# Did not meet TRUSTED criteria The app was assessed and did not meet all of the criteria for the TRUSTED mark. The specific items are listed below so the result can be weighed before installing. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Respect**: Not met. Did not meet one criterion in this area. - **Honest Experience**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Calm - Sleep, Meditate, Relax ## What This Means for You Mental health journals and mood logs are stored without encryption on the device and can be extracted via USB backup, and six analytics SDKs transmit behavioral data to third parties before any consent screen is presented. ## Recommendation: Solid Calm delivers a well-rounded meditation, sleep, and relaxation experience with strong network security and meaningful protections for HIPAA-enrolled users. Mental health journals, mood check-ins, and sleep records are stored on the device without encryption, and six analytics services begin collecting usage data before any consent mechanism is presented. The app suits people who primarily use it for guided meditations, sleep stories, and breathing exercises. **Best For:** People who use the app primarily for guided meditation, sleep stories, and breathing exercises. ## Key Findings **Data Security:** 2 findings (1 high, 1 medium) **Network Security:** 0 findings **Code Safety:** 7 findings (1 medium, 6 low) **Privacy:** 4 findings (1 high, 1 medium, 2 low) ## Privacy Concerns ### What Leaves the Device - Behavioral usage data (content played, session timing, in-app actions): sent to Amplitude, Segment, Iterable, AppsFlyer, and Facebook SDK for analytics, attribution, and marketing measurement - Purchase and subscription activity: sent to Firebase Analytics and AppsFlyer for revenue tracking - Device interaction signals: sent to HUMAN Security (PerimeterX) for bot detection and fraud prevention - Account sign-in information: sent to Auth0 for authentication and session management - Payment information: processed by Stripe and Google Play Billing for subscription purchases - Crash and performance data: sent to Firebase Crashlytics and Firebase Performance ### What Stays on the Device - Journal entries, mood check-ins, and sleep records: stored on the device and not transmitted to analytics services or third parties - Contact names and phone numbers: accessed on the device only for the Guest Pass sharing feature and not transmitted off-device - Meditation activity: can be written to the Android Health Connect local data store on an opt-in basis, where it stays under the user's control ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Firebase (Analytics, Crashlytics, Performance, Cloud Messaging, Remote Config) - usage analytics, crash reporting, performance monitoring, and push notifications - Amplitude Analytics and Amplitude Experiment - behavioral analytics and feature experimentation - Segment Analytics - behavioral event aggregation and routing - AppsFlyer - attribution, install tracking, and marketing analytics - Iterable - marketing communications and push notifications - Facebook SDK - advertising attribution and measurement - HUMAN Security (PerimeterX) - bot detection and fraud prevention - Auth0 - authentication and identity management - Stripe - payment processing - Google (Sign-In, Play Billing, Pay/Wallet) - authentication and payment processing ## Understanding the Scores **Security:** 72/100 **Privacy:** 69/100 ### Security Breakdown - **Data Security:** 46/100. Mental health journals, mood check-ins, and sleep records are stored on the device without encryption, and the backup configuration allows this data to be extracted via a USB-connected computer. A storage path active on rooted devices has an additional weakness that could allow stored data to be tampered with. This sub-score reflects the concentration of sensitive personal data in unprotected on-device storage. - **Network Security:** 100/100. All production traffic uses encrypted connections. SSL errors are correctly rejected across every in-app browsing component, and unencrypted connections are blocked at the OS level. - **Code Safety:** 88/100. Authentication and in-app browsing components include meaningful protections, and token-bearing in-app browsers are not accessible from other apps on the device. Several lower-severity configuration items, including development tools present in the release build, could be tightened in future updates. ### Privacy Breakdown - **Data Collection:** 65/100. Six analytics services initialize and begin collecting usage data when the app opens, before any consent is presented to the user. Actual journal entries, mood logs, and sleep content are not sent to these analytics services. - **Data Sharing:** 78/100. Usage and behavioral data is shared with six analytics and attribution services. HIPAA-enrolled users receive stronger data protections, with analytics anonymized and partner data sharing filtered. - **User Control:** 73/100. Users can request data deletion and the app provides HIPAA data controls for enrolled users. Analytics begin collecting before any user control mechanism is available, which limits pre-consent choice. ## Positive Security Features - All production API traffic uses encrypted connections, and unencrypted connections are blocked at the OS level - SSL errors are correctly rejected across all in-app browsing components, connections fail safely on any certificate issue - Token-bearing in-app browsers are not externally accessible from other apps, preventing navigation injection - HIPAA-enrolled users receive enhanced protections: analytics anonymized, advertiser tracking adjusted, and partner sharing filtered - Facebook automatic event logging and advertiser ID collection are disabled at the configuration level by default - Health Connect integration is write-only and opt-in; the app does not read health data from other apps or external sources - Actual journal entries, mood logs, and sleep content are not passed to any analytics or third-party services ## Areas for Improvement ### GDPR / CCPA Compliance The app's privacy practices could be strengthened by: 1. **Pre-consent Analytics Initialization** Analytics and attribution services could be initialized only after user consent is obtained, rather than at app startup before any consent screen is shown. 2. **Firebase Analytics Configuration** The manifest-level analytics opt-out flag could be honored rather than overridden in code, providing a reliable mechanism for disabling collection. ### Security Enhancements 1. **On-Device Database Encryption** Mental health journals, mood check-ins, and sleep records could be encrypted at rest on the device, protecting user data from extraction even if the device is connected to a computer. 2. **Backup Exclusion Rules** The backup configuration could exclude the app's main database and session storage files so that USB and cloud backups do not capture sensitive personal records. ## Technical Context **App Type:** Mental health and wellness (sensitive personal data) **Classes Analyzed:** 93,031 **Third-Party Services:** 19 **Context Tags:** health, sensitive_data, contacts, ads, subscription --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Calm.com, Inc. **Version:** 6.92 (build 4120434) **Analysis Date:** 2026-07-30 **Package:** com.calm.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 6.92 (build 4120434) analyzed on 2026-07-30 - May not reflect server-side security controls - Cannot detect all runtime behaviors