Calm - Sleep, Meditate, Relax Security & Privacy Scorecard
Android
Usage patterns and behavior are tracked by multiple analytics and marketing services, including Amplitude, Segment, AppsFlyer, and Facebook. User activity helps build ad profiles across platforms. Users have moderate control over their data, but sharing with third parties happens in the background.
Best for
Meditation seekers comfortable with standard analytics
Avoid if
You prefer apps that don't share data with Facebook
Findings
- 0 critical
- 0 high
- 0 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Unencrypted Mental Health PHI in Database
- SSL Errors Silently Ignored in WebViews
- Fixed IV in AES-GCM Encryption
Top privacy issues
- Mental Health Data to Non-HIPAA Third Parties
- No User Opt-Out for Behavioral Tracking
- Segment Data Amplification
Full analysis
Calm - Sleep, Meditate, Relax
com.calm.android | Version 6.87 (Build 4120426) | Analyzed: January 29, 2026
What This Means for You
Usage patterns and behavior are tracked by multiple analytics and marketing services, including Amplitude, Segment, AppsFlyer, and Facebook. User activity helps build ad profiles across platforms. Users have moderate control over their data, but sharing with third parties happens in the background.
Recommendation: Use With Caution
Best For: Meditation seekers comfortable with standard analytics
Avoid If: Users prefer apps that don't share data with Facebook
Key Findings
Data Security - 5 findings (2 critical, 3 high)
Network Security - 1 finding (1 critical)
Code Safety - 0 findings
Privacy - 5 findings (1 critical, 2 high, 2 medium)
Privacy Concerns
What Data is Collected
Calm collects information about how users interact with the app, including which features are used, how long users engage with content, and session patterns. This data is processed to personalize the user experience and inform marketing communications.
Third-Party Data Sharing
User activity data is shared with the following third-party services:
- Amplitude - Behavioral analytics and event tracking
- Segment - Data routing to other marketing and analytics platforms
- Iterable - Marketing messages and push notifications
- AppsFlyer - Advertising attribution across mobile campaigns
- Firebase Crashlytics - App stability reporting
- Auth0 - Account authentication services
- Apptentive - In-app feedback collection
- PerimeterX - Bot and fraud detection
- Facebook SDK - Social features and advertising integration
- ExoPlayer - Media playback (open source component)
Understanding the Scores
| Category | Score |
|---|---|
| Security | 65/100 |
| Privacy | 70/100 |
| Data Security | 60/100 |
| Network Security | 75/100 |
| Code Safety | 70/100 |
| Data Collection | 80/100 |
| Data Sharing | 65/100 |
| User Control | 75/100 |
Positive Security Features
- None identified.
Areas for Improvement
- Stronger on-device data protection: Personal data stored locally on the device could be better protected against unauthorized access by other apps or parties.
- More secure server connections: Some connections between the app and its servers use configurations that fall short of current best practices, leaving data with less protection than expected during transmission.
- Clearer third-party data controls: User activity is shared with advertising platforms including Facebook in the background, with limited options to opt out or understand exactly what is shared.
About This Analysis
This scorecard reflects the security and privacy posture of the app based on analysis of its code and behavior patterns at the time listed below.
App Details
- App: Calm - Sleep, Meditate, Relax
- Package ID: com.calm.android
- Version: 6.87 (Build 4120426)
- Analysis Date: January 29, 2026
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #3 (current) | 68/100 | |
| #1 | 22/100 |