Scan results

Recommendation: Trustworthy

CITT assesses Evernote as trustworthy for personal note-taking and cross-device sync. The main app uses layered encrypted storage and does not share note content with third-party analytics or crash-reporting systems. Crash-reporting and install-attribution libraries are linked, though these operate on device-level diagnostics rather than note content.

Key Findings

Data Security: 0 findings

Network Security: 0 findings

Code Safety: 2 findings (2 low)

Privacy: 0 findings

Privacy Concerns

What Leaves the Device

• Note content: synced to Evernote's own servers for cross-device access via an encrypted connection
• Crash and error data: the binary links Firebase Crashlytics and Sentry; these services may receive diagnostic reports when errors occur (runtime transmission was not observed)
• Install attribution data: the binary links Bending Spoons attribution and Apple AdServices; these may correlate install events with device or account identifiers (runtime transmission was not observed)
• Device identifiers and carrier name: the binary links RNDeviceInfo, which makes device-level information available within the app; whether this data is sent to external services was not confirmed through runtime observation

What Stays on the Device

No sensitive data was identified as processed exclusively on the device in this build. The binary does not link AppTrackingTransparency, so the device advertising identifier (IDFA) is not accessed by this build and remains outside the app's reach.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Firebase Crashlytics - crash and error reporting
• Sentry - error monitoring
• Bending Spoons - install attribution
• Apple AdServices (AAAttribution) - install attribution
• Google Sign-In (GTMAppAuth) - authentication

Understanding the Scores

Security: 83/100
Privacy: 84/100

Security Breakdown

• Data Security: 83/100. The main app uses layered encrypted storage and biometric-protected secure storage for sensitive items. The share extension's local storage could be strengthened to match the same level of protection.
• Network Security: 80/100. Communication with Evernote's servers uses encrypted connections; the binary's transport security configuration includes some exceptions that could be narrowed for more uniform enforcement.
• Code Safety: 88/100. The binary links well-maintained third-party components. Two low-severity findings relate to non-production infrastructure references compiled into the production build.

Privacy Breakdown

• Data Collection: 84/100. The binary links attribution and crash-reporting libraries that may send device-level data to third parties. Note content is not shared with any third-party SDK.
• Data Sharing: 91/100. Note content stays within Evernote's own infrastructure. The binary does not link advertising SDKs or data-broker services.
• User Control: 88/100. An in-app consent screen with a withdrawal path for third-party tracking is present in the binary. The device advertising identifier is not accessed by this build.

Positive Security Features

• Firebase Analytics is disabled in this build; no analytics data is configured to be sent to Google's analytics infrastructure
• Note content stays within Evernote's own infrastructure and is not shared with any third-party SDK
• The binary does not link AppTrackingTransparency; the device advertising identifier (IDFA) is not accessed
• The main app uses layered encrypted storage and biometric-protected secure storage for sensitive items
• The App Group container is restricted to first-party extensions under the same Team ID; no third-party SDK access to shared storage is configured
• An in-app consent screen with a withdrawal path for third-party tracking technologies is present in the binary

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. App Privacy Manifest Coverage
   Apple's guidance (https://developer.apple.com/documentation/bundleresources/privacy_manifest_files) recommends an app privacy manifest (PrivacyInfo.xcprivacy) listing required-reason APIs and declared data types. The binary links attribution and crash-reporting SDKs; adding or expanding a privacy manifest could make the App Store privacy label more complete and easier for users to compare against the binary. Whether the current privacy label fully reflects the linked SDKs could not be determined from the binary alone.

2. Non-Production Domains in Production Entitlements
   The signed entitlements file registers staging and test domains as universal link handlers. Apple's associated-domains documentation recommends keeping entitlement lists scoped to production domains. If any listed staging domain were to have its DNS reused by another party in the future, iOS routing behavior for those links could be affected. Removing non-production entries from the production build would narrow this surface.

Security Enhancements

1. Share Extension Storage Protection
   Strengthening the share extension's local storage to use the same level of encrypted protection as the main app would provide more consistent coverage when note content is captured through the system share sheet.

2. App Transport Security Exceptions
   Reviewing and narrowing the App Transport Security exception list in the binary would enforce encrypted connections more uniformly across the app and its extensions.

Technical Context

App Type: Productivity - note-taking and cloud sync (sensitive data)
Classes Analyzed: 0
Third-Party Services: 18
Context Tags: productivity, notes, sensitive_data, camera, cloud_sync, ads

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Evernote Corporation
Version: 11.28.3 (build 1251911)
Analysis Date: 2026-08-13
Package: com.evernote.iPhone.Evernote

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 11.28.3 analyzed on 2026-08-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors