Cal AI - Calorie Tracker Security & Privacy Scorecard

by Viral Development LLC · iOS

63
Overall trust score
Use With Caution
90
Security
52
Privacy

Food logs and in-app activity are shared with Facebook and multiple ad-tracking companies including AppsFlyer. A session replay tool records taps and interactions inside the app and sends them to an analytics service. User behavior is used to target ads across other apps and platforms.

Best for

Tracking daily calories without complex setup

Avoid if

Users who prefer in-app interactions not recorded

Findings

  • 0 critical
  • 2 high
  • 5 medium
  • 5 low
  • 8 info

1 issue identified across security and privacy analysis.

Top security issues

  • CoreData health database stored without application-layer encryption or NSFileProtectionComplete — full dietary history, body weight, body scans readable after first device unlock
  • Orphaned Adjust universal link entitlement (jndd.adj.st) — third-party-controlled domain can route universal links into the app with no SDK to validate parameters
  • Staging and development API endpoints compiled into production binary including a Render hash-subdomain that could be claimed if decommissioned

Top privacy issues

  • Session replay SDK (MixpanelSessionReplay) actively recording health app screens linked to user identity with no evidence of health-field masking
  • Misleading ATT prompt describes advertising tracking (AppsFlyer, Facebook IDFA, Google Ads) as 'product and feature analysis' — users cannot make informed consent decisions
  • Customer.io CRM receives meal progress, badge, and streak behavioral events tied to user identity with no user disclosure or opt-out mechanism

Full analysis

What This Means for You

Food logs and in-app activity are shared with Facebook and multiple ad-tracking companies including AppsFlyer. A session replay tool records taps and interactions inside the app and sends them to an analytics service. User behavior is used to target ads across other apps and platforms.

Recommendation: Use With Caution

Best For: Tracking daily calories without complex setup

Avoid If: Users who prefer in-app interactions not recorded

Key Findings

Data Security - 5 findings (1 medium, 1 low, 3 info)

Network Security - 1 finding (1 info)

Code Safety - 0 findings

Privacy - 8 findings (2 high, 1 medium, 2 low, 3 info)

Privacy Concerns

What Data is Collected

The app collects food logs, calorie entries, and in-app usage behavior. Taps and screen interactions are recorded by a session replay service and sent to an external analytics platform.

Third-Party Data Sharing

Data is shared with the following third-party services:

  • Facebook - receives behavioral data used for advertising
  • AppsFlyer - tracks user actions for ad attribution across apps
  • Mixpanel / MixpanelSessionReplay - analytics and session replay of in-app interactions
  • Customer.io - user messaging and engagement tracking
  • Google Ads - on-device ad conversion measurement
  • Firebase (Analytics, Crashlytics, Remote Config, Cloud Messaging) - app telemetry and performance monitoring
  • Superwall - paywall and subscription behavior analytics

Understanding the Scores

Category Score
Security 90/100
Privacy 52/100
Data Security 50/100
Network Security 100/100
Code Safety 92/100
Data Collection 65/100
Data Sharing 80/100
User Control 73/100

Positive Security Features

  • All network communications travel over secure, encrypted connections.
  • The app demonstrates strong code safety practices throughout its codebase.

Areas for Improvement

  • In-app behavior is shared with multiple advertising and analytics companies, giving users limited control over how that data is used across other apps and platforms.
  • A session replay service captures taps and screen interactions within the app, going beyond standard usage analytics.
  • Reducing the number of advertising and tracking services the app connects to would better protect user behavioral data.

About This Analysis

App Details

Field Value
Package com.viraldevelopment.CalAI
Version 3.3.0 (Build 1692)
Scan Date 2026-04-06

Versions & scan history

ScanDateOverall score
#1 (current) 63/100