{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:HLR5CMQZCRU2NNKEQNFQTXPW3J","short_pith_number":"pith:HLR5CMQZ","canonical_record":{"source":{"id":"2605.02016","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-03T18:42:08Z","cross_cats_sorted":["cs.CY"],"title_canon_sha256":"eb695582342f62c7ea4507c8bfbb73b3fc33051970321c8f5a7ab18d466881c2","abstract_canon_sha256":"8820109916cc436f68aee9a14e614dd230eb3cd0b468bc6a46af54aaab67d4ef"},"schema_version":"1.0"},"canonical_sha256":"3ae3d132191469a6b544834b09ddf6da78d931874047c90b295fed9fe354b668","source":{"kind":"arxiv","id":"2605.02016","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.02016","created_at":"2026-06-02T01:03:47Z"},{"alias_kind":"arxiv_version","alias_value":"2605.02016v3","created_at":"2026-06-02T01:03:47Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.02016","created_at":"2026-06-02T01:03:47Z"},{"alias_kind":"pith_short_12","alias_value":"HLR5CMQZCRU2","created_at":"2026-06-02T01:03:47Z"},{"alias_kind":"pith_short_16","alias_value":"HLR5CMQZCRU2NNKE","created_at":"2026-06-02T01:03:47Z"},{"alias_kind":"pith_short_8","alias_value":"HLR5CMQZ","created_at":"2026-06-02T01:03:47Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:HLR5CMQZCRU2NNKEQNFQTXPW3J","target":"record","payload":{"canonical_record":{"source":{"id":"2605.02016","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-03T18:42:08Z","cross_cats_sorted":["cs.CY"],"title_canon_sha256":"eb695582342f62c7ea4507c8bfbb73b3fc33051970321c8f5a7ab18d466881c2","abstract_canon_sha256":"8820109916cc436f68aee9a14e614dd230eb3cd0b468bc6a46af54aaab67d4ef"},"schema_version":"1.0"},"canonical_sha256":"3ae3d132191469a6b544834b09ddf6da78d931874047c90b295fed9fe354b668","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-02T01:03:47.986092Z","signature_b64":"RNKYtd6hU0fscvYWpu++LZESR6wqHxbRqeJ15RsqOZc4PCEzVw+KpjWeeXSRh6v/angp4sM8Fn4NdREl5CPICg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"3ae3d132191469a6b544834b09ddf6da78d931874047c90b295fed9fe354b668","last_reissued_at":"2026-06-02T01:03:47.985666Z","signature_status":"signed_v1","first_computed_at":"2026-06-02T01:03:47.985666Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.02016","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-02T01:03:47Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"JzwfoXiuxUmyt7oZw6IVqW2iXJOZ9B/6BKwOkF+p5OIlXc4cdBvGQlHNLebdV+Zx52OmkMu78uoQ2hcQPd2EBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-19T10:58:15.994879Z"},"content_sha256":"213f02723d52a71c9376b66be909a6bd28062eba252cb1d33626219b14a3eabe","schema_version":"1.0","event_id":"sha256:213f02723d52a71c9376b66be909a6bd28062eba252cb1d33626219b14a3eabe"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:HLR5CMQZCRU2NNKEQNFQTXPW3J","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"What's on Your Mind? Exploring Privacy of Mental Health Apps","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"Mental health apps embed undisclosed trackers and send user data to AI services without clear policy disclosure.","cross_cats":["cs.CY"],"primary_cat":"cs.CR","authors_text":"Chloe Georgiou, Emiliano De Cristofaro, Gene Tsudik, Hans Lu","submitted_at":"2026-05-03T18:42:08Z","abstract_excerpt":"Therapy and life-coaching apps have been rapidly growing in number, flavors, and popularity. However, their users routinely share highly sensitive and personal information, such as traumas, fantasies, desires, relationship difficulties, and other mental health concerns. This prompts the need for an empirical analysis of privacy practices in this ecosystem, and particularly the alignment between these apps' privacy policies and their actual behavior. In this paper, we present a comprehensive analysis of 25 popular Android mental health and life-coaching apps, combining static analysis, dynamic "},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"Our findings demonstrate that current disclosure practices fall short of the transparency required for meaningful informed consent.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"The 25 selected apps are representative of the broader mental health app ecosystem and that the combination of static analysis, dynamic capture, and LLM-assisted policy review fully captures all data-sharing behaviors without missing flows or false positives.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"Analysis of 25 mental health apps reveals all embed undisclosed trackers, 16 permission-policy contradictions, and unclear third-party AI processing, showing disclosure practices fall short of informed consent standards.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"Mental health apps embed undisclosed trackers and send user data to AI services without clear policy disclosure.