NewForm: Recovery & Wellbeing Security & Privacy Scorecard
Android
Recovery activity, progress, and behavior patterns are shared with Facebook, TikTok, Braze, and Amplitude for advertising and behavioral analysis. Branch.io tracks how users were referred to the app and links that to their profile. In-app interactions are used to target users with ads across other platforms.
Best for
Recovery journeys with Facebook and TikTok accounts
Avoid if
You prefer not sharing health activity with ad networks
Findings
- 3 critical
- 6 high
- 5 medium
- 2 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Cleartext HTTP Traffic Allowed for Main Domain
- Unencrypted Recovery Conversations on Third-Party Servers
- Test API Keys in Production Build
Top privacy issues
- Amplitude Session Replay Captures Sensitive Recovery Content
- Sensitive Recovery Data Tracked Without Granular Consent
- Comprehensive User Profiling with PII
Full analysis
NewForm: Recovery & Wellbeing
App: NewForm: Recovery & Wellbeing
Package ID: the.phoenix.android
Version: 10.5.0
Scan Date: 2026-02-12
What This Means for You
Recovery activity, progress, and behavior patterns are shared with Facebook, TikTok, Braze, and Amplitude for advertising and behavioral analysis. Branch.io tracks how users were referred to the app and links that to their profile. In-app interactions are used to target users with ads across other platforms.
Recommendation: Use With Caution
Best For: Recovery journeys with Facebook and TikTok accounts
Avoid If: You prefer not sharing health activity with ad networks
Key Findings
Data Security - 3 findings (1 high, 2 medium)
Network Security - 2 findings (1 critical, 1 medium)
Code Safety - 0 findings
Privacy - 6 findings (2 critical, 4 medium)
Privacy Concerns
What Data is Collected
The app collects recovery activity, progress milestones, in-app behavioral patterns, device identifiers, and usage timing data.
Third-Party Data Sharing
User data is shared with the following third-party services:
- Facebook SDK - Receives behavioral and interaction data for ad targeting across Meta platforms
- TikTok SDK - Receives interaction data for ad targeting on TikTok
- Braze - Receives behavioral data for marketing automation and push notifications
- Amplitude - Receives detailed usage patterns for behavioral analysis
- Branch.io - Tracks how users discovered and installed the app, linked to their profile
- Firebase - App infrastructure and analytics
- GetStream Chat - In-app messaging
- Google Maps - Location-based features
- PubNub - Real-time messaging infrastructure
- Coil - Image loading
- Seon - Fraud detection
Understanding the Scores
| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 35/100 |
| Data Security | 55/100 |
| Network Security | 40/100 |
| Code Safety | 75/100 |
| Data Collection | 50/100 |
| Data Sharing | 40/100 |
| User Control | 55/100 |
Positive Security Features
- No notable positive security practices were identified for this version of the app.
Areas for Improvement
- Recovery and health activity is shared with advertising networks including Facebook and TikTok. Limiting this to analytics-only services would meaningfully reduce user exposure to behavioral profiling.
- The app's network communications have room to be strengthened, which would better protect user data as it moves between the device and remote servers.
- Users currently have limited ability to opt out of data collection by advertising partners. Clearer controls over what is shared with ad networks would give users more agency over their personal information.
About This Analysis
This scorecard reflects security and privacy practices observed in the app's code and configuration at the time of the scan.
App Details
| Field | Value |
|---|---|
| App Name | NewForm: Recovery & Wellbeing |
| Package ID | the.phoenix.android |
| Version | 10.5.0 |
| Scan Date | 2026-02-12 |
| Platform | Android |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 40/100 |