Calm

Is Calm safe?

Calm is safe in the everyday sense: its content is professionally produced sleep stories, music and guided meditation, nobody can message you, and no regulator has fined it. Where it falls short is privacy. Apple's App Store label says Calm uses your purchases, identifiers and usage data to track you across other companies' apps and websites, and its privacy policy says it "sells" or "shares" identifiers and browsing data with advertising partners, social media platforms included. It also publishes little about how it protects your account, and there is no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login. We score it 66/100, behind Headspace at 69.

What Calm tracks

Calm's label is one of the more ad-heavy in the health section. Under "Data Used to Track You" it lists purchases, identifiers and usage data. Under third-party advertising it lists your user ID, device ID and how you use the app. Google Play tells a similar story: email address, user IDs, purchase history, app interactions and device IDs are shared with other companies for advertising or marketing.

The privacy policy, last updated on 13 October 2026, explains how. Ad partners use cookies, device identifiers and similar tools to see what you do in the app and on other sites, and some partners let Calm turn your email address or phone number into an identifier for ads on other platforms. Calm also collects the moods and reflections you log in check-ins, your sleep habits and goals, and may guess your age and gender from what you do.

Two promises limit the damage. Calm says it sells or shares sensitive data only with your consent, and that it does not knowingly use data from people under 18 for targeted ads. Data from Apple Health or Google Health Connect comes in only if you allow it, and Calm says it does not infer health characteristics from it.

The consumer app is not a medical service, so HIPAA does not apply to anything you log in it.

How secure is Calm?

We cannot say much, and that is part of the problem. Google Play confirms data is encrypted in transit, and we found no reported breach at Calm. But the consumer app has no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login; Calm's help centre describes multi-factor sign-in only for Calm Health and its partner portal. There is no bug bounty on HackerOne or Bugcrowd, and calm.com blocks automated visitors, so we could not check its security page for audits or certifications. Use a strong password that you do not use anywhere else.

Has Calm been fined?

No. The FTC's cases database has no entry for Calm, and we found no state attorney general action or European fine. When Mozilla reviewed 32 mental health and prayer apps in 2022 and gave 29 of them a "Privacy Not Included" warning, it singled out Calm for gathering data from outside sources and using several tracking tools to target ads. That is a review, not a legal finding, but the current label shows the same advertising model.

Compare that with BetterHelp, which paid $7.8 million under a 2023 FTC order for passing health questionnaire answers to ad platforms. Calm's sharing, as disclosed, is about identifiers and app activity rather than the content of check-ins.

Is Calm safe for kids?

The content is. The App Store rates Calm 9+, and there is no chat or user-to-user contact. The privacy side depends on the device: tracking permissions are set per phone or tablet, so turn tracking off on any device a child uses. Calm says it does not knowingly target ads at under-18s, but it can only know a user's age if it is told.

How to use Calm more privately

1. Tap "Ask App Not to Track" on iPhone. On Android, delete your advertising ID in the system ad settings.
2. Visit calm.com/optout to opt out of the sale and sharing of your data, or browse with Global Privacy Control turned on.
3. Skip the mood and reflection check-ins if you would rather not keep a mental health diary with an ad-funded company.
4. Leave the Apple Health or Health Connect link off unless you want sleep tracking.
5. To leave, ask for any refund first, then delete the account under Manage Account in the app.

How we scored it

Regulatory record (87) and scams and harmful content (85) are the strongest factors: no regulator has fined Calm and its content carries little risk. Privacy (55) is the weakest, because Calm declares tracking for ads and shares identifiers, purchases and app activity with ad partners. Security (60) reflects encryption in transit and no known breach, but no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login, no bug bounty and no public evidence of audits.