Scan results

    Fay Nutrition Dietitians

    Android

    Fay connects you with licensed Registered Dietitians for personalized nutrition care covered by insurance. The app enables 1:1 consultations, appointment scheduling, secure messaging with your dietitian, meal logging, and health tracking across 30+ specialties including diabetes, sports nutrition, g

    CITT SCORE
    32
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Nutrition coaching covered by insurance

    Not For: Sharing sensitive diagnoses or health conditions

    What It Means For You

    Dietary habits, health goals, and in-app behavior are tracked by analytics and behavioral profiling services including Mixpanel and Statsig. Usage data is shared with multiple third parties, and users have limited control over what is collected or how it is used. Those entering sensitive health details should review the privacy policy before signing up.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (12)

    Data Security

    3 total
    2 Critical
    1 High

    Code Security

    5 total
    1 High
    3 Medium
    1 Low

    Privacy

    4 total
    2 Critical
    1 High
    1 Medium

    Third-Party Services

    AWS Amplify, AWS Chime SDK, AWS Cognito, AWS S3, Sentry, Statsig, Mixpanel, Firebase Cloud Messaging, Conscrypt

    Security Strengths

    • Zero WebView usage - Custom Tabs for OAuth following RFC 8252
    • Modern TLS 1.3 implementation via Conscrypt 2.5.3
    • Secure OAuth flows via Custom Tabs
    • AWS security architecture with temporary credentials and SigV4 signing
    • Component export security - no exported components vulnerable
    • HTTPS-only communication enforced
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    health
    sensitive data
    financial
    ads
    location

    Package

    com.faynutrition.android

    Version

    1.28.0

    Analysis Date

    Dec 19, 2025

    Classes Analyzed

    12,142

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (2 critical, 1 high)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 4 findings (2 critical, 1 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    Fay Nutrition Dietitians collects data about dietary habits, health goals, and how users interact with the app. Behavioral profiling services record in-app activity, including which features are used and how often, to build a profile of user habits over time. Crash reporting services may capture device information and app state. Cloud infrastructure services store and process user data, including health-related content entered in the app.

    Third-Party Data Sharing

    User data is shared with multiple third-party services:

    • Mixpanel - Behavioral analytics and user profiling
    • Statsig - Feature experimentation and behavioral analytics
    • Firebase Cloud Messaging - Push notification delivery
    • Sentry - Error and crash reporting, which may include device and session data
    • AWS Amplify, Cognito, S3, Chime SDK - Cloud storage, authentication, and video communications infrastructure
    • Conscrypt - Underlying network security library

    Understanding the Scores

    CategoryScore
    Security38/100
    Privacy25/100
    Data Security15/100
    Network Security85/100
    Code Safety62/100
    Data Collection40/100
    Data Sharing20/100
    User Control30/100

    Security (38/100): The app's protection of sensitive data falls short in key areas, pulling the overall security score down significantly.

    Privacy (25/100): Broad data collection paired with extensive third-party sharing and limited user control result in a low privacy score.

    Data Security (15/100): How personal health information is stored and protected is a significant factor in the low overall score.

    Network Security (85/100): Communications between the app and its servers are generally well protected in transit.

    Code Safety (62/100): The app's code structure is reasonably sound, though some areas could be strengthened.

    Data Collection (40/100): The app collects a wide range of data about users and their health habits.

    Data Sharing (20/100): User data is distributed to multiple external parties with limited transparency about how it is used.

    User Control (30/100): Users have very limited ability to manage what is collected, opt out of tracking, or request data deletion from within the app.

    Positive Security Features

    • No standout security practices were identified in this version of the app.

    Areas for Improvement

    • How sensitive personal health data is stored and protected needs significant strengthening to reduce the risk of unauthorized access.
    • Behavioral data is shared with multiple analytics providers. Providing users with clear, accessible controls to limit or opt out of this sharing would better respect user privacy.
    • Users currently have little say in what data is collected or how it is used. Meaningful in-app privacy controls, especially for health-related data, would give users more control.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and behavior patterns. Scores reflect the state of the app at the time of the scan and may not capture every possible risk or recent updates.

    App Details

    • App Name: Fay Nutrition Dietitians
    • Package ID: com.faynutrition.android
    • Version: 1.28.0
    • Platform: Android
    • Scan Date: 2025-12-19

    Right of Reply

    Developer not yet contacted