CITT

    Scan results

    Bucket List: iBucket

    Android

    Create and share your bucket list together! Set life goals, plan trips, track places, and connect with your partner, couple, friends, or family — all in one app. Organize and achieve goals with day-by-day itineraries, cost tracking, and digital passport features.

    CITT SCORE
    77
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Tracking personal goals with minimal data exposure

    What It Means For You

    Usage patterns and crash data are shared with Google Firebase for analytics and app performance monitoring. Purchase activity flows through RevenueCat alongside Google Play and Amazon billing. Personal goals and list content stay largely private, with strong controls over what data leaves the device.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (9)

    Data Security

    3 total
    3 High

    Network Security

    1 total
    1 Critical

    Code Security

    3 total
    1 Medium
    2 Low

    Privacy

    2 total
    2 Medium

    Third-Party Services

    Firebase Analytics, Firebase Crashlytics, Firebase Performance, Firebase Cloud Messaging, Firebase Remote Config, Firebase App Check, Firebase Realtime Database, Firebase Cloud Storage, Google Sign-In, Apple Sign-In, RevenueCat, Google Play Billing, Amazon IAP

    Security Strengths

    • ✓HTTPS enforced for all network traffic (cleartext disabled)
    • ✓Proper Android KeyStore usage for biometric authentication with hardware-backed encryption
    • ✓No hardcoded server-side secrets or API keys
    • ✓Modern WebView security settings (file access disabled, mixed content blocked)
    • ✓Privacy-positive analytics architecture (no pre-consent tracking, ad-free)
    • ✓Properly protected exported components with signature-level permissions
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    social
    location
    camera
    financial
    sensitive data

    Package

    com.kaimallie.ibucket

    Version

    15.0.2 (versionCode 15021)

    Analysis Date

    Mar 9, 2026

    Classes Analyzed

    7,728

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (3 high)

    Network Security - 1 finding (1 critical)

    Code Safety - 0 findings

    Privacy - 2 findings (2 medium)

    Privacy Concerns

    What Data is Collected

    Usage patterns and crash reports flow to Firebase services automatically. Authentication identifiers are processed when users sign in through Google or Apple. Purchase history is recorded through RevenueCat, Google Play Billing, and Amazon IAP whenever a subscription is purchased or restored.

    Third-Party Data Sharing

    Data is shared with the following services:

    • Firebase (Google): Analytics, crash reporting, performance monitoring, push notifications, remote configuration, and cloud storage
    • RevenueCat: Purchase and subscription management
    • Google Play Billing: Payment processing
    • Amazon IAP: Payment processing
    • Google Sign-In / Apple Sign-In: Authentication

    Understanding the Scores

    CategoryScore
    Security62/100
    Privacy92/100
    Data Security60/100
    Network Security70/100
    Code Safety97/100
    Data Collection97/100
    Data Sharing97/100
    User Control94/100

    Positive Security Features

    • The app collects a minimal amount of personal information, limited to what is needed for core functionality
    • Strong user controls are in place over what data leaves the device, reflected in a 94/100 User Control score
    • Code quality is exceptionally clean, with very low risk of software defects affecting stored goals and lists

    Areas for Improvement

    • Data stored locally on the device could be better protected against unauthorized access if the phone is lost or shared with others.
    • The connection between the device and the app's servers needs stronger safeguards. User data may not be fully protected while it travels, particularly on public Wi-Fi.
    • Some data handling practices should be brought up to current standards to reduce the risk of user information being exposed.

    About This Analysis

    This scorecard is generated through automated static analysis of the application. Scores reflect the state of the app at the time of scanning and may not reflect subsequent updates.

    App Details

    • App Name: Bucket List: iBucket
    • Package ID: com.kaimallie.ibucket
    • Version: 15.0.2 (build 15021)
    • Scan Date: March 9, 2026
    • Platform: Android

    Right of Reply

    Developer not yet contacted