CITT

    Scan results

    Picture Bird - Bird Identifier

    Android

    PictureBird is a bird identification app that uses image recognition to help birdwatchers identify species and discover hotspots.

    CITT SCORE
    78
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Identifying plants and birds on nature walks

    What It Means For You

    Activity is tracked by Firebase Analytics, Facebook, and Adjust, which share data with ad networks. Usage patterns and device identifiers are collected to personalize the experience and deliver targeted advertising. Data sharing with third parties is limited, which is a positive sign for user privacy.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (22)

    Data Security

    7 total
    3 Medium
    2 Low
    2 Info

    Network Security

    4 total
    1 High
    3 Medium

    Code Security

    5 total
    1 Medium
    3 Low
    1 Info

    Privacy

    6 total
    1 High
    2 Medium
    1 Low
    2 Info

    Third-Party Services

    Adjust, Firebase Core, Firebase Remote Config, Firebase Messaging (FCM), Firebase Performance, Firebase Crashlytics, Firebase Analytics, AWS S3, Google Play Billing, AgentWeb, OkHttp 3, Glide, Gson, RxJava / RxAndroid, Kotlin Coroutines, ExoPlayer 2, Facebook Stetho, Lottie (Airbnb), TensorFlow Lite

    Security Strengths

    • ✓Dynamic AWS STS credentials — no hardcoded S3 keys
    • ✓Firebase Crashlytics collection explicitly disabled
    • ✓Adjust SDK correctly consent-gated with EU DMA granular signals
    • ✓ADB backup disabled (android:allowBackup=false)
    • ✓All 43 first-party API message classes enforce HTTPS (forceHttps=true)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    location
    camera
    ads
    nature

    Package

    com.glority.picturebird

    Version

    2.9.32 (versionCode 87)

    Analysis Date

    Apr 6, 2026

    Classes Analyzed

    17,692

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Acceptable

    Key Findings

    Data Security - 7 findings (3 medium, 2 low, 2 info)

    Network Security - 4 findings (1 high, 3 medium)

    Code Safety - 0 findings

    Privacy - 6 findings (1 high, 2 medium, 1 low, 2 info)

    Privacy Concerns

    What Data is Collected

    Usage patterns and in-app interactions are collected through Firebase Analytics. Device identifiers and advertising IDs are gathered by Adjust and Firebase for attribution and personalization. Performance and stability data is collected via Firebase Crashlytics and Firebase Performance. Push notification preferences are stored via Firebase Messaging. Plant and bird identification is processed on the device using TensorFlow Lite.

    Third-Party Data Sharing

    Usage and device data is shared with Google (Firebase), Adjust, and Facebook. These services use this data for advertising attribution and may build profiles used to deliver targeted ads across other apps and websites. Cloud file storage and delivery is handled via AWS S3. The app's high Data Sharing score (95/100) reflects that data shared beyond these analytics services is limited.

    Understanding the Scores

    CategoryScore
    Security77/100
    Privacy79/100
    Data Security75/100
    Network Security71/100
    Code Safety88/100
    Data Collection76/100
    Data Sharing95/100
    User Control79/100

    Positive Security Features

    • Data sharing with third parties is tightly limited, with a 95/100 score indicating user information stays within a small set of known services
    • No findings in the Code Safety category, meaning the app's core logic does not exhibit common coding patterns that could expose user data
    • Plant and bird identification runs on the device using TensorFlow Lite, so photos are not transmitted to external servers for analysis

    Areas for Improvement

    • Network communications between the app and its servers could be better protected to reduce the chance that user data travels with less protection than expected
    • The combination of Firebase Analytics, Adjust, and Facebook integrations means in-app behavior contributes to advertising profiles that can follow users across other apps and services
    • Users have limited built-in options to reduce analytics collection or opt out of behavioral tracking within the app itself

    About This Analysis

    Static analysis of the app's compiled code and configuration was performed on 2026-04-06. Scores are based on observed practices and findings across security and privacy categories.

    App Details

    FieldValue
    Package IDcom.glority.picturebird
    Version2.9.32 (build 87)
    Scan Date2026-04-06
    PlatformAndroid

    Right of Reply

    Developer not yet contacted