CITT

    Scan results

    GoDaddy Investor

    Android

    GoDaddy Investor is a mobile app for domain investors to monitor, bid, and manage expired domain auctions in real-time. Features include real-time auction monitoring, bidding capabilities, proxy bids, fingerprint authentication, auction history tracking, and GoDaddy's domain appraisal values to info

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: GoDaddy shareholders comfortable with analytics

    What It Means For You

    In-app behavior and session activity is recorded by FullStory, which captures detailed screen interactions. Usage data is also shared with Firebase Analytics and Singular for analytics and attribution tracking. Crash reports and feedback submitted within the app may be processed by third-party services outside GoDaddy.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    4 total
    2 Critical
    1 High
    1 Medium

    Network Security

    1 total
    1 High

    Code Security

    4 total
    1 Critical
    2 High
    1 Medium

    Privacy

    4 total
    2 High
    2 Medium

    Third-Party Risk

    2 total
    2 High

    Third-Party Services

    FullStory, Firebase Crashlytics, Firebase Analytics, Apptentive, Singular, Parse, Split.io, Realm

    Security Strengths

    • ✓Backup disabled (appropriate for financial app)
    • ✓WebView debugging disabled in release builds
    • ✓FullStory consent-gated (only analytics SDK with consent)
    • ✓HTTPS everywhere (all API endpoints use HTTPS)
    • ✓In-memory cache clearing on logout
    • ✓Conservative retry policy prevents duplicate bids
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    domains
    authentication
    payment

    Package

    com.godaddy.gdm.investorapp

    Version

    4.9.23 (Build 201)

    Analysis Date

    Feb 3, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (2 critical, 1 high, 1 medium)

    Network Security - 1 finding (1 high)

    Code Safety - 0 findings

    Privacy - 4 findings (2 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    GoDaddy Investor collects data about in-app behavior, screen interactions, and session activity. This includes device identifiers, usage patterns, and any feedback submitted within the app.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • FullStory - Records detailed screen interactions and session replays for behavior analysis
    • Firebase Analytics - Tracks usage patterns and in-app behavior
    • Firebase Crashlytics - Receives crash reports that may include device and session details
    • Singular - Receives attribution and analytics data about how the app is used
    • Apptentive - Processes feedback and in-app survey responses
    • Parse - Used for backend data processing
    • Split.io - Receives usage data to manage feature availability
    • Realm - Handles local data storage on the device

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy45/100
    Data Security30/100
    Network Security80/100
    Code Safety40/100
    Data Collection50/100
    Data Sharing60/100
    User Control55/100

    Positive Security Features

    • None identified in this version.

    Areas for Improvement

    • Data security practices need strengthening, particularly around how sensitive information is stored and protected on the device.
    • Behavioral data is shared with multiple third-party analytics and attribution services, with limited visibility or opt-out controls available to users.
    • Crash reports and feedback submissions may transmit details about the device and app activity to external services outside GoDaddy's direct control.

    About This Analysis

    This scorecard is based on analysis of the app's compiled code and configuration. Scores reflect observed behaviors and practices at the time of this review.

    App Details

    • App: GoDaddy Investor
    • Package: com.godaddy.gdm.investorapp
    • Version: 4.9.23 (Build 201)
    • Analysis Date: 2026-02-03
    • Platform: Android

    Right of Reply

    Developer not yet contacted