RevenueCat, Garmin FIT SDK, Reachability)
Context Tags: health, fitness, sensitive_data

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Not available
Version: 1.7.5 (Build 131)
Analysis Date: 2026-07-22
Package: app.outsiders.the

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 1.7.5 (Build 131) analyzed on 2026-07-22
• May not reflect server-side security controls
• Cannot detect all runtime behaviors