ONECTA Security & Privacy Scorecard
Android
Usage activity and device data are sent to Firebase Analytics and Google. Location is accessed to support device mapping features. Network protections have notable weaknesses, so using the app on untrusted Wi-Fi networks carries some risk to user account data.
Best for
Controlling your Daikin AC from your phone
Findings
- 2 critical
- 3 high
- 9 medium
- 3 low
- 0 info
17 issues identified across security and privacy analysis.
Top security issues
- Complete SSL/TLS Validation Bypass in Custom HTTP Module
- Hardcoded IoT Device Credentials (Altherma Telnet Backdoor)
- XOR-Encrypted OAuth Client Secrets in APK
Top privacy issues
- Pre-Consent Analytics Tracking with Persistent Device Identifiers
- Unencrypted SQLite Database for App State Storage
- Conflicting Firebase Analytics Privacy Settings
Full analysis
ONECTA
Security Score: 50/100 | Privacy Score: 77/100
Version 3.45.1-17247 | Scanned 2026-03-25
What This Means for You
Usage activity and device data are sent to Firebase Analytics and Google. Location is accessed to support device mapping features. Network protections have notable weaknesses, so using the app on untrusted Wi-Fi networks carries some risk to user account data.
Recommendation: Use With Caution
Best For: Controlling your Daikin AC from your phone
Key Findings
Data Security - 4 findings (4 medium)
Network Security - 2 findings (1 critical, 1 high)
Code Safety - 0 findings
Privacy - 3 findings (1 high, 1 medium, 1 low)
Privacy Concerns
What Data is Collected
ONECTA collects usage activity, device identifiers, and location data. This information supports features such as device mapping and helps improve service performance.
Third-Party Data Sharing
Data is shared with the following third-party services:
- Firebase Analytics and Firebase Remote Config (Google) - behavioral and usage data
- Google Play Services (Maps, Location, Ads ID, Auth) - location and device identity
- Sentry - error and diagnostic reporting
- AppAuth - authentication support
- Firebase Messaging and Firebase In-App Messaging - push notification delivery
Understanding the Scores
| Category | Score |
|---|---|
| Security | 50/100 |
| Privacy | 77/100 |
| Data Security | 77/100 |
| Network Security | 52/100 |
| Code Safety | 57/100 |
| Data Collection | 79/100 |
| Data Sharing | 100/100 |
| User Control | 84/100 |
Positive Security Features
- The app's third-party data sharing practices received a perfect score, keeping user data within expected service boundaries rather than dispersing it broadly across advertising networks.
- User control options scored well above average, giving users meaningful choices over how their data is handled within the app.
Areas for Improvement
- The app's network protections have serious weaknesses that could leave user account data less protected when connecting on public or untrusted Wi-Fi networks.
- Some data the app stores on the device could be better secured to reduce the risk of other installed apps accessing it.
- The app's code safety practices fall below average, which may affect how reliably the app protects user information across different usage situations.
About This Analysis
This scorecard reflects automated analysis of the app's compiled code as of the scan date. It is intended to help users make informed decisions about their app choices.
App Details
| App Name | ONECTA |
| Package ID | com.daikineurope.online.controller |
| Version | 3.45.1-17247 (Build 34501001) |
| Scan Date | 2026-03-25 |
| Total Findings | 17 (2 critical, 3 high, 9 medium, 3 low) |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 58/100 |