Fiytt: Workouts & Nutrition Security & Privacy Scorecard
by SAFitware Technologies LLP · iOS
Usage activity is collected by Firebase Analytics and shared with Google Ads for targeted advertising. Google Sign-In is used for authentication, meaning the user's Google account activity is tied to app usage. Users have limited control over what data is retained or deleted.
Best for
Personal logbook keeping with cloud sync
Avoid if
You prefer apps without ad tracking
Findings
- 1 critical
- 2 high
- 4 medium
- 5 low
- 3 info
1 issue identified across security and privacy analysis.
Top security issues
- Secrets.xcconfig File Shipped in Production Build
- AI API Gateway Key Classification Unknown
- Multiple Firebase Environment Configs in Production
Top privacy issues
- Missing App Tracking Transparency (ATT) Implementation
- Pre-Consent Analytics Collection (Firebase + Google Sign-In)
- LBAIChat Privacy Claim Contradiction
Full analysis
Version: 2.0.0 (Build 2)
Scan Date: March 28, 2026
What This Means for You
Usage activity is collected by Firebase Analytics and shared with Google Ads for targeted advertising. Google Sign-In is used for authentication, meaning the user's Google account activity is tied to app usage. Users have limited control over what data is retained or deleted.
Recommendation: Use With Caution
Best For: Personal logbook keeping with cloud sync
Avoid If: You prefer apps without ad tracking
Key Findings
Data Security - 0 findings
Network Security - 1 finding (1 low)
Code Safety - 0 findings
Privacy - 5 findings (2 high, 2 medium, 1 low)
Privacy Concerns
What Data is Collected
In-app activity and interaction patterns are collected through Firebase Analytics. Google account identity and profile details are collected through Google Sign-In. Purchase history and subscription status are collected through RevenueCat.
Third-Party Data Sharing
Data is shared with the following third-party services:
- Google (Firebase Analytics, Google Ads): In-app activity is shared with Google and used to serve targeted advertising.
- RevenueCat: Subscription and purchase data is shared to manage billing and in-app purchases.
- LBAIChat: Interaction data may be shared with this AI chat service.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 68/100 |
| Privacy | 43/100 |
| Data Security | 100/100 |
| Network Security | 94/100 |
| Code Safety | 62/100 |
| Data Collection | 53/100 |
| Data Sharing | 100/100 |
| User Control | 53/100 |
Positive Security Features
- No notable positive security features were identified in this version of the app.
Areas for Improvement
- Activity data is used for targeted advertising through Google Ads. Users who are not comfortable with behavioral profiling for ads may find this app does not align with their privacy expectations.
- The app provides limited options for users to control, export, or delete personal data after it has been collected.
- The code safety score indicates room to improve how the app handles sensitive operations, which could affect how reliably user data is protected on the device.
About This Analysis
This scorecard is based on automated static analysis of the app's code and configuration. It reflects the security and privacy practices observed in the version analyzed and is intended to help users make an informed decision about installing this app.
App Details
- App ID: com.safitware.Logbook.prd
- Version: 2.0.0 (Build 2)
- Scan Date: March 28, 2026
- Developer: Not provided
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 50/100 |