CITT

    Scan results

    Nest

    Android

    Control your Nest thermostat, alarm system, cameras, and smoke/CO detector from one app. Manage your home remotely with real-time alerts, video streaming, and automation. Requires internet connection and compatible Nest devices.

    CITT SCORE
    68
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Homeowners managing Nest devices daily

    Not For: You prefer minimal analytics tracking

    What It Means For You

    Usage patterns and activity are tracked by Google Analytics and Firebase, which share data with Google's advertising infrastructure. Users have limited control over what is collected, and data flows through multiple third-party services. Network communication is well protected, so device data is sent with full protection.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (10)

    Data Security

    2 total
    1 Medium
    1 Low

    Code Security

    4 total
    1 High
    1 Medium
    2 Low

    Privacy

    4 total
    3 High
    1 Medium

    Third-Party Services

    Firebase Core, Firebase Crashlytics, Firebase Analytics, Firebase Performance, Firebase Remote Config, Firebase Cloud Messaging, Google Play Services, Google Analytics, Google Tink, Google Maps, AppAuth, OkHttp, gRPC, Glide, Android Volley

    Security Strengths

    • ✓EncryptedSharedPreferences with AES-256-GCM for all authentication tokens
    • ✓Android KeyStore integration with hardware-backed key storage
    • ✓OAuth 2.0 implementation using industry-standard AppAuth library
    • ✓Backup disabled (allowBackup=false) prevents credential leakage
    • ✓All production APIs use HTTPS with proper certificate validation
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    home automation
    camera
    location
    sensitive data
    google ecosystem
    privacy concern

    Package

    com.nest.android

    Version

    5.86.0.4

    Analysis Date

    Mar 27, 2026

    Classes Analyzed

    13,816

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 2 findings (1 medium, 1 low)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 4 findings (3 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    The app continuously collects behavioral data, device identifiers, usage patterns, performance metrics, and crash reports during normal operation. This information is gathered across sessions and tied to the device.

    Third-Party Data Sharing

    Data flows to multiple Google-owned services: Firebase Analytics, Firebase Crashlytics, Firebase Performance, Firebase Remote Config, Firebase Cloud Messaging, Google Analytics, Google Play Services, and Google Maps. Additional libraries including AppAuth, OkHttp, gRPC, Glide, and Android Volley are also integrated, each representing a separate data channel active while the app is in use.

    Understanding the Scores

    CategoryScore
    Security90/100
    Privacy58/100
    Data Security92/100
    Network Security100/100
    Code Safety92/100
    Data Collection60/100
    Data Sharing100/100
    User Control65/100

    Positive Security Features

    • All network communication uses strong, modern protection, so data sent between the app and servers travels with full protection.
    • Local data handling practices are solid, with no detected issues with how sensitive information is stored on the device.
    • The app code does not contain patterns associated with unsafe execution or easily bypassed protections.

    Areas for Improvement

    • Behavioral and usage data is shared with Google's advertising infrastructure, and there are limited in-app options to reduce the scope of what gets collected.
    • Multiple analytics and tracking services run simultaneously, meaning user activity is observed by several independent third-party systems during ordinary use.
    • User control over what data is gathered is restricted: the app does not provide granular opt-out settings for non-essential tracking.

    About This Analysis

    This scorecard is based on automated static analysis of the app binary. Scores reflect observed behaviors and practices at the time of the scan. Results represent a point-in-time assessment and may not reflect changes introduced in subsequent app updates.

    App Details

    • Package: com.nest.android
    • Version: 5.86.0.4
    • Scan Date: 2026-03-27
    • Platform: Android

    Right of Reply

    Developer not yet contacted