CITT

    Scan results

    Simplenote

    Android

    Simplenote is an easy way to take notes, create to-do lists, capture ideas, and more. Sync across all your devices for free, stay organized with tags, collaborate and share with others, and publish directly to WordPress.

    CITT SCORE
    82
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Note-takers comfortable with Automattic analytics

    What It Means For You

    Notes are synced through Simperium, Automattic's own sync service. Usage patterns are collected via Automattic Tracks, their first-party analytics platform. Crash data is reported to Sentry, a third-party error monitoring service.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (13)

    Data Security

    4 total
    2 Critical
    1 High
    1 Medium

    Code Security

    4 total
    1 Critical
    1 High
    1 Medium
    1 Low

    Privacy

    4 total
    1 High
    2 Medium
    1 Low

    Third-Party Risk

    1 total
    1 Medium

    Third-Party Services

    Simperium, Sentry, Automattic Tracks, WordPress.com, Google Fonts, Dagger Hilt, OkHttp, AndroidX/Jetpack

    Security Strengths

    • ✓Certificate pinning implemented on Simperium domains
    • ✓TLS 1.2+ enforcement
    • ✓No JavaScript interfaces in WebViews
    • ✓External URLs open in system browser
    • ✓No SQL injection vectors
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    sensitive data
    notes
    sync
    authentication
    cloud storage
    collaborative

    Package

    com.automattic.simplenote

    Version

    2.37 (Build 184)

    Analysis Date

    Jan 20, 2025

    Classes Analyzed

    365

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 4 findings (2 critical, 1 high, 1 medium)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 4 findings (1 high, 2 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    • Usage patterns and behavioral data are collected via Automattic Tracks, Automattic's first-party analytics platform.
    • Crash reports and diagnostic information are sent to Sentry, a third-party error monitoring service.
    • Account and note sync data is processed through Simperium, Automattic's own sync infrastructure.

    Third-Party Data Sharing

    • Sentry: Receives crash reports and error diagnostics generated during app use.
    • Automattic Tracks: Collects usage pattern data through Automattic's first-party analytics service.

    Understanding the Scores

    CategoryScore
    Security80/100
    Privacy85/100
    Data Security75/100
    Network Security100/100
    Code Safety85/100
    Data Collection82/100
    Data Sharing90/100
    User Control80/100

    Positive Security Features

    • All network communications use modern, hardened protocols, resulting in a perfect Network Security score of 100/100.
    • Data sharing is limited primarily to Automattic's own infrastructure and a small number of essential third-party services, reflected in a strong Data Sharing score of 90/100.
    • Account and sync preferences give users meaningful control over their data, supporting the User Control score of 80/100.

    Areas for Improvement

    • Data storage practices on the device have issues that could put locally held notes at greater risk. Strengthening how note data is protected at rest would reduce exposure if the device is accessed by others.
    • Crash reporting sends diagnostic information to an external service. Offering an opt-out for this data collection would give users more control over what leaves the device.
    • Some usage data collection happens automatically without a clear in-app opt-out. Providing straightforward controls for analytics would better respect user preference for data minimization.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration at the time of the scan. Scores reflect observed practices and may not capture all runtime behaviors.

    App Details

    • App Name: Simplenote
    • Package ID: com.automattic.simplenote
    • Version: 2.37 (Build 184)
    • Scan Date: January 20, 2026

    Right of Reply

    Developer not yet contacted