Spark Mail: AI Email, Calendar Security & Privacy Scorecard

Android

76
Overall trust score
Acceptable
73
Security
79
Privacy

Email usage patterns, including how often users open the app and which features they tap, are shared with multiple analytics and marketing platforms such as AppsFlyer, Amplitude, and Braze. Some data in transit may travel with less protection than expected. Actual email content stays in user accounts, but behavioral data flows to several third-party advertising services.

Best for

Getting a smarter inbox across multiple accounts

Avoid if

You want email habits kept from marketing analytics

Findings

  • 1 critical
  • 2 high
  • 5 medium
  • 5 low
  • 0 info

1 issue identified across security and privacy analysis.

Top security issues

  • Cleartext HTTP Traffic Globally Enabled
  • DeepLinkActivity Accepts Arbitrary External Data Without Validation
  • Hardcoded Initialization Vector in Legacy Keystore

Top privacy issues

  • Pre-Consent Analytics and Marketing SDK Initialization
  • User Billing Data Sent to AppsFlyer with User IDs
  • Advertising Identifier Collection Without Consent

Full analysis

Spark Mail: AI Email, Calendar

com.readdle.spark | Version 3.16.5 | Scanned March 11, 2026

What This Means for You

Email usage patterns, including how often users open the app and which features they tap, are shared with multiple analytics and marketing platforms such as AppsFlyer, Amplitude, and Braze. Some data in transit may travel with less protection than expected. Actual email content stays in user accounts, but behavioral data flows to several third-party advertising services.

Recommendation: Use With Caution

Best For: Getting a smarter inbox across multiple accounts

Avoid If: Users want email habits kept from marketing analytics

Key Findings

Data Security - 3 findings (2 medium, 1 low)

Network Security - 2 findings (1 critical, 1 low)

Code Safety - 0 findings

Privacy - 3 findings (1 high, 2 medium)

Privacy Concerns

What Data is Collected

The app collects behavioral and usage data including how often users open the app, which features they interact with, and in-app activity patterns. This builds a profile of user email habits and usage behavior over time.

Third-Party Data Sharing

Usage data is shared with multiple third-party platforms:

  • AppsFlyer - Mobile attribution and marketing analytics
  • Amplitude - Product analytics and behavioral tracking
  • Braze - Customer engagement and marketing automation
  • Firebase Analytics - Usage and engagement tracking
  • Google Ads Identifier - Advertising targeting

Additional integrated services include Firebase Crashlytics, Firebase Messaging, Firebase Remote Config, Firebase Performance, RevenueCat, Stripe, Google Play Billing, ML Kit Document Scanner, and Google Play Services Auth.

Understanding the Scores

Category Score
Security 73/100
Privacy 79/100
Data Security 93/100
Network Security 76/100
Code Safety 88/100
Data Collection 82/100
Data Sharing 95/100
User Control 84/100

Positive Security Features

  • Third-party data sharing is contained to a defined set of named services, with no indication of broad or uncontrolled data distribution beyond those listed.
  • Payment processing is handled through established providers (Stripe, Google Play Billing), keeping direct financial data handling outside the app's own code.
  • Code safety practices score strongly, reflecting disciplined handling of code-level risks throughout the app.

Areas for Improvement

  • Some data exchanged between the app and remote servers travels with less protection than expected. This is the most pressing issue to address.
  • Behavioral and usage data flows to several marketing and analytics platforms. Clearer in-app controls to limit or opt out of this sharing would meaningfully improve user privacy.
  • Usage patterns are tied to advertising identifiers, enabling cross-app behavioral profiling. An opt-out for marketing-related data collection would give users more direct control over how their habits are used.

About This Analysis

This scorecard reflects automated static analysis of the app's code and configuration at the time of the scan. Scores represent observed security and privacy practices.

App Details

  • App: Spark Mail: AI Email, Calendar
  • Package: com.readdle.spark
  • Version: 3.16.5 (31605253)
  • Platform: Android
  • Scan Date: March 11, 2026

Versions & scan history

ScanDateOverall score
#1 (current) 76/100