Zepp (Amazfit)

Is the Zepp app safe?

Zepp is reasonably safe for the data your Amazfit watch or ring collects, as long as you live where Zepp says it keeps your data close to home. The app does not track you across other companies' apps, according to Apple's label, and its privacy policy says Zepp never sells personal information. US and Canadian users' data is stored in the US and European users' data in Germany, not in China, where the company is based.

What keeps the score in the middle is the thin evidence behind the security claims, with no public bug bounty or audit, plus vague rules on how long data is kept. We score Zepp 66/100, between Mi Fitness at 64 and Huawei Health at 68, the other two big Chinese wearable apps, and below Garmin Connect at 70.

Is Zepp a Chinese app?

Yes. Zepp Health, the company behind Amazfit, began as Huami in Hefei, and the privacy policy for the Zepp app is issued by Anhui Huami Information Technology Co., Ltd., a Zepp Health affiliate with an address in the Hefei Hi-tech Zone.

The policy, effective 14 July 2026, names data centres in China, the United States and Germany and assigns users to them by region:

Two caveats apply. Each region allows "cross-border transmissions as permitted by applicable laws", and Zepp may use its own overseas facilities to process or back up data. For the UK, Australia, India and other markets the policy does not name a location at all. The App Store listing adds that the data is hosted on Amazon Web Services, regionally stored and encrypted. Ownership alone is not a finding against the app, but if it matters to you, the gaps in that table are the thing to ask Zepp about.

What data does Zepp collect?

A lot, as you would expect from a watch app. The policy lists heart rate, blood oxygen, ECG and PPG readings, sleep and breathing, stress, temperature, workouts with GPS routes, and food diaries. With some watches it also handles calls, text messages and notifications pushed from your phone, and with LTE models your phone number and call records. AI features such as Zepp Flow, the Zepp Aura coach and Coach Chat combine what you type with your other data, and the Alexa voice assistant processes voice requests.

The labels are lighter than the policy. Apple's label links only identifiers to you and lists health, location and user content as collected but not linked. On Google Play, Zepp lists health, fitness and precise location as shared with other companies, for app functionality only, and email as used for advertising or marketing. The policy says Zepp does not sell personal information. It does say that software development kits in its products "may allow third parties (including advertisers) to collect your personal information", and that its service providers include advertising and marketing firms. Sharing with Strava, Google Fit and other apps happens only when you connect them.

How secure is Zepp?

Zepp's policy lists two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, data encryption, regular penetration testing and security updates for at least two years after a device model first ships, and says data moving between your watch, phone and Zepp's servers is encrypted. We found no reported breach of Zepp data.

The evidence stops there. We found no public bug bounty or security.txt contact, no independent audit or certification, and no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, so Zepp can read your health data on its servers. The one CVE we found for the company's apps dates from 2019 and concerned an unencrypted update check in its older Mi Fit app.

How to use Zepp more safely

1. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for your Zepp account if the app offers it in your region.
2. Leave notification and SMS mirroring off unless you need it, since it sends message content to the watch.
3. Connect Strava or Google Fit only if you use them, and remove links you no longer need.
4. Decline marketing emails and skip Zepp Aura Premium unless the AI advice is worth sharing more data.
5. If you live outside the US, Canada or the EEA, email Zepp's privacy team to ask where your data is stored.
6. When you stop using a device, request deletion of your account rather than just removing the app.

How we scored it

The regulatory record (86) is the strongest factor, with no fine or order on record, though no regulator has examined Zepp closely either. Scams and harmful content (76) reflects little contact with strangers, minus the gap between the 9+ store rating and the under-16 limit. Privacy (60), security (62) and transparency and control (62) are held down by third-party kits that may include advertisers, the missing bug bounty and audit, and open-ended retention.