# Security & Privacy Scorecard

## Virtuagym: Fitness & Workouts

**Version:** 12.0.4 (Build 4300847)  
**Platform:** Android  
**Scan Date:** March 5, 2026

**Security Score:** 42/100 | **Privacy Score:** 48/100

## What This Means for You

In-app behavior and workout activity is monitored by analytics services including Amplitude, which builds a profile of how the app is used. Stored fitness history and account details may not be fully protected if the device is accessed without authorization. User data is not shared with outside advertisers.

## Recommendation: Use With Caution

**Best For:** Casual workout logging at a gym or studio  
**Avoid If:** Storing sensitive body metrics or health conditions

## Key Findings

**Data Security** - 4 findings (2 critical, 1 high, 1 low)

**Network Security** - 1 finding (1 low)

**Code Safety** - 0 findings

**Privacy** - 5 findings (4 high, 1 medium)

## Privacy Concerns

### What Data is Collected

The app collects workout activity, fitness history, account information, and detailed records of in-app behavior. When fitness hardware such as a smart scale is connected, additional body measurement data is also gathered.

### Third-Party Data Sharing

Usage data is shared with the following third-party services:

- **Amplitude Analytics** - receives detailed records of in-app actions and builds a behavioral profile of how the app is used
- **Firebase** - receives app performance and stability data
- **Google Play Services** - used for authentication and core platform functions
- **Brightcove Video Player** - handles in-app video content
- **Nordic Semiconductor DFU** - supports firmware updates for connected fitness devices
- **QingNiu Scale SDK** - integrates with connected smart scales

User data is not shared with advertising networks or sold to third parties.

## Understanding the Scores

| Category | Score |
|----------|-------|
| Security | 42/100 |
| Privacy | 48/100 |
| Data Security | 35/100 |
| Network Security | 99/100 |
| Code Safety | 68/100 |
| Data Collection | 55/100 |
| Data Sharing | 100/100 |
| User Control | 87/100 |

**Data Security (35/100):** Stored fitness data and account details may not be fully protected if the device is accessed without authorization.

**Network Security (99/100):** Data moving between the app and its servers is well protected in transit.

**Code Safety (68/100):** The app's internal code structure is reasonably sound, with some areas that could be strengthened.

**Data Collection (55/100):** A moderate amount of data about user behavior and fitness activity is collected.

**Data Sharing (100/100):** User personal data is not passed to advertisers or sold to outside companies.

**User Control (87/100):** Users have strong options to manage data and account settings within the app.

## Positive Security Features

- No notable positive security practices were identified in this version.

## Areas for Improvement

- **Stronger on-device data protection:** Fitness history and account information should be stored with stronger safeguards so that it remains private even if someone gains physical access to the device.
- **Reduced collection of behavioral data:** The level of in-app activity monitoring exceeds what is needed to deliver core fitness features, and reducing it would better respect user privacy.
- **Improved protection for connected device data:** Data gathered from connected hardware such as smart scales deserves the same level of care as other personal health information.

---

## About This Analysis

This scorecard reflects the state of the app at the time of the scan, based on analysis of its code and configuration.

### App Details

- **App Name:** Virtuagym: Fitness & Workouts
- **Package ID:** digifit.virtuagym.client.android
- **Version:** 12.0.4 (Build 4300847)
- **Platform:** Android
- **Scan Date:** March 5, 2026