Scan results

Recommendation: Use With Caution

This app collects extensive behavioral data through its ad network integrations, including gesture patterns, motion sensor readings, and inferred location. The global disabling of secure connections for all ad traffic creates additional risk on public Wi-Fi. Casual gamers on trusted home networks face lower risk, but the depth of behavioral profiling across 18 ad SDKs warrants caution.

Key Findings

Data Security - 4 findings (1 medium, 3 low)

Network Security - 2 findings (1 medium, 1 low)

Code Safety - 1 finding (1 medium)

Privacy - 5 findings (1 high, 4 medium)

Privacy Concerns

What Data is Collected

• Advertising identifiers: device ad ID (IDFA) and vendor ID (IDFV)
• Biometric behavioral data: tap, swipe, and gesture coordinates with pressure, velocity, and orientation readings
• Device sensors: accelerometer and gyroscope readings (x/y/z axes)
• Approximate location: inferred from IP address by ad SDKs without a location permission prompt
• Device information: model, OS version, screen dimensions, battery level, and connection type
• App behavior: in-app interactions, frequency of play, and session data

Third-Party Data Sharing

The following third parties may receive your data:

• AppLovin MAX - ad mediation and behavioral targeting
• Meta Audience Network - advertising and device tracking
• Amazon APS - advertising and location-based targeting
• Google AdMob - advertising
• ATOM/Verve - behavioral profiling and audience segmentation
• BidMachine - real-time ad bidding
• InMobi - advertising
• Moloco - advertising
• Pangle/ByteDance - advertising
• TikTok Business SDK - advertising
• Mintegral - advertising
• Fyber/Digital Turbine - advertising
• HyBid/PubNative - advertising
• Unity Ads - advertising
• Vungle - advertising
• Firebase Crashlytics - crash reporting
• Firebase RemoteConfig - app configuration

Understanding the Scores

Security: 88/100
Privacy: 75/100

Security Breakdown

• Data Security: 83/100 - Biometric gesture data stored without encryption; development tool files accidentally bundled in the production app
• Network Security: 87/100 - Secure connections disabled globally for all ad traffic; standard ad click-handling behavior present
• Code Safety: 96/100 - Minimal system permissions with no elevated capabilities; a file access bridge in ad content views warrants attention

Privacy Breakdown

• Data Collection: 83/100 - Extensive behavioral profiling via ad SDKs including biometric gesture patterns and motion sensor data
• Data Sharing: 88/100 - Data shared with 17+ advertising networks and services
• User Control: 87/100 - Ad tracking consent prompt properly shown before any advertising ID access; Firebase Analytics disabled by developer

Positive Security Features

• Ad tracking transparency consent prompt properly implemented before any advertising identifier access across all ad SDKs
• Firebase Analytics explicitly disabled by the developer - no behavioral analytics collection occurs
• Minimal app permissions with no elevated system capabilities requested (no push notifications, no health data, no shared storage)
• No known security issues identified in any bundled SDK version as of the analysis date
• 267 privacy-preserving attribution identifiers registered, reducing reliance on direct user tracking for ad measurement

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Accurate App Store Privacy Label
   The top-level privacy declarations for the Unity framework do not reflect the tracking performed by five embedded ad SDKs (Meta, Google, BidMachine, Pangle, Unity Ads). Users reviewing the App Store privacy label receive an incomplete picture of data collection.

2. Biometric and Sensor Data Disclosure
   The ATOM/Verve SDK collects and stores gesture patterns, pressure readings, and motion sensor data for behavioral profiling. This data should be explicitly disclosed in the app's privacy policy and App Store label, where it is currently not declared.

3. Location Data Notice
   Approximate location is collected by the Amazon APS ad SDK via IP address inference. Users receive no notice of this collection because the app does not request a standard location permission.

Security Enhancements

1. Enable Secure Connections for Ad Traffic
   Disabling secure HTTP connections globally leaves ad-delivered content open to interception on public or compromised Wi-Fi networks, which could expose the ad-to-device communication channel.

2. Strengthen File Protection for Ad SDK Data
   Configuring a stronger file protection level for app-stored data would protect behavioral profiles and ad SDK caches when the device screen is locked.

Technical Context

App Type: Casual gaming, ad-supported, free-to-play
Classes Analyzed: 0 (binary analysis)
Third-Party Services: 20
Context Tags: ads, gaming

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Not available
Version: 3.9.5 (build 2900)
Analysis Date: 2026-04-14
Package: com.JindoBlu.OfflineGamesIOS

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 3.9.5 (build 2900) analyzed on 2026-04-14
• May not reflect server-side security controls
• Cannot detect all runtime behaviors