CITT

    Scan results

    Quitty: Quit Zyn & Snus

    iOS

    Quitty is a health and wellness app that helps users manage smoking cessation with built-in health tracking features.

    CITT SCORE
    80
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Tracking habits with minimal privacy trade-offs

    What It Means For You

    Usage patterns and in-app behavior are collected by analytics services including PostHog and Amplitude. Purchases are handled through RevenueCat, and push notifications are managed by OneSignal. Users have limited control over what data is collected, but nothing is shared with advertising networks.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (5)

    Data Security

    1 total
    1 Medium

    Privacy

    4 total
    3 Medium
    1 Low

    Third-Party Services

    Firebase, RevenueCat, PostHog, Amplitude, OneSignal, WishKit, Alamofire, Lottie, GRDB

    Security Strengths

    • ✓100% HTTPS enforcement across all API endpoints
    • ✓Proper SSL/TLS certificate validation
    • ✓Hardware-backed Keychain encryption for credentials
    • ✓HealthKit data remains local (never transmitted)
    • ✓Firebase Analytics disabled
    • ✓No advertising SDKs or IDFA collection
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    health
    sensitive data
    analytics
    third party tracking

    Package

    victor.dev.quittyapp

    Version

    1.20.0 (Build 72)

    Analysis Date

    Mar 28, 2026

    Classes Analyzed

    78,287

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on App Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 1 finding (1 medium)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 4 findings (3 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    In-app behavior, session patterns, and habit tracking activity are collected by PostHog and Amplitude for analytics purposes. Purchase history and subscription status are processed through RevenueCat to manage the user's account. Push notification interactions are tracked through OneSignal. Feature requests and feedback submitted by users may be collected through WishKit.

    Third-Party Data Sharing

    Behavioral and usage data is shared with PostHog and Amplitude. Subscription and purchase data is shared with RevenueCat. Notification interaction data is shared with OneSignal. Data sharing is limited to these functional service providers, with no advertising or marketing networks receiving user data.

    Understanding the Scores

    CategoryScore
    Security98/100
    Privacy72/100
    Data Security93/100
    Network Security100/100
    Code Safety100/100
    Data Collection82/100
    Data Sharing85/100
    User Control40/100

    Positive Security Features

    • All communications with third-party services use secure, up-to-date network protocols
    • The codebase consistently applies safe data handling patterns throughout
    • Purchases are processed through RevenueCat, a dedicated payment platform, rather than custom-built payment handling

    Areas for Improvement

    • Users have limited ability to opt out of behavioral data collection. There are no clear in-app controls to restrict what PostHog and Amplitude collect about user habits and activity.
    • The app integrates multiple overlapping analytics services, which increases the total volume of data collected about daily usage patterns.
    • Greater transparency around data retention periods and account deletion options would give users more meaningful control over personal information held by third-party services.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect the app's technical implementation as of the scan date.

    App Details

    • App: victor.dev.quittyapp
    • Package ID: victor.dev.quittyapp
    • Version: 1.20.0 (Build 72)
    • Scan Date: 2026-03-28

    Right of Reply

    Developer not yet contacted