# Did not meet TRUSTED criteria The app was assessed and did not meet all of the criteria for the TRUSTED mark. The specific items are listed below so the result can be weighed before installing. ## Trust Pillars - **Secure by Design**: Strong. Strong result in this area. - **Data Respect**: Not met. Did not meet one criterion in this area. - **Honest Experience**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## WidgetSmith ## What This Means for You Health metrics, calendar events, contacts, and photos are processed entirely on the device and never transmitted to any server or third party. Advertising identifiers may be shared with Google AdMob for ad delivery, and subscription data is sent to RevenueCat for purchase management. ## Recommendation: Very Secure Sensitive personal data including health metrics, calendar events, contacts, and photos is processed locally and never transmitted to any server or third party. The app is ad-supported, and advertising identifiers operate separately from the personal data that powers the widget functionality. All connections are encrypted and no third-party data broker flows were identified. **Best For:** People who want their health metrics, calendar events, and contacts available as home screen widgets, with that personal data kept on their device. ## Key Findings **Data Security:** 0 findings **Network Security:** 0 findings **Code Safety:** 1 finding (1 low) **Privacy:** 0 findings ## Privacy Concerns ### What Leaves the Device - Advertising identifiers: may be sent to Google AdMob for ad targeting and delivery - Subscription and purchase information: sent to RevenueCat for subscription management - App interaction data: may be sent to Superwall for paywall optimization - Location: may be sent to Foreca, Weathermachine.io, and WorldTides to serve weather and tide data for widgets ### What Stays on the Device - Health metrics (activity, heart rate, sleep, and other Apple Health data): accessed on the device and never transmitted - Calendar events and reminders: accessed locally for widget display and not sent off-device - Contacts: accessed on the device for widget display and not transmitted - Photos: accessed on the device and not transmitted ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Google Mobile Ads (AdMob) - advertising - Google UMP (UserMessagingPlatform) - ad consent management - RevenueCat - subscription and purchase management - Superwall - paywall and subscription flow management - Foreca - weather data - Weathermachine.io - weather data - WorldTides - tide forecast data - Apple AdServices - ad attribution - Apple AdSupport / ATT - advertising identifier access ## Understanding the Scores **Security:** 93/100 **Privacy:** 91/100 ### Security Breakdown - **Data Security:** 94/100. Sensitive personal data is secured on the device. Health, calendar, contacts, reminders, and photos are handled with strong protections and remain within the user's device. - **Network Security:** 100/100. All connections use HTTPS with modern authenticated encryption. No unprotected traffic is permitted anywhere in the app. - **Code Safety:** 92/100. Strong binary protections are in place throughout the app, including stack protection active across all code paths and no exposed scripting bridges in app-controlled views. ### Privacy Breakdown - **Data Collection:** 91/100. Sensitive personal data types including health, calendar, contacts, and photos are accessed locally and not transmitted. Ad-related data flows are limited to what the advertising frameworks require. - **Data Sharing:** 93/100. Data sharing is focused on functional services: weather data providers, subscription management, and advertising. No third-party data broker flows were identified. - **User Control:** 90/100. iOS platform controls including App Tracking Transparency, HealthKit permissions, and Calendar, Contacts, and Photos authorization give users direct authority over what data the app can access. ## Positive Security Features - All network connections are encrypted - no unprotected traffic is permitted - Health, calendar, contacts, reminders, and photos data stays on the device and is never transmitted off-device - Location is absent from all analytics and advertising data flows - No third-party data broker flows were identified - Modern encryption standards are used throughout the app - Stack protection is active across all code in the binary - The App Group shared container is restricted to the developer's own extensions, preventing third-party access ## Areas for Improvement ### GDPR / CCPA Compliance The app's privacy practices could be strengthened by: 1. **App Privacy Manifest** Adding an app privacy manifest could make the App Store privacy label more complete, giving users greater transparency about the data the app accesses. 2. **Ad Tracking Consent** Ensuring the App Tracking Transparency prompt is presented to users before advertising identifiers are accessed would provide a clear, explicit opportunity to opt out of ad tracking. ### Security Enhancements 1. **Weather Service Authentication** The app embeds weather service authentication directly in the binary, which requires a new app release to update. Designing this to be refreshable from a server configuration would improve resilience if the authentication were ever changed or needed rotation. ## Technical Context **App Type:** Home screen widget customization app with health, calendar, weather, and contacts integration **Classes Analyzed:** 0 **Third-Party Services:** 10 **Context Tags:** health, location, ads, calendar, contacts --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Crossforward **Version:** 8.4 (Build 1304) **Analysis Date:** 2026-08-05 **Package:** com.crossforward.WidgetSmith ### Analysis Limitations - Static analysis only (code review without running the app) - Based on iOS binary version 8.4 (Build 1304) analyzed on 2026-08-05 - May not reflect server-side security controls - Cannot detect all runtime behaviors