Scan results

Recommendation: Solid

Calm delivers a well-rounded meditation, sleep, and relaxation experience with strong network security and meaningful protections for HIPAA-enrolled users. Mental health journals, mood check-ins, and sleep records are stored on the device without encryption, and six analytics services begin collecting usage data before any consent mechanism is presented. The app suits people who primarily use it for guided meditations, sleep stories, and breathing exercises.

Key Findings

Data Security: 2 findings (1 high, 1 medium)

Network Security: 0 findings

Code Safety: 7 findings (1 medium, 6 low)

Privacy: 4 findings (1 high, 1 medium, 2 low)

Privacy Concerns

What Leaves the Device

• Behavioral usage data (content played, session timing, in-app actions): sent to Amplitude, Segment, Iterable, AppsFlyer, and Facebook SDK for analytics, attribution, and marketing measurement
• Purchase and subscription activity: sent to Firebase Analytics and AppsFlyer for revenue tracking
• Device interaction signals: sent to HUMAN Security (PerimeterX) for bot detection and fraud prevention
• Account sign-in information: sent to Auth0 for authentication and session management
• Payment information: processed by Stripe and Google Play Billing for subscription purchases
• Crash and performance data: sent to Firebase Crashlytics and Firebase Performance

What Stays on the Device

• Journal entries, mood check-ins, and sleep records: stored on the device and not transmitted to analytics services or third parties
• Contact names and phone numbers: accessed on the device only for the Guest Pass sharing feature and not transmitted off-device
• Meditation activity: can be written to the Android Health Connect local data store on an opt-in basis, where it stays under the user's control

Third-Party Data Sharing

Third parties that may receive data from the app:

• Firebase (Analytics, Crashlytics, Performance, Cloud Messaging, Remote Config) - usage analytics, crash reporting, performance monitoring, and push notifications
• Amplitude Analytics and Amplitude Experiment - behavioral analytics and feature experimentation
• Segment Analytics - behavioral event aggregation and routing
• AppsFlyer - attribution, install tracking, and marketing analytics
• Iterable - marketing communications and push notifications
• Facebook SDK - advertising attribution and measurement
• HUMAN Security (PerimeterX) - bot detection and fraud prevention
• Auth0 - authentication and identity management
• Stripe - payment processing
• Google (Sign-In, Play Billing, Pay/Wallet) - authentication and payment processing

Understanding the Scores

Security: 72/100
Privacy: 69/100

Security Breakdown

• Data Security: 46/100. Mental health journals, mood check-ins, and sleep records are stored on the device without encryption, and the backup configuration allows this data to be extracted via a USB-connected computer. A storage path active on rooted devices has an additional weakness that could allow stored data to be tampered with. This sub-score reflects the concentration of sensitive personal data in unprotected on-device storage.

• Network Security: 100/100. All production traffic uses encrypted connections. SSL errors are correctly rejected across every in-app browsing component, and unencrypted connections are blocked at the OS level.

• Code Safety: 88/100. Authentication and in-app browsing components include meaningful protections, and token-bearing in-app browsers are not accessible from other apps on the device. Several lower-severity configuration items, including development tools present in the release build, could be tightened in future updates.

Privacy Breakdown

• Data Collection: 65/100. Six analytics services initialize and begin collecting usage data when the app opens, before any consent is presented to the user. Actual journal entries, mood logs, and sleep content are not sent to these analytics services.

• Data Sharing: 78/100. Usage and behavioral data is shared with six analytics and attribution services. HIPAA-enrolled users receive stronger data protections, with analytics anonymized and partner data sharing filtered.

• User Control: 73/100. Users can request data deletion and the app provides HIPAA data controls for enrolled users. Analytics begin collecting before any user control mechanism is available, which limits pre-consent choice.

Positive Security Features

• All production API traffic uses encrypted connections, and unencrypted connections are blocked at the OS level
• SSL errors are correctly rejected across all in-app browsing components, connections fail safely on any certificate issue
• Token-bearing in-app browsers are not externally accessible from other apps, preventing navigation injection
• HIPAA-enrolled users receive enhanced protections: analytics anonymized, advertiser tracking adjusted, and partner sharing filtered
• Facebook automatic event logging and advertiser ID collection are disabled at the configuration level by default
• Health Connect integration is write-only and opt-in; the app does not read health data from other apps or external sources
• Actual journal entries, mood logs, and sleep content are not passed to any analytics or third-party services

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Pre-consent Analytics Initialization
   Analytics and attribution services could be initialized only after user consent is obtained, rather than at app startup before any consent screen is shown.

2. Firebase Analytics Configuration
   The manifest-level analytics opt-out flag could be honored rather than overridden in code, providing a reliable mechanism for disabling collection.

Security Enhancements

1. On-Device Database Encryption
   Mental health journals, mood check-ins, and sleep records could be encrypted at rest on the device, protecting user data from extraction even if the device is connected to a computer.

2. Backup Exclusion Rules
   The backup configuration could exclude the app's main database and session storage files so that USB and cloud backups do not capture sensitive personal records.

Technical Context

App Type: Mental health and wellness (sensitive personal data)
Classes Analyzed: 93,031
Third-Party Services: 19
Context Tags: health, sensitive_data, contacts, ads, subscription

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Calm.com, Inc.
Version: 6.92 (build 4120434)
Analysis Date: 2026-07-30
Package: com.calm.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 6.92 (build 4120434) analyzed on 2026-07-30
• May not reflect server-side security controls
• Cannot detect all runtime behaviors