FitWoody: Health Tracker Security & Privacy Scorecard
by Chubby Studio S.L. · iOS
Activity data is shared with a marketing messaging platform, Customer.io, which can send targeted push notifications and in-app messages. Usage analytics are also collected via TelemetryDeck. Network communication is handled securely, but fitness and behavioral data touches several third-party services behind the scenes.
Best for
Tracking personal fitness goals and workouts
Findings
- 0 critical
- 1 high
- 3 medium
- 6 low
- 7 info
1 issue identified across security and privacy analysis.
Top security issues
- Production Supabase and PowerSync credentials hardcoded in shipped IPA bundle across all four app targets — immediately exploitable by any App Store downloader
- Unencrypted PowerSync SQLite database stores detailed health data (HRV, sleep, training load, metabolic metrics) readable in plaintext on jailbroken or forensically extracted devices
- Custom URL scheme fitwoody:// accepts invocation from any app or web page without source validation — potential for unauthorized navigation into sensitive app workflows
Top privacy issues
- Customer.io auto-tracks every screen transition in a health app and can retroactively link all behavioral events to a user's identity via identify(), sending health navigation patterns to a third-party CRM
- App Store privacy label is inaccurate — main app privacy manifest omits Customer.io and TelemetryDeck data collection declarations, misleading users making informed install decisions about a health app
- iCloud Key-Value Store silently syncs undisclosed data types to Apple servers and all user devices without privacy manifest declaration in a health-context application
Full analysis
What This Means for You
Activity data is shared with a marketing messaging platform, Customer.io, which can send targeted push notifications and in-app messages. Usage analytics are also collected via TelemetryDeck. Network communication is handled securely, but fitness and behavioral data touches several third-party services behind the scenes.
Recommendation: Acceptable
Best For: Tracking personal fitness goals and workouts
Key Findings
Data Security - 4 findings (1 high, 1 medium, 1 low, 1 info)
Network Security - 3 findings (3 info)
Code Safety - 0 findings
Privacy - 5 findings (2 medium, 2 low, 1 info)
Privacy Concerns
What Data is Collected
FitWoody collects fitness activity, workout history, and behavioral patterns during app use. Usage analytics are gathered to understand how users interact with features. Subscription and purchase information is also recorded through a third-party billing service.
Third-Party Data Sharing
User data is shared with several external services:
- Customer.io - Receives activity and behavioral data to send targeted push notifications and in-app messages
- TelemetryDeck - Collects analytics about how users interact with app features
- RevenueCat - Handles subscription and purchase records
- LaunchDarkly - Receives data to determine which features are enabled for a user's account
- PowerSync and Supabase - Used to store and synchronize personal data
- Diagnostics - Collects crash and performance information from the device
Understanding the Scores
| Area | Score |
|---|---|
| Security | 75/100 |
| Privacy | 52/100 |
| Data Security | 44/100 |
| Network Security | 100/100 |
| Code Safety | 96/100 |
| Data Collection | 62/100 |
| Data Sharing | 80/100 |
| User Control | 65/100 |
Positive Security Features
- All network connections use secure, modern protocols with no insecure communication paths detected
- The app's code demonstrates strong safety practices with minimal use of risky patterns
- Payment and subscription handling is fully delegated to a specialized third-party provider rather than processed directly within the app
Areas for Improvement
- On-device data protection could be stronger. Some personal fitness and activity data may not be stored with adequate safeguards on the device, which could expose it if the phone is accessed by someone else.
- Third-party data reach is broad. Behavioral and fitness data flows to six or more external services, making it difficult to understand exactly how it is used or retained downstream.
- Data control options are limited. The app does not make it straightforward for users to review, export, or remove personal data on request.
About This Analysis
This scorecard is based on a technical review of the app's code and configuration. Scores reflect the practices observed at the time of analysis and may not capture all risks or account for recent updates.
App Details
| Field | Value |
|---|---|
| App | camp.FitWoody |
| Package | camp.FitWoody |
| Version | 2.3.6 (Build 2) |
| Scan Date | 2026-04-03 |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #13 (current) | 59/100 |