Evernote - Notes Organizer Security & Privacy Scorecard

by Evernote Corporation · iOS

80
Overall trust score
Acceptable
82
Security
76
Privacy

Usage patterns are shared with advertising partners including AppLovin, which uses that data to target ads. Analytics services track how users interact with the app, and Apple Ads Attribution connects in-app activity to ad campaigns. Notes content stays private, but behavioral data reaches several third parties.

Best for

Personal note-taking and organization

Findings

  • 0 critical
  • 11 high
  • 7 medium
  • 5 low
  • 10 info

7 issues identified across security and privacy analysis.

Top security issues

  • ENML note renderer URL sanitizer bypassed by Unicode control characters, enabling XSS via shared notes in WKWebView
  • App Transport Security completely disabled in both main app and Share extension, exposing sensitive note data to MITM attacks
  • SQLite and CoreData databases not encrypted — note content accessible after first device unlock without user credentials

Top privacy issues

  • Main app privacy manifest missing NSPrivacyTracking declaration despite active advertising tracking infrastructure with AppLovin SDK
  • AppLovin SDK v13.3.1 privacy manifest declares empty data collection, systematically misrepresenting what the ad SDK collects
  • Sentry Session Replay with touch tracking compiled and active in production, potentially recording visible note content

Full analysis

Version: 11.10.1 (Build 1246977)
Scan Date: 2026-04-05

Security Score: 82/100
Privacy Score: 76/100

What This Means for You

Usage patterns are shared with advertising partners including AppLovin, which uses that data to target ads. Analytics services track how users interact with the app, and Apple Ads Attribution connects in-app activity to ad campaigns. Notes content stays private, but behavioral data reaches several third parties.

Recommendation: Trustworthy

Best For: Personal note-taking and organization

Key Findings

Data Security - 5 findings (2 medium, 2 low, 1 info)

Network Security - 5 findings (2 high, 1 low, 2 info)

Code Safety - 0 findings

Privacy - 7 findings (1 high, 2 medium, 1 low, 3 info)

Privacy Concerns

What Data is Collected

Device identifiers, usage patterns, and behavioral data are collected during app use. Crash reports and performance diagnostics are gathered automatically. Account information and in-app activity are recorded to support core functionality and advertising.

Third-Party Data Sharing

Data is shared with the following third parties:

  • AppLovin (advertising and quality analytics) - receives usage data to serve and optimize ads
  • Apple Ads Attribution (Bending Spoons integration) - links in-app activity to advertising campaigns
  • Firebase / Google - handles push notifications and crash reporting
  • Sentry - receives crash diagnostics and error reports
  • IAB Open Measurement SDK - supports ad viewability measurement

Understanding the Scores

Category Score
Security 82/100
Privacy 76/100
Data Security 86/100
Network Security 76/100
Code Safety 86/100
Data Collection 82/100
Data Sharing 89/100
User Control 84/100

Positive Security Features

  • Data shared with advertising partners is limited to behavioral and usage signals, keeping notes content off third-party networks
  • Code structure follows established patterns that reduce exposure to common security issues
  • In-app controls allow users to manage their account and connected services

Areas for Improvement

  • Some network communications could be better hardened against interception, particularly on untrusted networks such as public Wi-Fi
  • Advertising data collection is active by default, and clearer in-app controls for opting out of behavioral tracking would benefit users
  • Privacy disclosures about which advertising partners receive user data, and for what purposes, could be more prominent and accessible

About This Analysis

This scorecard is generated from automated static analysis of the app binary. Scores reflect security and privacy practices found in the code. Real-world behavior may vary based on server-side configuration and user settings.

App Details

Field Value
App ID com.evernote.iPhone.Evernote
Version 11.10.1 (Build 1246977)
Scan Date 2026-04-05

Versions & scan history

ScanDateOverall score
#1 (current) 80/100