# Security & Privacy Scorecard

## com.bryanjohnson.biomarkers

## What This Means for You

Usage patterns and in-app behavior are sent to Mixpanel and Segment, two analytics companies. Health and activity data stays reasonably protected, but multiple third-party services receive information about how the app is used.

## Recommendation: Use With Caution

**Best For:** Tracking personal health and biomarker data
**Avoid If:** You prefer apps that collect minimal analytics data

## Key Findings

**Data Security** - 4 findings (2 medium, 1 low, 1 info)

**Network Security** - 6 findings (1 medium, 1 low, 4 info)

**Code Safety** - 0 findings

**Privacy** - 5 findings (1 high, 2 medium, 1 low, 1 info)

## Privacy Concerns

### What Data is Collected

Health and biomarker readings are the core data this app stores. Beyond that, in-app behavior, session activity, and usage patterns are collected for analytics purposes. Device identifiers and interaction events are transmitted to multiple third-party platforms each time the app is used.

### Third-Party Data Sharing

Usage data is shared with the following third-party services:

- **Mixpanel** - Behavioral analytics and event tracking
- **Segment** - Data routing and customer data aggregation
- **LaunchDarkly** - Feature flag management (receives device and session context)
- **Avo Inspector** - Analytics quality monitoring
- **AWS Amplify / Cognito** - Authentication and backend services
- **Google Sign-In** - Authentication provider
- **Expo EAS** - App build and update delivery

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 85/100 |
| Privacy | 55/100 |
| Data Security | 72/100 |
| Network Security | 85/100 |
| Code Safety | 85/100 |
| Data Collection | 56/100 |
| Data Sharing | 75/100 |
| User Control | 70/100 |

## Positive Security Features

- The app includes a library to detect modified device environments, providing an added layer of protection for health data stored locally.
- Authentication is delegated to established providers (Google Sign-In, AWS Cognito) rather than a custom-built system, reducing the risk from authentication mistakes.

## Areas for Improvement

- Usage behavior is shared with several analytics and data-routing services simultaneously. Providing an opt-out or reducing the number of recipients would meaningfully improve user privacy.
- How sensitive health data is stored on the device could be strengthened to better protect biomarker records if the device is ever accessed by someone else.
- Some network connections could be configured more strictly to better protect data while it travels between the app and its servers.

---

## About This Analysis

This scorecard is generated through automated static analysis of the app's code and configuration. Scores reflect the app's practices at the time of the scan and may not capture all runtime behaviors.

### App Details

- **App ID:** com.bryanjohnson.biomarkers
- **Version:** 1.0.10 (Build 70)
- **Scan Date:** 2026-03-31
- **Platform:** iOS / React Native