CITT

    Scan results

    Barry's

    Android

    The official app of Barry's Bootcamp fitness classes. Book classes, view studio locations and schedules, manage reservations, purchase classes, order shakes, and manage your account. High-intensity workout classes designed to burn up to 1,000 calories per session.

    CITT SCORE
    38
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Barry's regulars comfortable with behavioral analytics

    What It Means For You

    In-app behavior and usage patterns are tracked by Mixpanel and shared with third parties. Payment processing goes through Stripe, which handles user card details. Account activity and session data are collected to personalize the user experience, and users have limited control over how that data is used or deleted.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (18)

    Data Security

    6 total
    1 Critical
    1 High
    2 Medium
    2 Low

    Code Security

    5 total
    2 High
    3 Medium

    Privacy

    6 total
    1 Critical
    3 High
    1 Medium
    1 Low

    Permission Usage

    1 total
    1 Low

    Third-Party Services

    Stripe, Mixpanel, Coralogix RUM, ConfigCat, Google Play Services, Google Maps, Google Pay, Google Identity, AppAuth

    Security Strengths

    • ✓PCI-DSS compliant payment processing via Stripe SDK
    • ✓Zero WebView JavaScript interfaces (no RCE vectors)
    • ✓No SQL injection or command injection vulnerabilities
    • ✓Modern Android architecture with MVVM and Room
    • ✓OAuth 2.0 with PKCE for authentication
    • ✓Target SDK 35 (Android 15) with latest security features
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    health
    location
    sensitive data
    fitness
    payments

    Package

    com.marianatek.barrysbootcamp

    Version

    1.43.3 (Build 1433)

    Analysis Date

    Feb 12, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (1 critical, 1 high, 2 medium, 2 low)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 6 findings (1 critical, 3 high, 1 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    • Account information and session data used to manage bookings and membership
    • Behavioral and usage patterns captured through Mixpanel analytics
    • Payment card details processed by Stripe
    • Location data accessed through Google Maps
    • Device and diagnostic data collected by Coralogix RUM

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Stripe - Handles user payment card details for class bookings
    • Mixpanel - Receives in-app behavior and usage patterns
    • Coralogix RUM - Collects real-time diagnostic and session data
    • ConfigCat - Manages feature availability and app configuration
    • Google Play Services - Core platform services
    • Google Maps - Location and mapping features
    • Google Pay - Alternative payment processing
    • Google Identity - Manages sign-in and authentication
    • AppAuth - Handles authorization flows

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy30/100
    Data Security40/100
    Network Security100/100
    Code Safety55/100
    Data Collection35/100
    Data Sharing40/100
    User Control25/100

    Positive Security Features

    • No notable positive security features were identified in this version of the app.

    Areas for Improvement

    • Limit the behavioral data passed to analytics services so usage patterns are not shared with multiple third parties without explicit, informed consent.
    • Improve user ability to request deletion of account activity and session history, as user control over personal data is currently limited.
    • Reduce the number of third-party services that receive access to user data, particularly those involved in behavioral profiling.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. It reflects the app's data handling practices, security implementation, and privacy posture at the time of the scan.

    App Details

    • App Name: Barry's
    • Package ID: com.marianatek.barrysbootcamp
    • Version: 1.43.3 (Build 1433)
    • Scan Date: 2026-02-12
    • Platform: Android

    Right of Reply

    Developer not yet contacted