CITT

    Scan results

    Virtuagym: Fitness & Workouts

    Android

    Virtuagym: Fitness & Workouts is an AI-powered fitness app with 5M+ downloads offering personalized workout plans, 5,000+ 3D exercises, video streaming, nutrition tracking, and mindfulness features for all fitness levels.

    CITT SCORE
    45
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Casual workout logging at a gym or studio

    Not For: Storing sensitive body metrics or health conditions

    What It Means For You

    In-app behavior and workout activity is monitored by analytics services including Amplitude, which builds a profile of how the app is used. Stored fitness history and account details may not be fully protected if the device is accessed without authorization. User data is not shared with outside advertisers.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    4 total
    2 Critical
    1 High
    1 Low

    Network Security

    1 total
    1 Low

    Code Security

    5 total
    1 Critical
    1 High
    2 Medium
    1 Low

    Privacy

    5 total
    4 High
    1 Medium

    Third-Party Services

    Firebase, Amplitude Analytics, Google Play Services, Brightcove Video Player, Nordic Semiconductor DFU, QingNiu Scale SDK

    Security Strengths

    • ✓HTTPS enforcement across all API endpoints
    • ✓Certificate Transparency validation implemented
    • ✓OAuth 2.0 with PKCE (correct mobile implementation)
    • ✓Android KeyStore integration for selective data
    • ✓Backup disabled (allowBackup=false)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    health
    fitness
    sensitive data
    social
    location
    camera
    bluetooth

    Package

    digifit.virtuagym.client.android

    Version

    12.0.4 (Build 4300847)

    Analysis Date

    Mar 5, 2026

    Classes Analyzed

    43,180

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (2 critical, 1 high, 1 low)

    Network Security - 1 finding (1 low)

    Code Safety - 0 findings

    Privacy - 5 findings (4 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    The app collects workout activity, fitness history, account information, and detailed records of in-app behavior. When fitness hardware such as a smart scale is connected, additional body measurement data is also gathered.

    Third-Party Data Sharing

    Usage data is shared with the following third-party services:

    • Amplitude Analytics - receives detailed records of in-app actions and builds a behavioral profile of how the app is used
    • Firebase - receives app performance and stability data
    • Google Play Services - used for authentication and core platform functions
    • Brightcove Video Player - handles in-app video content
    • Nordic Semiconductor DFU - supports firmware updates for connected fitness devices
    • QingNiu Scale SDK - integrates with connected smart scales

    User data is not shared with advertising networks or sold to third parties.

    Understanding the Scores

    CategoryScore
    Security42/100
    Privacy48/100
    Data Security35/100
    Network Security99/100
    Code Safety68/100
    Data Collection55/100
    Data Sharing100/100
    User Control87/100

    Data Security (35/100): Stored fitness data and account details may not be fully protected if the device is accessed without authorization.

    Network Security (99/100): Data moving between the app and its servers is well protected in transit.

    Code Safety (68/100): The app's internal code structure is reasonably sound, with some areas that could be strengthened.

    Data Collection (55/100): A moderate amount of data about user behavior and fitness activity is collected.

    Data Sharing (100/100): User personal data is not passed to advertisers or sold to outside companies.

    User Control (87/100): Users have strong options to manage data and account settings within the app.

    Positive Security Features

    • No notable positive security practices were identified in this version.

    Areas for Improvement

    • Stronger on-device data protection: Fitness history and account information should be stored with stronger safeguards so that it remains private even if someone gains physical access to the device.
    • Reduced collection of behavioral data: The level of in-app activity monitoring exceeds what is needed to deliver core fitness features, and reducing it would better respect user privacy.
    • Improved protection for connected device data: Data gathered from connected hardware such as smart scales deserves the same level of care as other personal health information.

    About This Analysis

    This scorecard reflects the state of the app at the time of the scan, based on analysis of its code and configuration.

    App Details

    • App Name: Virtuagym: Fitness & Workouts
    • Package ID: digifit.virtuagym.client.android
    • Version: 12.0.4 (Build 4300847)
    • Platform: Android
    • Scan Date: March 5, 2026

    Right of Reply

    Developer not yet contacted