# Security & Privacy Scorecard

## Calorie Ai

## What This Means for You

Your food photos and meal descriptions are sent to OpenAI for AI analysis, and three advertising companies (AppsFlyer, TikTok, and Facebook) collect behavioral data tied to your health and diet activity.

## Recommendation: Use With Caution

Food images are transmitted to OpenAI for analysis, and the app uses multiple ad-tracking SDKs. Not recommended for privacy-conscious users or those tracking medically sensitive dietary patterns.

**Best For:** Casual users who want AI-powered calorie tracking and are comfortable with ad-supported apps

## Key Findings

**Data Security** - 2 findings (2 medium)

**Network Security** - 0 findings

**Code Safety** - 1 finding (1 low)

**Privacy** - 2 findings (1 medium, 1 info)

## Privacy Concerns

### What Data is Collected

- Personal information: account details, user profile
- Health and biometric data: meal entries, calorie goals, weight history, heart rate, steps, active energy
- Device information: device identifier, advertising identifier
- Usage data: app interactions, meal logging patterns, exercise frequency
- Food photos and descriptions: transmitted to OpenAI for calorie analysis

### Third-Party Data Sharing

**The following third parties may receive your data:**

- AppsFlyer - advertising attribution and user tracking
- TikTok Business SDK - advertising attribution and behavioral analytics
- Facebook SDK - advertising attribution
- Firebase (Google) - backend services including analytics and crash reporting
- RevenueCat - subscription management and purchase attribution
- OpenAI - AI-powered food and calorie analysis

## Understanding the Scores

**Security:** 91/100
**Privacy:** 84/100

### Security Breakdown

- **Data Security:** 87/100 - Health and dietary data stored with standard device protection; food images transmitted to a third-party AI service
- **Network Security:** 100/100 - All communication secured in transit with no exceptions
- **Code Safety:** 95/100 - Sound coding practices throughout with a minor access control gap in one interaction handler

### Privacy Breakdown

- **Data Collection:** 90/100 - Collects health and biometric data with appropriate system permission prompts
- **Data Sharing:** 88/100 - Food photos sent to OpenAI; behavioral data shared with three ad-tech companies
- **User Control:** 93/100 - App Tracking Transparency prompt gives you control over ad tracking before it begins

## Positive Security Features

- All data sent between the app and servers is protected in transit, with no exceptions to secure communication requirements
- Saved account details are stored with device-bound protection and cannot sync to other devices
- You are asked for permission before any advertising tracking begins
- Modern, industry-standard methods are used for cryptographic operations within the app
- The AI service access code is not permanently embedded in the app binary, reducing one specific class of risk

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Clearer Disclosure for AI Food Analysis**
   Users should be explicitly informed during onboarding that food photos and meal descriptions are transmitted to OpenAI, and given a clear option to opt out of this feature.

2. **Reduced Ad-Tech Footprint**
   Running three simultaneous advertising attribution services in a health-category app with access to biometric data exceeds industry norms and could be reduced to a single analytics provider.

### Security Enhancements

1. **Stronger Local Data Protection**
   Meal entries, weight history, and calorie data stored on device could use the highest available protection level so the database remains protected even after the device has been unlocked once since boot.

2. **Interaction Handler Validation**
   Handlers that respond to signals from other apps on the same device should verify the source before processing parameters, reducing the potential for manipulation.

## Technical Context

**App Type:** Health and nutrition tracker with AI food recognition and HealthKit integration
**Classes Analyzed:** iOS binary (native Swift)
**Third-Party Services:** 13 third-party services identified
**Context Tags:** health, camera, ads, sensitive_data

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Not available
**Version:** 1.10.10 (build 1.0)
**Analysis Date:** 2026-04-14
**Package:** app.Calorie-Ai

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 1.10.10 analyzed on 2026-04-14
- May not reflect server-side security controls
- Cannot detect all runtime behaviors