Scan results

Recommendation: Solid

WHOOP delivers solid health tracking with strong network security, keeping all communications encrypted and restricting browser-based authentication to WHOOP-owned domains. Sign-in data and health records stored locally on the device rely on operating system-level protection rather than an additional app-level encryption layer, and analytics services are initialized before users can review privacy settings. For most fitness and health tracking use cases, the app's data handling is responsible where it matters most.

Key Findings

Data Security: 1 finding (1 low)

Network Security: 2 findings (1 medium, 1 low)

Code Safety: 2 findings (1 medium, 1 low)

Privacy: 2 findings (2 low)

Privacy Concerns

What Leaves the Device

• Usage and behavioral analytics: sent to Amplitude and Firebase for product improvement and performance monitoring
• Email address: sent to Iterable for marketing and communications before explicit opt-in consent
• Crash reports with app navigation history: sent to Sentry, linked to the user's WHOOP account identifier rather than an anonymous session ID
• Community and team messages: processed and stored by Stream (getstream.io) as the messaging infrastructure
• Google Advertising ID: may be associated with health app usage and shared with advertising platforms

What Stays on the Device

Biometric health values including heart rate, heart rate variability, sleep stages, blood oxygen, respiratory rate, and reproductive health data sync to WHOOP's own servers but are not shared with advertising, analytics, or marketing partners. GPS workout routes are similarly kept within WHOOP's own infrastructure. Health-sensitive data does not flow to third-party companies.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Amplitude Analytics - usage and behavioral analytics
• Firebase (Google) - push notifications and analytics infrastructure
• Sentry - crash reporting, linked to the WHOOP account identifier
• Stream (getstream.io) - community and team messaging platform
• Iterable - email marketing and communications
• Stripe - payment processing
• Google Play Services - platform authentication and device services
• Mapbox - mapping display for workout data visualization

Understanding the Scores

Security: 77/100
Privacy: 82/100

Security Breakdown

• Data Security: 48/100. Sign-in data and health records stored on the device are protected primarily by the device's screen lock, without an additional encryption layer specific to the app's sensitive data. This is the main area pulling the overall security score down.
• Network Security: 87/100. All network communications use encrypted HTTPS with no unencrypted fallback. Sign-in data travels as request headers rather than URL parameters, and browser-based authentication is restricted to an allowlist of WHOOP-owned domains.
• Code Safety: 84/100. The codebase applies solid security practices throughout. An internal developer settings screen is compiled into the production build but is hidden from the standard user interface.

Privacy Breakdown

• Data Collection: 85/100. The app limits what sensitive health data flows to third parties. Analytics and marketing services receive behavioral information, and some of these services initialize before users can review privacy settings.
• Data Sharing: 86/100. Biometric health values, sleep data, and workout routes are not shared with advertising or analytics partners. Data sharing with third parties is focused on operational services such as payments, crash reporting, and messaging.
• User Control: 84/100. Data deletion is supported. Some analytics and marketing services initialize before explicit user consent is obtained, reducing the degree of upfront user control over those data flows.

Positive Security Features

• All network traffic uses encrypted HTTPS with no unencrypted fallback, and sign-in data is sent as request headers rather than URL parameters
• Cloud backup is disabled, preventing bulk extraction of health data through Android's backup system
• Biometric health values including heart rate, HRV, sleep stages, reproductive data, and blood oxygen levels are not shared with any third-party analytics or advertising service
• GPS workout routes are kept within WHOOP's own infrastructure and not transmitted to any mapping or analytics partner
• Browser-based authentication is restricted to WHOOP-owned domains, preventing sign-in data from reaching unintended destinations

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Pre-consent Analytics Initialization
   Analytics and marketing services could be deferred until users have reviewed and accepted the privacy policy, giving users meaningful choice before any behavioral data is sent off-device.

2. Email Marketing Consent Gating
   The marketing email platform receives email addresses during account setup. Requiring explicit opt-in consent before sharing contact information with the marketing service would align with GDPR and CCPA requirements.

3. Advertising Identifier Use in Health Context
   The Google Advertising ID is associated with health app usage. Given the sensitive nature of health data, limiting or opting out of advertising identifier use would reduce the potential for health-context behavioral profiling.

Security Enhancements

1. Local Data Encryption
   Sign-in data and health records stored on the device could be moved to Android's encrypted storage, adding a protection layer that operates independently of the device screen lock.

2. File Sharing Scope Reduction
   The file sharing configuration exposes broad sections of internal storage. Narrowing these paths to folders specifically intended for sharing would reduce exposure if a sharing URI were inadvertently granted to another app.

3. Sign-In Callback Broadcast Protection
   Sign-in callback data is forwarded via a broadcast that any installed app can receive. Restricting the broadcast with a declared permission or using a local broadcast mechanism would limit receipt to WHOOP's own components.

Technical Context

App Type: Health and fitness wearable companion app; handles biometric, financial, and location data
Third-Party Services: 10+ service providers identified
Context Tags: health, fitness, biometric, location, financial, sensitive data, wearable

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Whoop, Inc.
Version: 5.445.0
Analysis Date: 2026-07-30
Package: com.whoop.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 5.445.0 analyzed on 2026-07-30
• May not reflect server-side security controls
• Cannot detect all runtime behaviors