Scan results

Recommendation: Solid

Castify works well for streaming media to Chromecast, Roku, Fire TV, and compatible smart TVs. The app shares device and behavioral data with Google advertising and analytics services prior to consent, and the Play Store privacy disclosures understate the actual scope of third-party data sharing. The in-app browser's open file-access settings and unvalidated link handling are the main technical areas that could be strengthened.

Key Findings

Data Security: 0 findings

Network Security: 4 findings (3 medium, 1 low)

Code Safety: 4 findings (3 high, 1 low)

Privacy: 4 findings (1 medium, 3 low)

Privacy Concerns

What Data is Collected

• Device information: device identifiers are shared with Google AdMob for ad targeting
• Usage data: app session and interaction data are shared with Firebase Analytics
• Crash and diagnostic data: device model, OS version, and app state at the time of a crash are shared with Firebase Crashlytics
• Interest categories: cross-app behavioral interest topics are inferred on-device via Google's Privacy Sandbox and shared with ad servers with each ad request
• Downloaded media filenames: stored in the public Downloads folder on the device

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google AdMob - behavioral advertising and device targeting
• Firebase Analytics - session and usage analytics
• Firebase Crashlytics - crash reporting and device diagnostics
• Google Play Install Referrer - install attribution tracking
• ConnectSDK - multi-device casting support for DLNA, Roku, Samsung, and LG
• Amazon WhisperLink/WhisperPlay - Fire TV casting support
• Facebook - App ID is declared in the app configuration; no SDK code was found, so the extent of any data sharing is unclear from code review alone

Understanding the Scores

Security: 72/100
Privacy: 81/100

Security Breakdown

• Data Security: 79/100. Primary connections to the castify.tv backend use HTTPS, and cloud backup of app data is disabled, protecting locally stored data from extraction via device backup on Android 12 and above.
• Network Security: 80/100. Most server connections are secured with HTTPS. The in-app browser allows users to bypass connection security warnings with a single tap, and casting connections to Samsung TVs use a custom validation approach that checks URL patterns rather than certificate identity.
• Code Safety: 80/100. Core app functionality is well-structured. The in-app browser component accepts unvalidated external links and uses open file-access settings, which represent the main areas where hardening would meaningfully reduce risk.

Privacy Breakdown

• Data Collection: 82/100. Device identifiers and behavioral data are shared with Google's advertising and analytics services. Crash reporting begins transmitting data on first launch before any user consent is requested.
• Data Sharing: 88/100. Data flows are concentrated within Google's ecosystem for advertising, analytics, and crash reporting. The Play Store Data Safety section inaccurately declares no third-party data sharing, which does not reflect the app's actual data flows.
• User Control: 82/100. Users can request data deletion per the Play Store listing. Controls over ad tracking initialization and crash reporting could be tied more directly to in-app consent flows.

Positive Security Features

• All primary API connections to the castify.tv backend use HTTPS
• Samsung TV casting connections use a restricted certificate authority, limiting which certificates are trusted for casting commands
• Cloud backup of app data is disabled, protecting app data from being extracted via backup on Android 12 and above

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Accurate Play Store Privacy Disclosures
   The Play Store Data Safety section declares no third-party data sharing, but device identifiers, behavioral data, and crash reports are shared with Google's advertising and analytics services. Updating the disclosure to accurately reflect actual data flows would improve transparency for users.

2. Consent-Gated Crash Reporting
   Firebase Crashlytics initializes and begins transmitting diagnostic data on first launch, before any user consent dialog can execute. Deferring initialization until after consent is obtained would better align with privacy regulations.

Security Enhancements

1. In-App Browser File Access Restrictions
   The in-app browser is configured to allow scripts on loaded pages to read local device files. Disabling universal file access in the browser settings would significantly reduce the risk associated with opening untrusted links.

2. Link Validation Before Loading
   External links routed into the in-app browser are loaded without any domain validation or user confirmation. Restricting which domains can be opened automatically, or confirming with the user before loading external URLs, would reduce exposure.

Technical Context

App Type: Media casting and streaming utility
Classes Analyzed: 18,575
Third-Party Services: 13
Context Tags: streaming, casting, ads, media

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: CASTIFY INC.
Version: 12.299 (versionCode 10299)
Analysis Date: 2026-07-18
Package: com.castify

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 12.299 analyzed on 2026-07-18
• May not reflect server-side security controls
• Cannot detect all runtime behaviors