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"b19cf0a3d8680eae09ae5726c8d684f52da8b4cdd45b3c774c774e7bb3c15518"},"source":{"id":"2605.02016","kind":"arxiv","version":3},"verdict":{"id":"133db46c-72b4-446a-975d-3982acebb264","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-12T02:15:47.242529Z","strongest_claim":"Our findings demonstrate that current disclosure practices fall short of the transparency required for meaningful informed consent.","one_line_summary":"Analysis of 25 mental health apps reveals all embed undisclosed trackers, 16 permission-policy contradictions, and unclear third-party AI processing, showing disclosure practices fall short of informed consent standards.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"The 25 selected apps are representative of the broader mental health app ecosystem and that the combination of static analysis, dynamic capture, and LLM-assisted policy review fully captures all data-sharing behaviors without missing flows or false positives.","pith_extraction_headline":"Mental health apps embed undisclosed trackers and send user data to AI services without clear policy disclosure."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.02016/integrity.json","findings":[],"available":true,"detectors_run":[{"name":"ai_meta_artifact","ran_at":"2026-05-20T16:39:57.555221Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_title_agreement","ran_at":"2026-05-20T04:31:22.268143Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_compliance","ran_at":"2026-05-19T16:47:43.099579Z","status":"completed","version":"1.0.0","findings_count":0}],"snapshot_sha256":"0f44249326d50436a462077a41bd217246621b5ae88e78bdb6d120504de8d467"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":"133db46c-72b4-446a-975d-3982acebb264"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-02T01:03:47Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"LCrgCcS/uuxHJ2UdNlnRDHBVp7flrPN4u1FpEzGGpNyT7nDUtQD+3/618xMPEyjIWErb9kBHZm8/aQlRMLFtCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-19T10:58:15.996164Z"},"content_sha256":"880742f98b9576ca017f1340cd8d9f5b6f6b714715f38617ea96624ad9eeb670","schema_version":"1.0","event_id":"sha256:880742f98b9576ca017f1340cd8d9f5b6f6b714715f38617ea96624ad9eeb670"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/HLR5CMQZCRU2NNKEQNFQTXPW3J/bundle.json","state_url":"https://pith.science/pith/HLR5CMQZCRU2NNKEQNFQTXPW3J/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/HLR5CMQZCRU2NNKEQNFQTXPW3J/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-19T10:58:16Z","links":{"resolver":"https://pith.science/pith/HLR5CMQZCRU2NNKEQNFQTXPW3J","bundle":"https://pith.science/pith/HLR5CMQZCRU2NNKEQNFQTXPW3J/bundle.json","state":"https://pith.science/pith/HLR5CMQZCRU2NNKEQNFQTXPW3J/state.json","well_known_bundle":"https://pith.science/.well-known/pith/HLR5CMQZCRU2NNKEQNFQTXPW3J/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:HLR5CMQZCRU2NNKEQNFQTXPW3J","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8820109916cc436f68aee9a14e614dd230eb3cd0b468bc6a46af54aaab67d4ef","cross_cats_sorted":["cs.CY"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-03T18:42:08Z","title_canon_sha256":"eb695582342f62c7ea4507c8bfbb73b3fc33051970321c8f5a7ab18d466881c2"},"schema_version":"1.0","source":{"id":"2605.02016","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.02016","created_at":"2026-06-02T01:03:47Z"},{"alias_kind":"arxiv_version","alias_value":"2605.02016v3","created_at":"2026-06-02T01:03:47Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.02016","created_at":"2026-06-02T01:03:47Z"},{"alias_kind":"pith_short_12","alias_value":"HLR5CMQZCRU2","created_at":"2026-06-02T01:03:47Z"},{"alias_kind":"pith_short_16","alias_value":"HLR5CMQZCRU2NNKE","created_at":"2026-06-02T01:03:47Z"},{"alias_kind":"pith_short_8","alias_value":"HLR5CMQZ","created_at":"2026-06-02T01:03:47Z"}],"graph_snapshots":[{"event_id":"sha256:880742f98b9576ca017f1340cd8d9f5b6f6b714715f38617ea96624ad9eeb670","target":"graph","created_at":"2026-06-02T01:03:47Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":4,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"Our findings demonstrate that current disclosure practices fall short of the transparency required for meaningful informed consent."},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"The 25 selected apps are representative of the broader mental health app ecosystem and that the combination of static analysis, dynamic capture, and LLM-assisted policy review fully captures all data-sharing behaviors without missing flows or false positives."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"Analysis of 25 mental health apps reveals all embed undisclosed trackers, 16 permission-policy contradictions, and unclear third-party AI processing, showing disclosure practices fall short of informed consent standards."