# Did not meet TRUSTED criteria The app was assessed and did not meet all of the criteria for the TRUSTED mark. The specific items are listed below so the result can be weighed before installing. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Respect**: Not met. Did not meet one criterion in this area. - **Honest Experience**: Strong. Strong result in this area. - **User Control**: Strong. Strong result in this area. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## WHOOP ## What This Means for You WHOOP sends usage analytics, crash reports, and email addresses to third-party companies, and some of these data flows begin before users review consent settings. Biometric health data including heart rate, sleep stages, and GPS workout routes stays within WHOOP's own platform and is not shared with advertising or analytics partners. ## Recommendation: Solid WHOOP delivers solid health tracking with strong network security, keeping all communications encrypted and restricting browser-based authentication to WHOOP-owned domains. Sign-in data and health records stored locally on the device rely on operating system-level protection rather than an additional app-level encryption layer, and analytics services are initialized before users can review privacy settings. For most fitness and health tracking use cases, the app's data handling is responsible where it matters most. **Best For:** People who track fitness, sleep, and recovery metrics with a WHOOP wearable and want their biometric health data kept within WHOOP's own platform rather than shared with advertising or analytics companies. ## Key Findings **Data Security:** 1 finding (1 low) **Network Security:** 2 findings (1 medium, 1 low) **Code Safety:** 2 findings (1 medium, 1 low) **Privacy:** 2 findings (2 low) ## Privacy Concerns ### What Leaves the Device - Usage and behavioral analytics: sent to Amplitude and Firebase for product improvement and performance monitoring - Email address: sent to Iterable for marketing and communications before explicit opt-in consent - Crash reports with app navigation history: sent to Sentry, linked to the user's WHOOP account identifier rather than an anonymous session ID - Community and team messages: processed and stored by Stream (getstream.io) as the messaging infrastructure - Google Advertising ID: may be associated with health app usage and shared with advertising platforms ### What Stays on the Device Biometric health values including heart rate, heart rate variability, sleep stages, blood oxygen, respiratory rate, and reproductive health data sync to WHOOP's own servers but are not shared with advertising, analytics, or marketing partners. GPS workout routes are similarly kept within WHOOP's own infrastructure. Health-sensitive data does not flow to third-party companies. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Amplitude Analytics - usage and behavioral analytics - Firebase (Google) - push notifications and analytics infrastructure - Sentry - crash reporting, linked to the WHOOP account identifier - Stream (getstream.io) - community and team messaging platform - Iterable - email marketing and communications - Stripe - payment processing - Google Play Services - platform authentication and device services - Mapbox - mapping display for workout data visualization ## Understanding the Scores **Security:** 77/100 **Privacy:** 82/100 ### Security Breakdown - **Data Security:** 48/100. Sign-in data and health records stored on the device are protected primarily by the device's screen lock, without an additional encryption layer specific to the app's sensitive data. This is the main area pulling the overall security score down. - **Network Security:** 87/100. All network communications use encrypted HTTPS with no unencrypted fallback. Sign-in data travels as request headers rather than URL parameters, and browser-based authentication is restricted to an allowlist of WHOOP-owned domains. - **Code Safety:** 84/100. The codebase applies solid security practices throughout. An internal developer settings screen is compiled into the production build but is hidden from the standard user interface. ### Privacy Breakdown - **Data Collection:** 85/100. The app limits what sensitive health data flows to third parties. Analytics and marketing services receive behavioral information, and some of these services initialize before users can review privacy settings. - **Data Sharing:** 86/100. Biometric health values, sleep data, and workout routes are not shared with advertising or analytics partners. Data sharing with third parties is focused on operational services such as payments, crash reporting, and messaging. - **User Control:** 84/100. Data deletion is supported. Some analytics and marketing services initialize before explicit user consent is obtained, reducing the degree of upfront user control over those data flows. ## Positive Security Features - All network traffic uses encrypted HTTPS with no unencrypted fallback, and sign-in data is sent as request headers rather than URL parameters - Cloud backup is disabled, preventing bulk extraction of health data through Android's backup system - Biometric health values including heart rate, HRV, sleep stages, reproductive data, and blood oxygen levels are not shared with any third-party analytics or advertising service - GPS workout routes are kept within WHOOP's own infrastructure and not transmitted to any mapping or analytics partner - Browser-based authentication is restricted to WHOOP-owned domains, preventing sign-in data from reaching unintended destinations ## Areas for Improvement ### GDPR / CCPA Compliance The app's privacy practices could be strengthened by: 1. **Pre-consent Analytics Initialization** Analytics and marketing services could be deferred until users have reviewed and accepted the privacy policy, giving users meaningful choice before any behavioral data is sent off-device. 2. **Email Marketing Consent Gating** The marketing email platform receives email addresses during account setup. Requiring explicit opt-in consent before sharing contact information with the marketing service would align with GDPR and CCPA requirements. 3. **Advertising Identifier Use in Health Context** The Google Advertising ID is associated with health app usage. Given the sensitive nature of health data, limiting or opting out of advertising identifier use would reduce the potential for health-context behavioral profiling. ### Security Enhancements 1. **Local Data Encryption** Sign-in data and health records stored on the device could be moved to Android's encrypted storage, adding a protection layer that operates independently of the device screen lock. 2. **File Sharing Scope Reduction** The file sharing configuration exposes broad sections of internal storage. Narrowing these paths to folders specifically intended for sharing would reduce exposure if a sharing URI were inadvertently granted to another app. 3. **Sign-In Callback Broadcast Protection** Sign-in callback data is forwarded via a broadcast that any installed app can receive. Restricting the broadcast with a declared permission or using a local broadcast mechanism would limit receipt to WHOOP's own components. ## Technical Context **App Type:** Health and fitness wearable companion app; handles biometric, financial, and location data **Third-Party Services:** 10+ service providers identified **Context Tags:** health, fitness, biometric, location, financial, sensitive data, wearable --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Whoop, Inc. **Version:** 5.445.0 **Analysis Date:** 2026-07-30 **Package:** com.whoop.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 5.445.0 analyzed on 2026-07-30 - May not reflect server-side security controls - Cannot detect all runtime behaviors