# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Strong. Strong result in this area. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## FitWoody ## What This Means for You Analytics events and an Apple Search Ads attribution identifier may be sent to Customer.io, TelemetryDeck, and RevenueCat; workout and health data read from Apple Health stays on the device. ## Recommendation: Trustworthy CITT rates FitWoody Trustworthy. The app enforces HTTPS globally, avoids ad networks, keeps fitness data on-device, and uses privacy-preserving analytics. Local database encryption gaps represent its main technical concern. **Best For:** Fitness enthusiasts who want their workout and health data kept on their own device, without advertising networks. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 0 findings **Network Security:** 0 findings **Code Safety:** 1 finding (1 low) **Privacy:** 1 finding (1 low) ## Privacy Concerns ### What Leaves the Device - Analytics events: Customer.io is linked in the binary and may send lifecycle and screen events to Customer.io servers; EU data residency is configured. - Analytics telemetry: TelemetryDeck is linked and may send usage events using privacy-preserving, daily-rotating anonymized identifiers rather than persistent advertising IDs. - Attribution data: RevenueCat is linked and may send an Apple Search Ads attribution identifier on install to identify install source; no persistent advertising identifier framework for cross-app targeting is linked in this binary. - Workout sync data: PowerSync is linked for offline sync to the developer's own backend at fitwoody.camp. ### What Stays on the Device - Workout data, GPS routes, and health metrics read from Apple Health remain on the device and were not observed leaving it in this build. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Customer.io - lifecycle analytics and in-app messaging (EU data residency configured) - TelemetryDeck - privacy-preserving analytics using anonymized, rotating identifiers - RevenueCat - subscription management and Apple Search Ads attribution - Diagnostics SDK - diagnostics and crash reporting ## Understanding the Scores **Security:** 90/100 **Privacy:** 88/100 ### Security Breakdown - **Data Security:** 83/100. Data handling practices are generally solid. The main opportunity for improvement is adding encryption at rest to the local offline-sync database. - **Network Security:** 100/100. All network traffic uses HTTPS with no cleartext exceptions configured across any app target, representing the highest standard for transport security. - **Code Safety:** 93/100. The binary links modern encryption algorithms throughout, representing a strong code safety profile. ### Privacy Breakdown - **Data Collection:** 85/100. Analytics and attribution data may leave the device to third-party services, while workout and health data read from Apple Health stays on the device. - **Data Sharing:** 91/100. Data shared externally is limited to analytics, subscription management, and attribution. No advertising networks or data brokers are linked in the binary. - **User Control:** 87/100. Sign in with Apple and passkey support give users strong, modern authentication options, and no persistent advertising identifier framework for cross-app ad targeting is linked in the binary. ## Positive Security Features - Workout data, GPS routes, and health metrics read from Apple Health stay on the device, with no evidence of transmission to any analytics, advertising, or data-broker endpoint in this build. - No advertising networks or data broker SDKs are present in the binary. - All network connections use HTTPS with no cleartext traffic exceptions in any app target. - Sign in with Apple, passkey support, and OAuth session handling represent a modern authentication approach. - TelemetryDeck analytics use daily-rotating anonymized identifiers, avoiding persistent advertising identifiers. - Customer.io is configured with EU data residency. - Backend sync runs on developer-controlled infrastructure (fitwoody.camp), not a third-party data custody service. ## Areas for Improvement ### Disclosure observations 1. **App Privacy Manifest Coverage** Apple's guidelines recommend that apps using required-reason APIs declare them in an app privacy manifest (PrivacyInfo.xcprivacy). The FitWoody binary links Customer.io and TelemetryDeck, both of which use APIs in Apple's required-reason category; a privacy manifest for the main app target was not identified in this build. Adding one could make the App Store privacy label more complete and consistent with the binary's linked frameworks. ### Security Enhancements 1. **Local Database Encryption** The PowerSync SQLite database used for offline workout sync does not appear to have encryption at rest configured in this build. Enabling database encryption would protect stored workout data if a device is accessed without authorization. 2. **URL Scheme Hardening** The binary registers a custom URL scheme. Configuring Universal Links alongside the custom scheme would provide additional protection against URL scheme interception on shared devices. ## Technical Context **App Type:** Health and fitness, subscription, HealthKit integration **Classes Analyzed:** 0 (iOS binary; static symbol and framework analysis) **Third-Party Services:** 7 **Context Tags:** health, fitness, location, analytics, subscription --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** FitWoody **Version:** 2.6.5 (Build 463) **Analysis Date:** 2026-08-13 **Package:** camp.FitWoody ### Analysis Limitations - Static analysis only (code review without running the app) - Based on iOS build 2.6.5 (Build 463) analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors