# Security & Privacy Scorecard

## Lively: Cycle Syncing, Period

## What This Means for You

Cycle and health data is handled by an app connected to Facebook, AppsFlyer, and Firebase, meaning usage patterns can reach advertising and attribution networks. Push notifications are managed by OneSignal, a third-party service. The app provides reasonable account controls, but user activity is shared across several external platforms.

## Recommendation: Use With Caution

**Best For:** Cycle tracking with standard app analytics

**Avoid If:** Keeping health data off ad networks is a priority

## Key Findings

**Data Security** - 3 findings (1 critical, 1 high, 1 medium)

**Network Security** - 2 findings (2 high)

**Code Safety** - 0 findings

**Privacy** - 4 findings (2 high, 2 medium)

## Privacy Concerns

### What Data is Collected

This app collects sensitive personal health information, including menstrual cycle dates, symptoms, and related health inputs provided by users. It also collects standard device and usage data such as device model, operating system version, and how users interact with app features.

### Third-Party Data Sharing

User data and activity are shared with the following external services:

- **Facebook SDK** - In-app behavior and device information are shared with Facebook for advertising and audience targeting purposes.
- **AppsFlyer** - Install source and in-app activity are shared with an attribution network to measure ad campaign performance.
- **Firebase** - Usage analytics and crash information are sent to Google Firebase.
- **OneSignal** - The device push notification identifier is shared with OneSignal to deliver notifications.
- **Intercom** - Customer support interactions are handled by Intercom, a third-party service.
- **Adapty** - Subscription and purchase data is processed by Adapty.
- **Ably** - Real-time messaging features are powered by Ably.
- **Google Play Billing** - In-app purchases are processed through Google Play Billing.

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 80/100 |
| Privacy | 80/100 |
| Data Security | 75/100 |
| Network Security | 85/100 |
| Code Safety | 80/100 |
| Data Collection | 80/100 |
| Data Sharing | 80/100 |
| User Control | 85/100 |

## Positive Security Features

- Account management controls give users reasonable ability to manage their data and account.
- Network communications use current transport security practices for data in transit.

## Areas for Improvement

- How health data is stored on the device could be strengthened to better protect cycle information if the phone is accessed by someone else.
- Some network connections could benefit from additional protections to further reduce the risk of data being read in transit.
- User health and behavioral data reaches multiple advertising and attribution platforms. Reducing that sharing scope would better protect user privacy.

---

## About This Analysis

This scorecard reflects the security and privacy practices observed in the version of the app detailed below.

### App Details

| Field | Value |
|---|---|
| App Name | Lively: Cycle Syncing, Period |
| Package ID | com.app.lively_app |
| Version | 2.6.8 (281) |
| Scan Date | January 31, 2026 |
| Developer | Not listed |