CITT

    Scan results

    ClearVPN - Fast & Secure VPN

    Android

    ClearVPN is a hassle-free VPN for secure browsing, expanding online experience with 45+ country servers, DNS protection, ad-blocking, and support for up to 6 devices. Uses AES-256 encryption with no-log policy.

    CITT SCORE
    64
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Casual users wanting simple VPN protection

    Not For: You want to minimize install and usage tracking

    What It Means For You

    App installs, usage patterns, and device details are shared with AppsFlyer and Firebase for analytics and attribution. OneSignal can push notifications tied to a user activity profile. User data is not sold to third parties, but several services build a picture of how the app is used.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (12)

    Data Security

    2 total
    1 Medium
    1 Info

    Network Security

    2 total
    1 Medium
    1 Info

    Code Security

    3 total
    2 High
    1 Info

    Privacy

    4 total
    1 High
    2 Medium
    1 Info

    Permission Usage

    1 total
    1 Low

    Third-Party Services

    AppsFlyer, OneSignal, Sentry, Zendesk, Unleash, Firebase Messaging, Google Play Services

    Security Strengths

    • ✓Let's Encrypt certificate pinning
    • ✓EncryptedSharedPreferences with AES-256-GCM
    • ✓Firebase Analytics/Crashlytics explicitly disabled
    • ✓HTTPS enforcement across all endpoints
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    vpn
    privacy
    location
    ads
    sensitive data
    financial

    Package

    com.macpaw.clearvpn.android

    Version

    3.4.2 (108)

    Analysis Date

    Mar 24, 2026

    Classes Analyzed

    11,798

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 2 findings (1 medium, 1 info)

    Network Security - 2 findings (1 medium, 1 info)

    Code Safety - 0 findings

    Privacy - 4 findings (1 high, 2 medium, 1 info)

    Privacy Concerns

    What Data is Collected

    The app collects device identifiers, install source data, usage patterns, and notification interaction history. Error and crash reports, which may include device state at the time of a crash, are transmitted to Sentry.

    Third-Party Data Sharing

    Seven third-party services receive data from the device:

    • AppsFlyer - receives install and usage data to measure advertising attribution
    • Firebase Messaging - delivers push notifications and logs delivery events
    • OneSignal - manages notifications linked to a user usage profile
    • Google Play Services - handles app distribution and device integrations
    • Sentry - receives crash reports and error diagnostics
    • Zendesk - handles support requests if the user contacts the developer
    • Unleash - receives feature flag queries reflecting the app configuration

    Understanding the Scores

    CategoryScore
    Security75/100
    Privacy52/100
    Data Security98/100
    Network Security95/100
    Code Safety78/100
    Data Collection50/100
    Data Sharing100/100
    User Control70/100

    Positive Security Features

    • Server communications are protected with strong transport security across all network connections
    • Data stored on the device is protected using platform-level security mechanisms
    • Personal data stays within the app's declared service providers and is not passed to data brokers

    Areas for Improvement

    • Install and usage activity is shared with multiple analytics and attribution services, creating a behavioral profile across those platforms.
    • Notifications are managed through OneSignal with limited user control over how app activity shapes the user notification profile.
    • Seven third-party integrations collectively gather more information about app usage than the core service requires.

    About This Analysis

    This scorecard is based on static analysis of the app's code and configuration. Scores reflect security and privacy practices observed in this version.

    App Details

    • App Name: ClearVPN - Fast & Secure VPN
    • Package ID: com.macpaw.clearvpn.android
    • Version: 3.4.2 (108)
    • Scan Date: 2026-03-24

    Right of Reply

    Developer not yet contacted