Scan results

Recommendation: Safe & Privacy-Focused

SplitFlapSend demonstrates strong privacy practices with no analytics, minimal permissions, and all processing on-device. Safe for general use with no data collection.

Key Findings

Data Security - 0 findings

Network Security - 0 findings

Code Safety - 0 findings

Privacy - 0 findings

Privacy Concerns

What Data is Collected

No personal data is collected by this app. All message creation, video encoding, and GIF generation happen locally on your device. No user accounts are required and no information is transmitted to the developer.

Third-Party Data Sharing

No third-party data sharing was identified in this analysis.

Understanding the Scores

Security: 100/100
Privacy: 100/100

Security Breakdown

• Data Security: 100/100 - All processing is on-device with no data stored or transmitted externally
• Network Security: 100/100 - No backend server communication; network access is used only for Google Play Billing
• Code Safety: 100/100 - Pure Kotlin/Java code with no native binaries, no unsafe patterns identified

Privacy Breakdown

• Data Collection: 100/100 - Zero analytics, telemetry, or tracking of any kind
• Data Sharing: 100/100 - No data shared with any third parties
• User Control: 100/100 - No accounts, no profiles, no persistent identifiers collected

Positive Security Features

• No analytics or tracking - zero telemetry is collected from your device
• Minimal permissions - only network access for billing and license checks; no access to camera, microphone, location, contacts, or storage
• All processing on-device - message creation, video export, and GIF generation never leave your phone
• No user accounts - no sign-in, no profile, no personal information required to use the app
• External links open in your system browser rather than an in-app browser
• No native code - the entire app runs in the standard Android runtime with no low-level binary components

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices are already strong. One area to monitor:

1. Firebase Datatransport Dependency
   The app includes a dormant Google Firebase component pulled in as a side effect of Google Play Billing. It is not active today, but future updates that add Firebase features should be reviewed to ensure the privacy-first approach is maintained.

Security Enhancements

1. License Verification Network Traffic
   The app contacts Google Play servers for license verification at launch. This is standard practice for paid apps, but users on restricted networks should be aware that a network check occurs on startup.

Technical Context

App Type: Media and messaging utility (content rating: Everyone)
Classes Analyzed: 19,305
Third-Party Services: Google Play Billing, Google Play Services (GMS), Firebase Datatransport (dormant transitive dependency), PairIP License Check
Context Tags: media, messaging

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Mark Morris (uplink.to)
Version: 1.0.47 (Build 4)
Analysis Date: 2026-04-14
Package: com.markmorris.splitflapsend

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.0.47 analyzed on 2026-04-14
• May not reflect server-side security controls
• Cannot detect all runtime behaviors