Scan results

Recommendation: Significant Security Concerns

A private service authentication key is embedded directly in the app where anyone can extract it, potentially allowing unauthorized access to McFIT's gym location management service and consuming the chain's service quota. Additionally, email addresses are forwarded to an external marketing platform during key membership actions without explicit user consent. McFIT members should be aware of these findings.

Key Findings

Data Security - 1 finding (1 low)

Network Security - 1 finding (1 low)

Code Safety - 5 findings (1 high, 1 low, 3 info)

Privacy - 1 finding (1 medium)

Privacy Concerns

What Data is Collected

• Personal information: email address, name, phone number, gender, date of birth
• Location data: approximate (network-based) and precise (GPS)
• Device information: device ID, Wi-Fi connection details
• Usage data: app interactions, contract activity, checkout and registration behavior
• Financial information: contract and payment activity

Third-Party Data Sharing

The following third parties may receive your data:

• Braze - CRM and marketing communications (receives your email address and user profile data)
• Firebase Analytics - usage analytics (requires your consent before activating)
• Firebase Crashlytics - crash and error reporting (requires your consent before activating)
• Segment Analytics - behavioral analytics
• Branch.io - install attribution and in-app navigation routing
• Google Ads Identifier - advertising measurement
• Zendesk - customer support communications

Understanding the Scores

Security: 90/100
Privacy: 88/100

Security Breakdown

• Data Security: 96/100 - Personal data stored on-device is generally well protected, with a minor concern around how the marketing library caches profile data locally
• Network Security: 97/100 - All server communications use encrypted connections, with no bypass code present; an in-app browser component loads server-provided pages without an explicit host allowlist
• Code Safety: 91/100 - Strong overall code practices, though a private service key is embedded in the distributed app and a URL scheme handler forwards incoming links without validation

Privacy Breakdown

• Data Collection: 89/100 - App collects personal and location data appropriate for membership management, alongside analytics services
• Data Sharing: 93/100 - Limited external sharing overall, though email forwarding to the marketing platform lacks a consent gate
• User Control: 89/100 - Most analytics services require consent before activating, but the marketing platform starts unconditionally at launch

Positive Security Features

• All communication with McFIT's servers uses encrypted connections with no bypass code found
• App installation is verified as genuine before connecting to McFIT's servers, blocking automated abuse
• Login sessions are protected using hardware-backed secure storage on your device
• Usage analytics are disabled by default and only activate after you give consent
• Crash reporting only activates after you explicitly consent
• App data cannot be copied from your device via USB backup tools
• The marketing platform stores your data on EU-based servers, supporting GDPR compliance
• File sharing with other apps is restricted to necessary areas only

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Marketing Platform Consent Gating
   The Braze marketing service starts unconditionally when the app launches, including forwarding your email address during checkout and contract events. Industry best practice recommends gating this service behind explicit user consent, consistent with how Firebase Analytics is already handled in this app.

2. Privacy Policy Transparency
   The privacy policy could more explicitly disclose which personal data fields (name, email, gender, date of birth) are forwarded to the marketing platform and under which legal basis this processing occurs.

Security Enhancements

1. Relocate Private Service Keys to Server Side
   The private Woosmap location service key is embedded in the app where anyone can extract it. Routing location service requests through a McFIT-controlled backend proxy that holds the key securely on the server would remove this exposure from the distributed app entirely.

2. Validate Custom URL Scheme Handlers
   The custom URL scheme handler forwards incoming navigation requests to the main screen without checking their origin or structure. Adding an allowlist of permitted navigation destinations would prevent other apps on the same device from triggering unexpected in-app navigation flows.

Technical Context

App Type: Fitness membership management app with financial and contract data handling
Classes Analyzed: 13,437
Third-Party Services: 17
Context Tags: fitness, health, location, membership, financial, videos

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: RSG Group GmbH
Version: 1.16.6+66 (versionCode 66)
Analysis Date: 2026-04-13
Package: com.heroworkout.mamba.mcfitklub

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.16.6+66 analyzed on 2026-04-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors