CITT

    Scan results

    NewForm: Recovery & Wellbeing

    Android

    NewForm is a free recovery support app connecting users to sober communities, events, and support groups. Join nearly 500,000 people exploring recovery with peer support, virtual meetups, fitness events, and resources from trusted organizations.

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Recovery journeys with Facebook and TikTok accounts

    Not For: You prefer not sharing health activity with ad networks

    What It Means For You

    Recovery activity, progress, and behavior patterns are shared with Facebook, TikTok, Braze, and Amplitude for advertising and behavioral analysis. Branch.io tracks how users were referred to the app and links that to their profile. In-app interactions are used to target users with ads across other platforms.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    3 total
    1 High
    2 Medium

    Network Security

    2 total
    1 Critical
    1 Medium

    Code Security

    3 total
    2 High
    1 Low

    Privacy

    6 total
    2 Critical
    4 Medium

    Permission Usage

    1 total
    1 Low

    Third-Party Services

    GetStream Chat, Amplitude, Braze, Firebase, Seon, Branch.io, Facebook SDK, TikTok SDK, Google Maps, PubNub, Coil

    Security Strengths

    • ✓AES-256-GCM token encryption with hardware-backed Android KeyStore
    • ✓Code obfuscation with ProGuard/R8
    • ✓Root detection and device integrity checking
    • ✓WebView file access disabled
    • ✓Android backup disabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    health
    sensitive data
    social
    location
    recovery
    substance use

    Package

    the.phoenix.android

    Version

    10.5.0

    Analysis Date

    Feb 12, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (1 high, 2 medium)

    Network Security - 2 findings (1 critical, 1 medium)

    Code Safety - 0 findings

    Privacy - 6 findings (2 critical, 4 medium)

    Privacy Concerns

    What Data is Collected

    The app collects recovery activity, progress milestones, in-app behavioral patterns, device identifiers, and usage timing data.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Facebook SDK - Receives behavioral and interaction data for ad targeting across Meta platforms
    • TikTok SDK - Receives interaction data for ad targeting on TikTok
    • Braze - Receives behavioral data for marketing automation and push notifications
    • Amplitude - Receives detailed usage patterns for behavioral analysis
    • Branch.io - Tracks how users discovered and installed the app, linked to their profile
    • Firebase - App infrastructure and analytics
    • GetStream Chat - In-app messaging
    • Google Maps - Location-based features
    • PubNub - Real-time messaging infrastructure
    • Coil - Image loading
    • Seon - Fraud detection

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy35/100
    Data Security55/100
    Network Security40/100
    Code Safety75/100
    Data Collection50/100
    Data Sharing40/100
    User Control55/100

    Positive Security Features

    • No notable positive security practices were identified for this version of the app.

    Areas for Improvement

    • Recovery and health activity is shared with advertising networks including Facebook and TikTok. Limiting this to analytics-only services would meaningfully reduce user exposure to behavioral profiling.
    • The app's network communications have room to be strengthened, which would better protect user data as it moves between the device and remote servers.
    • Users currently have limited ability to opt out of data collection by advertising partners. Clearer controls over what is shared with ad networks would give users more agency over their personal information.

    About This Analysis

    This scorecard reflects security and privacy practices observed in the app's code and configuration at the time of the scan.

    App Details

    FieldValue
    App NameNewForm: Recovery & Wellbeing
    Package IDthe.phoenix.android
    Version10.5.0
    Scan Date2026-02-12
    PlatformAndroid

    Right of Reply

    Developer not yet contacted