Scan results

Recommendation: Very Secure

Sensitive personal data including health metrics, calendar events, contacts, and photos is processed locally and never transmitted to any server or third party. The app is ad-supported, and advertising identifiers operate separately from the personal data that powers the widget functionality. All connections are encrypted and no third-party data broker flows were identified.

Key Findings

Data Security: 0 findings

Network Security: 0 findings

Code Safety: 1 finding (1 low)

Privacy: 0 findings

Privacy Concerns

What Leaves the Device

• Advertising identifiers: may be sent to Google AdMob for ad targeting and delivery
• Subscription and purchase information: sent to RevenueCat for subscription management
• App interaction data: may be sent to Superwall for paywall optimization
• Location: may be sent to Foreca, Weathermachine.io, and WorldTides to serve weather and tide data for widgets

What Stays on the Device

• Health metrics (activity, heart rate, sleep, and other Apple Health data): accessed on the device and never transmitted
• Calendar events and reminders: accessed locally for widget display and not sent off-device
• Contacts: accessed on the device for widget display and not transmitted
• Photos: accessed on the device and not transmitted

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google Mobile Ads (AdMob) - advertising
• Google UMP (UserMessagingPlatform) - ad consent management
• RevenueCat - subscription and purchase management
• Superwall - paywall and subscription flow management
• Foreca - weather data
• Weathermachine.io - weather data
• WorldTides - tide forecast data
• Apple AdServices - ad attribution
• Apple AdSupport / ATT - advertising identifier access

Understanding the Scores

Security: 93/100
Privacy: 91/100

Security Breakdown

• Data Security: 94/100. Sensitive personal data is secured on the device. Health, calendar, contacts, reminders, and photos are handled with strong protections and remain within the user's device.
• Network Security: 100/100. All connections use HTTPS with modern authenticated encryption. No unprotected traffic is permitted anywhere in the app.
• Code Safety: 92/100. Strong binary protections are in place throughout the app, including stack protection active across all code paths and no exposed scripting bridges in app-controlled views.

Privacy Breakdown

• Data Collection: 91/100. Sensitive personal data types including health, calendar, contacts, and photos are accessed locally and not transmitted. Ad-related data flows are limited to what the advertising frameworks require.
• Data Sharing: 93/100. Data sharing is focused on functional services: weather data providers, subscription management, and advertising. No third-party data broker flows were identified.
• User Control: 90/100. iOS platform controls including App Tracking Transparency, HealthKit permissions, and Calendar, Contacts, and Photos authorization give users direct authority over what data the app can access.

Positive Security Features

• All network connections are encrypted - no unprotected traffic is permitted
• Health, calendar, contacts, reminders, and photos data stays on the device and is never transmitted off-device
• Location is absent from all analytics and advertising data flows
• No third-party data broker flows were identified
• Modern encryption standards are used throughout the app
• Stack protection is active across all code in the binary
• The App Group shared container is restricted to the developer's own extensions, preventing third-party access

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. App Privacy Manifest
   Adding an app privacy manifest could make the App Store privacy label more complete, giving users greater transparency about the data the app accesses.

2. Ad Tracking Consent
   Ensuring the App Tracking Transparency prompt is presented to users before advertising identifiers are accessed would provide a clear, explicit opportunity to opt out of ad tracking.

Security Enhancements

1. Weather Service Authentication
   The app embeds weather service authentication directly in the binary, which requires a new app release to update. Designing this to be refreshable from a server configuration would improve resilience if the authentication were ever changed or needed rotation.

Technical Context

App Type: Home screen widget customization app with health, calendar, weather, and contacts integration
Classes Analyzed: 0
Third-Party Services: 10
Context Tags: health, location, ads, calendar, contacts

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Crossforward
Version: 8.4 (Build 1304)
Analysis Date: 2026-08-05
Package: com.crossforward.WidgetSmith

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS binary version 8.4 (Build 1304) analyzed on 2026-08-05
• May not reflect server-side security controls
• Cannot detect all runtime behaviors