},{"attestation":"unclaimed","claim_id":"C4","kind":"headline","source":"verdict.pith_extraction.headline","status":"machine_extracted","text":"Mental health apps embed undisclosed trackers and send user data to AI services without clear policy disclosure."}],"snapshot_sha256":"b19cf0a3d8680eae09ae5726c8d684f52da8b4cdd45b3c774c774e7bb3c15518"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[{"findings_count":0,"name":"ai_meta_artifact","ran_at":"2026-05-20T16:39:57.555221Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"doi_title_agreement","ran_at":"2026-05-20T04:31:22.268143Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"doi_compliance","ran_at":"2026-05-19T16:47:43.099579Z","status":"completed","version":"1.0.0"}],"endpoint":"/pith/2605.02016/integrity.json","findings":[],"snapshot_sha256":"0f44249326d50436a462077a41bd217246621b5ae88e78bdb6d120504de8d467","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Therapy and life-coaching apps have been rapidly growing in number, flavors, and popularity. However, their users routinely share highly sensitive and personal information, such as traumas, fantasies, desires, relationship difficulties, and other mental health concerns. This prompts the need for an empirical analysis of privacy practices in this ecosystem, and particularly the alignment between these apps' privacy policies and their actual behavior. In this paper, we present a comprehensive analysis of 25 popular Android mental health and life-coaching apps, combining static analysis, dynamic ","authors_text":"Chloe Georgiou, Emiliano De Cristofaro, Gene Tsudik, Hans Lu","cross_cats":["cs.CY"],"headline":"Mental health apps embed undisclosed trackers and send user data to AI services without clear policy disclosure.","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-03T18:42:08Z","title":"What's on Your Mind? Exploring Privacy of Mental Health Apps"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.02016","kind":"arxiv","version":3},"verdict":{"created_at":"2026-05-12T02:15:47.242529Z","id":"133db46c-72b4-446a-975d-3982acebb264","model_set":{"reader":"grok-4.3"},"one_line_summary":"Analysis of 25 mental health apps reveals all embed undisclosed trackers, 16 permission-policy contradictions, and unclear third-party AI processing, showing disclosure practices fall short of informed consent standards.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"Mental health apps embed undisclosed trackers and send user data to AI services without clear policy disclosure.","strongest_claim":"Our findings demonstrate that current disclosure practices fall short of the transparency required for meaningful informed consent.","weakest_assumption":"The 25 selected apps are representative of the broader mental health app ecosystem and that the combination of static analysis, dynamic capture, and LLM-assisted policy review fully captures all data-sharing behaviors without missing flows or false positives."}},"verdict_id":"133db46c-72b4-446a-975d-3982acebb264"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:213f02723d52a71c9376b66be909a6bd28062eba252cb1d33626219b14a3eabe","target":"record","created_at":"2026-06-02T01:03:47Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8820109916cc436f68aee9a14e614dd230eb3cd0b468bc6a46af54aaab67d4ef","cross_cats_sorted":["cs.CY"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-03T18:42:08Z","title_canon_sha256":"eb695582342f62c7ea4507c8bfbb73b3fc33051970321c8f5a7ab18d466881c2"},"schema_version":"1.0","source":{"id":"2605.02016","kind":"arxiv","version":3}},"canonical_sha256":"3ae3d132191469a6b544834b09ddf6da78d931874047c90b295fed9fe354b668","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3ae3d132191469a6b544834b09ddf6da78d931874047c90b295fed9fe354b668","first_computed_at":"2026-06-02T01:03:47.985666Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-02T01:03:47.985666Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"RNKYtd6hU0fscvYWpu++LZESR6wqHxbRqeJ15RsqOZc4PCEzVw+KpjWeeXSRh6v/angp4sM8Fn4NdREl5CPICg==","signature_status":"signed_v1","signed_at":"2026-06-02T01:03:47.986092Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.02016","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:213f02723d52a71c9376b66be909a6bd28062eba252cb1d33626219b14a3eabe","sha256:880742f98b9576ca017f1340cd8d9f5b6f6b714715f38617ea96624ad9eeb670"],"state_sha256":"662d4f30836243a0d537d9036dd395b7240e7c39d11fae8e5abe1a31e7d78665"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"oYbzaplcCZ94DJ7URBfdnjnWVnAFAgnFuRIN7jYN23PWSxUz18pPvK0qdQJX4s8ljsgKl99l2lCinmCDsnfmBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-19T10:58:16.011814Z","bundle_sha256":"66364bd64a2050c60d8872811a21f64f5366a5e193bcb1e7f8afb89e3c621baf"}}