Scan results

Recommendation: Elevated Risk

The overall score of 44/100 reflects solid security fundamentals alongside a substantially lower privacy score of 30/100. Four advertising networks (Google AdMob, Facebook Audience Network, Unity Ads, and Vungle) are linked in a paid security product alongside three analytics services, and the build's configuration may allow these to initialize before a consent dialog is presented on first launch. The Photo Vault feature's encryption key setup uses an iteration count far below current published guidance, which may reduce the effort required to guess a PIN if key files are obtained from shared device storage; this was not tested at runtime.

Key Findings

Data Security: 2 findings (1 medium, 1 low)

Network Security: 3 findings (1 medium, 2 low)

Code Safety: 5 findings (1 medium, 4 low)

Privacy: 3 findings (3 medium)

Privacy Concerns

What Leaves the Device

• Device advertising identifier and behavioral signals: shared with Google AdMob, Facebook Audience Network, Unity Ads, and Vungle for advertising
• App usage and session data: sent to Firebase Analytics and Adobe Analytics
• Install attribution data including advertising identifier: sent to Singular
• Call metadata (phone numbers, call direction, call outcomes, and device identifier): sent to Hiya (hiyaapi.com) for caller ID and call screening
• Crash and stability data: sent to Firebase Crashlytics

What Stays on the Device

• Installed app list: read for malware scanning and kept on the device, not shared with advertising networks or third-party services
• Photo Vault content: encrypted files are stored locally and not routed off the device

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google AdMob - advertising
• Facebook Audience Network - advertising
• Unity Ads - advertising
• Vungle / Liftoff - advertising
• Firebase Analytics - usage analytics
• Adobe Analytics - usage analytics
• Singular - install attribution
• Hiya - caller ID and call screening
• Firebase Crashlytics - crash reporting
• Auth0 - authentication

Understanding the Scores

Security: 78/100
Privacy: 30/100

Security Breakdown

• Data Security: 78/100. Build 26.6.0 applies hardware-backed protection for authentication data and disables app backup, preventing data from being extracted via Android backup mechanisms. The Photo Vault feature's encryption key setup uses a low-iteration approach relative to current published guidance, which may reduce its resistance to offline guessing if key files are obtained from shared external storage.

• Network Security: 85/100. Most connections in the build use encrypted transport, and specific domains used by the developer's own services are configured to require encryption. Two configuration files permit unencrypted connections globally, which may allow some bundled SDK traffic to use insecure channels; a typographical error in one configuration file means a domain-specific restriction for a detection endpoint does not take effect.

• Code Safety: 85/100. The build's authentication flow uses hardware-backed key storage, and the app backup feature is disabled. Four development and testing components are present in the production manifest and may be reachable by other installed apps, though their practical impact is limited.

Privacy Breakdown

• Data Collection: 22/100. Three analytics services (Firebase Analytics, Adobe Analytics, and Singular) are configured to initialize at app launch, potentially before the consent dialog is shown. Advertising identifiers may be included in early data flows during that window; runtime behavior was not observed to confirm whether server-side controls apply.

• Data Sharing: 26/100. The build links four advertising networks (Google AdMob, Facebook Audience Network, Unity Ads, and Vungle) that may pass device identifiers and behavioral signals to their respective platforms. The Hiya caller ID service is also configured to route call metadata, including phone numbers and call outcomes, to its own servers.

• User Control: 36/100. The build includes a data deletion request mechanism per the Data Safety label. Analytics and advertising services are configured to initialize before a consent decision may be recorded, and call metadata sharing with Hiya is not named in the Data Safety label, which may limit informed decision-making about that data flow.

Positive Security Features

• App backup is disabled for this build, preventing data from being extracted via Android backup or device transfer.
• Authentication data is protected by hardware-backed encryption, with the Android Keystore used to manage access.
• The VPN connection validates against a fixed server identity for the SurFEasy endpoint, adding resistance to network interception of VPN traffic.
• The installed app list is processed on the device for malware scanning and kept locally, not shared with advertising networks, analytics services, or other third parties.
• Security diagnostic telemetry is directed to the developer's own infrastructure, not to advertising networks or data brokers.

Areas for Improvement

Disclosure Observations

Observations about disclosure, each stated against published guidance so a reader can compare:

1. Advertising partner identification in Data Safety label
   Google's Data Safety policy requires apps to identify specific third-party organizations when data is shared for advertising purposes. The Play Store label retrieved on August 11, 2026 states the app "may share App activity, App info and performance, and Device or other IDs" with third parties but does not name Facebook, Unity, or Vungle as recipients. Code analysis confirms four advertising SDKs are linked in the build and may initialize automatically; whether a server-side gate prevents data from being shared before a user consent choice is recorded was not determinable from static analysis.

2. Caller ID data sharing not named in Data Safety label
   The Hiya caller ID SDK (v5.33.7) bundled in this build contains code paths that route call metadata, including phone numbers, call direction, and call outcomes, to hiyaapi.com. The Play Store Data Safety label retrieved on August 11, 2026 does not name Hiya or disclose call event data in its third-party sharing section. Whether Hiya's data upload path is gated on a user opt-in was not determinable from static analysis.

Security Enhancements

1. Photo Vault key configuration
   The Photo Vault derives its encryption key using an iteration count far below what current published guidance recommends. Increasing this count to current guidance levels would substantially raise the effort required to guess a PIN offline, particularly given that key files are stored in shared external storage where other apps with storage permissions may access them.

2. Photo Vault storage location
   The Photo Vault stores encrypted files and key material in shared external storage. Moving vault data to app-private storage would prevent other installed apps from accessing those files.

3. Development components in production manifest
   Three AndroidX Test instrumentation activities and one Compose development component are declared as exported in the production manifest, making them reachable by other installed apps. Excluding development-only components from release builds reduces the exposed interface.

4. Network configuration attribute correction
   A typographical error in one network security configuration file causes a domain-specific restriction for a detection endpoint to have no effect. Correcting the attribute name to the properly spelled form would restore the intended behavior.

Technical Context

App Type: Mobile security and privacy suite
Classes Analyzed: 132,302
Third-Party Services: 16
Context Tags: security, privacy, ads, sensitive_data

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Avast Software s.r.o.
Version: 26.6.0 (Build 260325387)
Analysis Date: August 12, 2026
Package: com.avast.android.mobilesecurity

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 26.6.0 analyzed on August 12, 2026
• May not reflect server-side security controls
• Cannot detect all runtime behaviors