'%3e%3cpath%20d='M138%2095.6436V147H0V0H138V51.3564H59.3526V95.6436H138Z'%20fill='white'/%3e%3cpath%20d='M208%200V147H150V0H208Z'%20fill='white'/%3e%3cpath%20d='M361%200V51.4292H321.377V147H261.731V51.4292H220V0H361Z'%20fill='white'/%3e%3cpath%20d='M512%200V51.4292H472.939V147H414.139V51.4292H373V0H512Z'%20fill='white'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_1_12'%3e%3crect%20width='512'%20height='147'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Scan results
Pocket Casts - Podcast App
AndroidPocket Casts is the world's most powerful free podcast app with next-level listening, search and discovery tools. Features hand-curated podcast recommendations, playlists, smart filters, variable speed playback, and syncing across devices via cloud storage.
Quick Verdict
Best for: Podcast listeners comfortable with standard analytics
Not For: You log in on shared or work-managed devices
What It Means For You
Listening habits and in-app activity are tracked by Firebase Analytics and shared with Google. Crash reports sent to Sentry may include device and session details. Account data stored on-device may not be fully protected, so using this app on a shared device puts account information at greater risk.
Quick Verdict
Best for: Podcast listeners comfortable with standard analytics
Not For: You log in on shared or work-managed devices
What It Means For You
Listening habits and in-app activity are tracked by Firebase Analytics and shared with Google. Crash reports sent to Sentry may include device and session details. Account data stored on-device may not be fully protected, so using this app on a shared device puts account information at greater risk.
Method and Limitations
Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.
Findings (12)
Data Security
4 totalNetwork Security
5 totalCode Security
2 totalPrivacy
1 totalThird-Party Services
Security Strengths
- ✓Certificate pinning implemented (Let's Encrypt trust anchors)
- ✓No JavaScript interfaces (prevents RCE)
- ✓Current SDKs with no known CVEs
- ✓Privacy-conscious analytics (Sentry breadcrumbs disabled, Firebase ADID disabled)
- ✓Code obfuscation enabled (R8/ProGuard)
Version diff is on the Developer plan. See developer plans.
Context Tags
Package
au.com.shiftyjelly.pocketcasts
Version
7.101 (Build 9386)
Analysis Date
Jan 20, 2026
Was this analysis helpful?
Feedback helps us improve our analysis
Recommendation: Use With Caution
Key Findings
Data Security - 4 findings (1 critical, 2 high, 1 medium)
Network Security - 5 findings (1 medium, 2 low, 2 info)
Code Safety - 0 findings
Privacy - 1 finding (1 medium)
Privacy Concerns
What Data is Collected
The app collects listening activity, in-app behavior, and usage patterns. Crash reports include device identifiers and session details. Account information is stored locally on the device.
Third-Party Data Sharing
Data is shared with the following third-party services:
- Firebase Analytics (Google) - behavioral analytics and usage tracking
- Sentry - crash reporting, which may include device and session details
- Google Engage SDK - engagement and activity data
- Google Play Billing - purchase and subscription data
- Google Sign-In - account authentication data
- Chromecast - playback activity when casting
- Google Wear OS - activity data when using wearable integration
Understanding the Scores
| Category | Score |
|---|---|
| Security | 42/100 |
| Privacy | 48/100 |
| Data Security | 35/100 |
| Network Security | 78/100 |
| Code Safety | 72/100 |
| Data Collection | 75/100 |
| Data Sharing | 70/100 |
| User Control | 82/100 |
Positive Security Features
- No additional security measures beyond standard platform defaults were observed for this app.
Areas for Improvement
- How account information is stored on-device could be strengthened to better protect it if the device is accessed by someone else.
- Some outgoing connections could benefit from stronger safeguards to reduce the chance of data being intercepted in transit.
- The range of third-party services receiving usage data is broad. Users for whom privacy is a priority should weigh this before using the app.
About This Analysis
App Details
| Field | Value |
|---|---|
| App | Pocket Casts - Podcast App |
| Package ID | au.com.shiftyjelly.pocketcasts |
| Version | 7.101 (Build 9386) |
| Scan Date | 2026-01-20 |
Right of Reply
Developer not yet contacted