Opal: Screen Time Control Security & Privacy Scorecard

Opal - Focus & Screen Time

What This Means for You

Your app usage events, including focus sessions and in-app purchase activity, are shared with advertising and analytics platforms such as Facebook and Amplitude, and some of this sharing may occur even if you decline ad tracking permission.

Recommendation: Trustworthy

Opal is a secure, well-built focus app with robust data protections. It shares usage data with analytics and advertising platforms, standard for productivity apps and suitable for users seeking screen-time management.

Best For: Users who want a screen-time focus app and are comfortable sharing usage data with analytics and advertising networks

Key Findings

Data Security - 2 findings (1 low, 1 info)

Network Security - 0 findings

Code Safety - 3 findings (2 low, 1 info)

Privacy - 5 findings (2 medium, 1 low, 2 info)

Privacy Concerns

What Data is Collected

• Account information: Account details such as your email address are shared with authentication and backend services
• Device identifier: Your advertising identifier (IDFA) may be shared with Facebook and attribution networks if tracking permission is granted
• Usage data: App usage events, focus session activity, and in-app purchase interactions are shared with analytics platforms including Amplitude and Firebase
• Health data: Physical activity and health metrics accessed from Apple Health are processed on your device and stay on your device
• Location: Approximate location may be inferred from your public IP address via a third-party geolocation service, even if you have denied location permission

Third-Party Data Sharing

The following third parties may receive your data:

• Facebook (Meta) - advertising measurement and app event analytics
• Amplitude - usage analytics and session data
• Adjust - attribution and campaign measurement
• Google (Firebase Analytics, Google App Measurement) - analytics and crash reporting
• ContextSDK - physical activity and behavioral context classification
• OneSignal - push notification delivery
• RevenueCat - subscription and purchase management
• Superwall - paywall optimization

Understanding the Scores

Security: 96/100
Privacy: 84/100

Security Breakdown

• Data Security: 97/100 - Sensitive information is stored securely, with strong protections applied to keychain items across the app.
• Network Security: 100/100 - All connections use secure HTTPS, with no insecure communication paths detected.
• Code Safety: 97/100 - The app is well-built and relies on established, secure system frameworks throughout.

Privacy Breakdown

• Data Collection: 86/100 - The app collects a moderate range of usage and account data to power its features, while health and location data are accessed on your device.
• Data Sharing: 90/100 - Usage data is shared with a standard set of analytics and advertising partners common to productivity apps.
• User Control: 83/100 - The app includes Apple's tracking permission prompt for ad identifier access, though some analytics events may be sent before you make a consent choice.

Positive Security Features

• All network connections use secure HTTPS encryption
• Firebase App Check is enforced, verifying that only legitimate copies of the app can reach backend services
• Google reCAPTCHA Enterprise is used to protect logins against bots and fraud
• Apple's privacy tracking permission prompt (ATT) is present, giving you control over advertising identifier access
• Most sensitive data stored on-device uses strict keychain protection, accessible only when the device is unlocked
• 49 privacy-preserving ad attribution networks are registered, reducing reliance on direct user tracking

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Updating the App Store Privacy Label
   The privacy nutrition label does not currently list health data or location data among its declared data types. If either data type is transmitted to the app's backend or analytics services, adding them to the label would align it with App Store guidelines and GDPR/CCPA disclosure requirements.

2. Facebook Auto-Event Transparency
   Facebook's SDK is configured to automatically send app events regardless of the user's ad tracking decision. Disabling auto-logging until the user grants tracking permission would better respect user consent choices.

3. Behavioral Profiling Disclosure
   An embedded third-party framework classifies users into physical activity states (walking, running, in transit, and similar) using device motion sensors. Disclosing this SDK and its data use in the privacy nutrition label would give users a clearer picture of how their context is analyzed.

Security Enhancements

1. Remove Staging Configuration From Production Build
   Internal staging server addresses are compiled into the production binary alongside a runtime flag that selects the environment. Separating production and staging configurations at build time is a standard hardening step.

2. Review Keychain Protection Settings
   One group of keychain items is configured to remain readable even when the device is locked. Upgrading these items to a stricter protection class would further limit exposure on a physically compromised device.

Technical Context

App Type: Productivity / Screen Time Management, moderate sensitivity (health data, usage patterns)
Classes Analyzed: 0 (iOS binary analysis)
Third-Party Services: 18 identified
Context Tags: health, location, productivity, subscription, ads, analytics, sensitive_data

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Opal
Version: 4.1 (build 0612165642)
Analysis Date: 2026-06-17
Package: com.withopal.opal

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 4.1 (build 0612165642) analyzed on 2026-06-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors