CITT

    Scan results

    Garmin Connect™

    Android

    Garmin Connect is the official companion app for Garmin fitness devices, providing health and fitness data tracking, activity analysis, and device management. It syncs with Forerunner, Venu, fenix, and other compatible Garmin devices to display workouts, health metrics, and enable custom training.

    CITT SCORE
    45
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Garmin device owners comfortable with broad data sharing

    What It Means For You

    Fitness activity, location, and health data are shared with multiple analytics and advertising services. Components from Baidu, Alipay, and Tencent process portions of user data through Chinese platforms alongside Western services like Firebase and Microsoft. The advertising ID is collected, linking workout and movement patterns to ad targeting across apps.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (16)

    Data Security

    4 total
    1 Critical
    1 High
    2 Medium

    Network Security

    3 total
    1 Critical
    1 High
    1 Medium

    Code Security

    3 total
    1 Critical
    1 Medium
    1 Low

    Privacy

    4 total
    3 High
    1 Medium

    Third-Party Risk

    2 total
    1 High
    1 Medium

    Third-Party Services

    Firebase Analytics, Microsoft Application Insights, Google Play Services Measurement, Google Advertising ID, Baidu Cloud Push, Alipay SDK, Tencent Services, Mapbox Maps SDK, Google Maps API, Strava

    Security Strengths

    • ✓SSL error handling secure (no SSL bypass vulnerabilities)
    • ✓Backup protection enabled (allowBackup=false)
    • ✓HTTPS enforcement in code throughout codebase
    • ✓Secure WebView template exists with comprehensive security settings
    • ✓Modern architecture components (Room, AndroidX Security, OkHttp3/Retrofit2)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    health
    fitness
    location
    sensitive data
    financial
    social
    ads

    Package

    com.garmin.android.apps.connectmobile

    Version

    5.20.2

    Analysis Date

    Jan 22, 2026

    Classes Analyzed

    58,479

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (1 critical, 1 high, 2 medium)

    Network Security - 3 findings (1 critical, 1 high, 1 medium)

    Code Safety - 0 findings

    Privacy - 4 findings (3 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    • Fitness and workout activity records
    • GPS location and movement patterns
    • Health metrics including heart rate, sleep, and step counts
    • Advertising ID, which links activity to a cross-app behavioral profile
    • Device identifiers

    Third-Party Data Sharing

    Data is shared with the following services:

    • Firebase Analytics - behavioral analytics (Google)
    • Microsoft Application Insights - usage and performance analytics
    • Google Play Services Measurement - advertising measurement
    • Google Advertising ID - cross-app ad targeting
    • Baidu Cloud Push - push notifications processed through a Chinese platform
    • Alipay SDK - data processing through a Chinese platform
    • Tencent Services - analytics and data processing through a Chinese platform
    • Mapbox Maps SDK - mapping and location processing
    • Google Maps API - mapping and location processing
    • Strava - fitness data integration

    Understanding the Scores

    CategoryScore
    Security42/100
    Privacy48/100
    Data Security35/100
    Network Security40/100
    Code Safety45/100
    Data Collection52/100
    Data Sharing50/100
    User Control60/100

    Positive Security Features

    • App uses the standard Android permission model to gate access to device sensors and location

    Areas for Improvement

    • Health and fitness data is shared with a broad set of third-party services well beyond what is needed to sync with a Garmin device, including advertising networks that build behavioral profiles across apps.
    • Location and movement data flows through both Western and Chinese third-party platforms, subjecting it to multiple legal jurisdictions with different privacy protections.
    • The advertising ID collected by this app connects workout and health data to a wider profile used for ad targeting in other apps on the device.

    About This Analysis

    This scorecard is generated through automated static analysis of the app's code and behavior patterns. Scores reflect the security and privacy posture of the version analyzed and may change with app updates.

    App Details

    • App: Garmin Connect™
    • Package: com.garmin.android.apps.connectmobile
    • Version: 5.20.2
    • Platform: Android
    • Scan Date: 2026-01-22

    Right of Reply

    Developer not yet contacted