Endel: Focus & Sleep Sounds Security & Privacy Scorecard
by Endel · iOS
Listening habits and in-app behavior are shared with multiple marketing platforms, including Facebook and AppsFlyer, to track attribution and engagement. A health-behavior AI platform called Sahha.ai also monitors usage patterns. Users have limited options to control or opt out of what gets collected.
Best for
Unwinding with ambient soundscapes daily
Avoid if
Prefer not sharing behavioral health data
Findings
- 2 critical
- 3 high
- 7 medium
- 2 low
- 3 info
1 issue identified across security and privacy analysis.
Top security issues
- Documents Directory Exposed via iTunes File Sharing
- Staging API Endpoint in Production Build
- Deep Link Parameter Validation Not Verified
Top privacy issues
- Production App with Placeholder ATT Permission Text
- Privacy Manifest Contradicts Tracking Domain Declarations
- Firebase Analytics Enabled by Default
Full analysis
Version: 4.49.100 (Build 1000004003)
Analyzed: 2026-03-27
What This Means for You
Listening habits and in-app behavior are shared with multiple marketing platforms, including Facebook and AppsFlyer, to track attribution and engagement. A health-behavior AI platform called Sahha.ai also monitors usage patterns. Users have limited options to control or opt out of what gets collected.
Recommendation: Use With Caution
Best For: Unwinding with ambient soundscapes daily
Avoid If: Prefer not sharing behavioral health data
Key Findings
Data Security - 6 findings (1 high, 4 medium, 1 low)
Network Security - 2 findings (1 medium, 1 info)
Code Safety - 0 findings
Privacy - 4 findings (2 critical, 1 high, 1 info)
Privacy Concerns
What Data is Collected
The app collects behavioral data tied to how and when it is used, including listening patterns and in-app activity. This data feeds into health-behavior profiling via Sahha.ai, as well as advertising and analytics systems.
Third-Party Data Sharing
User data is shared with the following third-party services:
- AppsFlyer - Mobile attribution and marketing analytics
- Facebook SDK - Advertising and audience targeting
- Singular - Marketing attribution
- Firebase Analytics - Usage analytics
- Firebase Crashlytics - Crash reporting
- Firebase Auth - Authentication
- Firebase Dynamic Links - App navigation and routing
- OneSignal - Push notifications
- RevenueCat - Subscription management
- Google Sign-In - Authentication
- Sahha.ai - Health-behavior AI monitoring
- Lottie - UI animations
- AppAuth - Authentication
- GTMAppAuth - Authentication management
Understanding the Scores
| Category | Score |
|---|---|
| Security | 86/100 |
| Privacy | 62/100 |
| Data Security | 78/100 |
| Network Security | 98/100 |
| Code Safety | 94/100 |
| Data Collection | 65/100 |
| Data Sharing | 72/100 |
| User Control | 50/100 |
Positive Security Features
- Network communications use strong, modern protections, earning a near-perfect score of 98/100.
- The app's code has been built with solid safety practices, scoring 94/100.
- Overall security posture is above average at 86/100.
Areas for Improvement
- The app shares behavioral and usage data with a health-AI platform (Sahha.ai) without clear opt-out controls, raising significant concerns for health-related data privacy.
- Options for users to control, limit, or delete collected data are minimal. The user control score of 50/100 reflects a lack of accessible privacy settings within the app.
- Data is sent to a large number of advertising and analytics services, with limited transparency about what each service receives or retains.
About This Analysis
This scorecard is based on automated static analysis of the app binary.
App Details
| Field | Value |
|---|---|
| Package | com.endel.endel |
| Version | 4.49.100 (Build 1000004003) |
| Scan Date | 2026-03-27 |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 69/100 |