Scan results

Recommendation: Use With Caution

Hearoes delivers structured auditory rehabilitation training with fully secured network communications and no advertising networks in the data pipeline. The primary concern is transparency: Firebase Analytics initializes automatically without a user consent step, and the developer's Play Store privacy label declares no data is shared with third parties, which the code does not support. Hearing training progress goes to the developer's own Firebase backend and is not passed on to data brokers or ad platforms.

Key Findings

Data Security: 1 finding (1 high)

Network Security: 0 findings

Code Safety: 7 findings (1 medium, 6 low)

Privacy: 1 finding (1 high)

Privacy Concerns

What Leaves the Device

• Behavioral data and device identifiers: sent to Google via Firebase Analytics for app usage tracking
• Google Advertising ID, purchase receipts, subscription details, and device information: sent to RevenueCat for subscription management

What Stays on the Device

No sensitive data was identified as processed only on the device.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google (Firebase Analytics) - behavioral analytics and device event tracking
• RevenueCat - subscription and purchase management

Understanding the Scores

Security: 73/100
Privacy: 48/100

Security Breakdown

• Data Security: 42/100. Subscription state and backup data are stored on the device without encryption, creating risk on older Android versions. For a health-adjacent app where subscription status can indicate a hearing impairment, this is worth addressing.
• Network Security: 100/100. All communications use HTTPS or WSS (TLS). No unencrypted connections were identified.
• Code Safety: 88/100. Strong overall code safety posture. Several lower-severity configuration issues exist in Unity game engine components and the Android manifest, including an exported activity without a permission requirement and a debug module compiled into the production build.

Privacy Breakdown

• Data Collection: 74/100. Firebase Analytics initializes at app launch and sends behavioral data and device identifiers to Google without a user consent gate. The advertising identifier is passed to RevenueCat for subscription management.
• Data Sharing: 80/100. Sharing is limited to analytics and subscription management partners. No data brokers, ad networks, or session recording services are present in the code.
• User Control: 75/100. Both RevenueCat and Unity honor the system-level "Limit Ad Tracking" setting and skip advertising ID collection when opted out. No in-app consent mechanism is present for analytics collection.

Positive Security Features

• All network communications use HTTPS or WSS (TLS). No unencrypted connections were identified.
• Firebase backend access is protected by Play Integrity attestation, preventing unauthorized access from modified or sideloaded installs.
• Memory safety hardening is active in the native code layer, detecting heap corruption in the Unity binary at runtime.
• No advertising networks are present. Despite having advertising ID permissions, no ad SDK receives behavioral targeting data.
• Hearing training data is stored in the developer's own Firebase infrastructure and is not shared with data brokers or third-party analytics aggregators.
• Both RevenueCat and Unity honor the system-level ad tracking opt-out and skip advertising ID collection when Limit Ad Tracking is enabled.

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Accurate Play Store Data Safety disclosure
   The Play Store privacy label states no data is shared with third parties. Updating it to reflect that behavioral data goes to Google Firebase Analytics and subscription data goes to RevenueCat would bring the disclosure into alignment with what the code shows.

2. User consent before analytics initialization
   Firebase Analytics starts collecting data at app launch before any user action. Adding a consent step before analytics activates would align with the expectations of GDPR and CCPA.

Security Enhancements

1. Restrict Android backup scope
   Explicitly configuring backup rules to exclude subscription state, sign-in data, and purchase metadata would prevent that data from being accessible via device backup tools on Android 9 and below.

2. Remove debug modules from production builds
   A Firebase App Check debug module is compiled into the production APK. Stripping it from release builds reduces the information available to anyone inspecting the app.

Technical Context

App Type: Auditory rehabilitation and hearing training (health-adjacent), Unity game engine
Classes Analyzed: 0
Third-Party Services: 21 identified
Context Tags: health, sensitive_data, financial

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: GAMES 4 HEAROES PTY LTD
Version: 1.4.05 (versionCode: 330014005)
Analysis Date: 2026-08-06
Package: com.Games4Hearoes.G4H

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.4.05 analyzed on 2026-08-06
• May not reflect server-side security controls
• Cannot detect all runtime behaviors