Scan results

Recommendation: Trustworthy

Reflect provides strong privacy protection with application-layer note encryption, cloud sync, and no advertising or attribution networks. Network communications are secured throughout, and Sentry receives the account email address for crash diagnostics as the primary contact with a third-party service.

Key Findings

Data Security: 0 findings

Network Security: 1 finding (1 low)

Code Safety: 1 finding (1 low)

Privacy: 1 finding (1 low)

Privacy Concerns

What Leaves the Device

• Account email address: sent to Sentry for crash diagnostics and error monitoring
• Journal notes and content: synced to Firebase cloud storage; content is encrypted at the application layer before leaving the device

What Stays on the Device

No sensitive data was identified as processed only on the device.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Sentry - crash reporting and error monitoring (receives account email address)
• Firebase (Google) - cloud storage and authentication infrastructure for notes and account management
• Google Sign-In - user authentication
• Logflare - application logging

Understanding the Scores

Security: 84/100
Privacy: 93/100

Security Breakdown

• Data Security: 86/100. Note content is encrypted at the application layer before reaching cloud storage, and the app's overall data handling is careful and limited in scope.
• Network Security: 91/100. All network communication uses HTTPS with no cleartext connections observed throughout the app.
• Code Safety: 83/100. The app's codebase follows sound practices, with one low-severity input-handling concern in the navigation layer identified.

Privacy Breakdown

• Data Collection: 93/100. The app's external data footprint is minimal, with no advertising, attribution, or broad-reach analytics SDKs present and external data sharing limited to cloud sync and crash diagnostics.
• Data Sharing: 95/100. Data is shared only with the developer's own cloud infrastructure and a small set of essential services, with no advertising, attribution, or behavioral profiling data flows identified.
• User Control: 93/100. Users manage their account through Firebase authentication, and note content is encrypted at the application layer before cloud upload.

Positive Security Features

• No advertising networks, attribution SDKs, or broad-reach analytics SDKs are present in the app
• Journal and note content is encrypted at the application layer before syncing to cloud storage
• All API traffic uses HTTPS with no cleartext connections observed
• Crash-reporting behavioral capture is disabled, limiting what interaction data is sent to third parties
• Share extension data stays within the developer's own first-party infrastructure

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Crash Reporting Identity Linkage
   Sentry is configured to attach the account email address to crash reports and performance traces. Using a pseudonymous identifier for crash-reporting sessions would reduce the personal data sent to this service.

2. App Privacy Manifest
   Adding an app privacy manifest could make the App Store privacy label more complete and accurate.

3. Sign-In SDK Location Permissions
   The Google Sign-In library declares approximate location as a data type linked to user identity. Confirming whether this permission is actively used and limiting it where not needed would reduce the app's declared data footprint.

Security Enhancements

1. Local Data Encryption
   The database library linked to the app includes a built-in encryption capability. Enabling it for locally stored data would strengthen on-device data protection.

2. Network Request Filtering
   The embedded web layer is configured to allow network requests to any origin. Restricting this to known first-party and approved domains would add a layer of network defense.

3. Authentication Configuration
   Authentication configuration values embedded in the app bundle could be moved to server-side retrieval to reduce their exposure.

Technical Context

App Type: Personal journaling and note-taking, sensitive data
Classes Analyzed: 395
Third-Party Services: 13
Context Tags: notes, journal, sensitive_data, cloud_sync, health

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Reflect
Version: 1.0.43 (Build 202605221946)
Analysis Date: 2026-08-06
Package: app.reflect.ReflectMobile

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS app version 1.0.43 analyzed on 2026-08-06
• May not reflect server-side security controls
• Cannot detect all runtime behaviors