# Security & Privacy Scorecard

## Oniri - Your Dream Journal

**io.oniri.oniriapp** | Version 1.40.3 (Build 65) | Scanned 2026-02-04

**Security Score: 45/100** | **Privacy Score: 35/100**

## What This Means for You

Dream entries and usage habits are tracked by Mixpanel for behavioral analytics, and crash data is sent to Sentry. Subscription activity flows through RevenueCat. Journal content may not be fully protected if stored data is not adequately secured.

## Recommendation: Use With Caution

**Best For:** Dream journalers comfortable with behavioral analytics
**Avoid If:** You keep sensitive personal thoughts in your journal

## Key Findings

**Data Security** - 8 findings (1 critical, 2 high, 1 medium, 4 low)

**Network Security** - 0 findings

**Code Safety** - 0 findings

**Privacy** - 4 findings (1 critical, 2 high, 1 medium)

## Privacy Concerns

### What Data is Collected

- **Behavioral data**: In-app actions and usage patterns are collected by Mixpanel for behavioral analytics.
- **Crash and diagnostic data**: When the app encounters errors, Sentry receives details about the device state and app activity at the time of the crash.
- **Subscription data**: Purchase and subscription activity is processed by RevenueCat.
- **Journal and app data**: Entries are stored using MongoDB Realm, a local and cloud-connected database service.

### Third-Party Data Sharing

User data is shared with the following third-party services:

- **Mixpanel** - behavioral analytics and usage tracking
- **Sentry** - crash reporting and diagnostics
- **RevenueCat** - subscription and purchase management
- **MongoDB Realm** - data storage

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 35/100 |
| Data Security | 40/100 |
| Network Security | 100/100 |
| Code Safety | 85/100 |
| Data Collection | 45/100 |
| Data Sharing | 50/100 |
| User Control | 60/100 |

## Positive Security Features

- No notable positive security practices were identified in this version.

## Areas for Improvement

- The way journal data is stored on the device leaves it accessible in ways that could expose private entries to other apps or background processes.
- Multiple third-party services collect data about how the app is used, with limited options available to opt out or control what is shared with each company.
- Subscription and usage patterns are processed by an external service, expanding the number of companies with access to user activity.

---

## About This Analysis

This scorecard is based on static analysis of the published app binary. Scores and findings represent the state of the app at the time of the scan and may not reflect subsequent updates.

### App Details

- **App Name**: Oniri - Your Dream Journal
- **Package ID**: io.oniri.oniriapp
- **Version**: 1.40.3 (Build 65)
- **Scan Date**: 2026-02-04