Scan results

Recommendation: Trustworthy

Privacy-focused screen-time app with strong encryption, zero ad tracking, privacy-preserving analytics, and on-device HealthKit data processing. Recommended for users prioritizing digital wellness without external surveillance.

Key Findings

Data Security - 4 findings (2 low, 2 info)

Network Security - 4 findings (4 info)

Code Safety - 4 findings (2 medium, 1 low, 1 info)

Privacy - 8 findings (1 medium, 1 low, 6 info)

Privacy Concerns

What Data is Collected

• Health and mindfulness data: accessed on your device from Apple Health and never transmitted to external servers
• Browsing patterns: the Safari extension processes which websites you visit for blocking decisions; URL paths including page addresses are stored locally and synced to your iCloud account
• Device identifier: a device identifier may be sent to the developer's API during background accountability features
• Anonymous usage data: non-identifying interaction patterns sent to TelemetryDeck (no personal data, no advertising identifiers)
• Crash diagnostics: performance and crash data sent to Sentry, hosted in Germany

Third-Party Data Sharing

The following third parties may receive your data:

• TelemetryDeck - privacy-preserving usage analytics (anonymized identifiers, no personal data, GDPR-compliant)
• Sentry (EU, Germany) - crash reports and performance diagnostics for app stability

Understanding the Scores

Security: 90/100
Privacy: 89/100

Security Breakdown

• Data Security: 95/100 - Sensitive data is protected with strong, industry-standard encryption and appropriate on-device storage controls throughout the app.
• Network Security: 99/100 - All external connections use HTTPS with no exceptions, and secure server trust validation is enforced for communications with external services.
• Code Safety: 88/100 - Solid overall code foundations with two moderate concerns around hardcoded backend automation service credentials and broad Safari extension page permissions.

Privacy Breakdown

• Data Collection: 91/100 - Analytics are handled through a privacy-preserving platform with no advertising identifiers and no personal data leaving your device.
• Data Sharing: 100/100 - No user data is shared with advertisers, marketing platforms, or data brokers.
• User Control: 94/100 - Users retain full control over health data access and iCloud sync through standard iOS privacy settings.

Positive Security Features

• All external network connections use HTTPS with no exceptions or insecure fallbacks
• Secure server trust validation is implemented for external API communications, strengthening protection against network-based interception
• Strong authenticated encryption is used throughout the app with no weak or outdated algorithms
• Keychain storage uses appropriate access controls, including device-only protection variants for the most sensitive items
• Privacy-preserving analytics via TelemetryDeck: no advertising identifiers, no personal data, GDPR-compliant by design
• Crash monitoring uses Sentry with EU data residency in Germany, aligned with GDPR requirements
• No advertising SDKs, no tracking identifiers, and no ad networks anywhere in the app
• Privacy manifest fully compliant with all required Apple API usage declarations correctly in place
• HealthKit data is accessed on your device only with no evidence of transmission to any external server

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Safari Extension URL Scope
   The Safari extension transmits complete website addresses including page paths and query details to the main app during blocking decisions. Limiting this to just the website domain would reduce the amount of browsing history stored locally and synced via iCloud, particularly for sensitive sites like banking or healthcare portals.

2. Device Identifier Placement in Requests
   A device identifier appears to be included in URL parameters when the app contacts the developer's API for accountability features. Passing this identifier in request headers rather than URL parameters would prevent it from appearing in server access logs.

Security Enhancements

1. Backend Automation Service Access
   Automation service access codes for Make.com and Integromat integrations are embedded in the app binary and could be extracted by anyone examining the app. Moving these through a server-side proxy would protect the developer's automation workflows from unauthorized triggering.

2. iCloud Data Visibility in Files App
   App data stored in iCloud is configured to be browsable through the iOS Files app by anyone with physical access to the device. Restricting the iCloud container to private document scope would keep wellness and screen-time data out of the Files app.

Technical Context

App Type: Screen-time and digital wellness (health-sensitive)
Classes Analyzed: 0 (symbol-level iOS static analysis)
Third-Party Services: 12 identified
Context Tags: health, sensitive_data, safari-extension

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Riedel
Version: 5.2.6 (Build 1654)
Analysis Date: 2026-06-17
Package: wtf.riedel.one-sec

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 5.2.6 (Build 1654) analyzed on 2026-06-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors