# Security & Privacy Scorecard

## NewForm: Recovery & Wellbeing

**App:** NewForm: Recovery & Wellbeing  
**Package ID:** the.phoenix.android  
**Version:** 10.5.0  
**Scan Date:** 2026-02-12  

## What This Means for You

Recovery activity, progress, and behavior patterns are shared with Facebook, TikTok, Braze, and Amplitude for advertising and behavioral analysis. Branch.io tracks how users were referred to the app and links that to their profile. In-app interactions are used to target users with ads across other platforms.

## Recommendation: Use With Caution

**Best For:** Recovery journeys with Facebook and TikTok accounts  
**Avoid If:** You prefer not sharing health activity with ad networks

## Key Findings

**Data Security** - 3 findings (1 high, 2 medium)

**Network Security** - 2 findings (1 critical, 1 medium)

**Code Safety** - 0 findings

**Privacy** - 6 findings (2 critical, 4 medium)

## Privacy Concerns

### What Data is Collected

The app collects recovery activity, progress milestones, in-app behavioral patterns, device identifiers, and usage timing data.

### Third-Party Data Sharing

User data is shared with the following third-party services:

- **Facebook SDK** - Receives behavioral and interaction data for ad targeting across Meta platforms
- **TikTok SDK** - Receives interaction data for ad targeting on TikTok
- **Braze** - Receives behavioral data for marketing automation and push notifications
- **Amplitude** - Receives detailed usage patterns for behavioral analysis
- **Branch.io** - Tracks how users discovered and installed the app, linked to their profile
- **Firebase** - App infrastructure and analytics
- **GetStream Chat** - In-app messaging
- **Google Maps** - Location-based features
- **PubNub** - Real-time messaging infrastructure
- **Coil** - Image loading
- **Seon** - Fraud detection

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 35/100 |
| Data Security | 55/100 |
| Network Security | 40/100 |
| Code Safety | 75/100 |
| Data Collection | 50/100 |
| Data Sharing | 40/100 |
| User Control | 55/100 |

## Positive Security Features

- No notable positive security practices were identified for this version of the app.

## Areas for Improvement

- Recovery and health activity is shared with advertising networks including Facebook and TikTok. Limiting this to analytics-only services would meaningfully reduce user exposure to behavioral profiling.
- The app's network communications have room to be strengthened, which would better protect user data as it moves between the device and remote servers.
- Users currently have limited ability to opt out of data collection by advertising partners. Clearer controls over what is shared with ad networks would give users more agency over their personal information.

---

## About This Analysis

This scorecard reflects security and privacy practices observed in the app's code and configuration at the time of the scan.

### App Details

| Field | Value |
|---|---|
| App Name | NewForm: Recovery & Wellbeing |
| Package ID | the.phoenix.android |
| Version | 10.5.0 |
| Scan Date | 2026-02-12 |
| Platform | Android |