CITT

    Scan results

    Pokémon GO

    Android

    Pokémon GO is an action-adventure mobile game where players explore their real-world surroundings to find and catch Pokémon creatures. With 500M+ downloads and Editor's Choice status, it combines location-based gameplay with multiplayer features and in-app purchases.

    CITT SCORE
    48
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Casual players comfortable with broad data sharing

    Not For: You limit location access to trusted apps only

    What It Means For You

    User location, device identifiers, and activity are shared with advertising and analytics companies including Facebook, AppsFlyer, and Quago. Gameplay behavior is tracked across multiple third-party platforms for targeting purposes. Ads are served based on profile data built from this activity.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (22)

    Data Security

    6 total
    1 Critical
    1 High
    4 Medium

    Network Security

    4 total
    1 Critical
    1 High
    2 Medium

    Code Security

    7 total
    1 Critical
    3 Medium
    3 Low

    Privacy

    2 total
    1 High
    1 Medium

    Third-Party Risk

    1 total
    1 Medium

    Permission Usage

    2 total
    1 Medium
    1 Low

    Third-Party Services

    Quago, AppsFlyer, Helpshift, Usabilla, Sentry, Firebase, Facebook SDK, Unity Ads, Google Play Services, Google Maps

    Security Strengths

    • ✓Modern AES-256-GCM encryption with Android Keystore
    • ✓No JavaScript interfaces exposed in WebViews (eliminates RCE risk)
    • ✓Privacy-conscious analytics configuration (Firebase/Facebook analytics disabled)
    • ✓Parameterized database queries (no SQL injection risk)
    • ✓Debug mode properly disabled in release builds
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    location
    gaming
    sensitive data
    camera
    behavioral tracking
    ads
    in app purchases
    social

    Package

    com.nianticlabs.pokemongo

    Version

    Latest (as of scan)

    Analysis Date

    Feb 11, 2026

    Classes Analyzed

    11,312

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (1 critical, 1 high, 4 medium)

    Network Security - 4 findings (1 critical, 1 high, 2 medium)

    Code Safety - 0 findings

    Privacy - 2 findings (1 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    Pokémon GO collects precise location continuously during gameplay, device identifiers, and detailed records of in-app activity including gameplay routes, item purchases, and interaction patterns. This data is used both to operate the game and to build an advertising profile tied to the device.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • Facebook SDK - Behavioral data for ad targeting and attribution
    • AppsFlyer - Install attribution and cross-app behavioral analytics
    • Quago - Location and device-level analytics
    • Unity Ads - Ad delivery and targeting
    • Firebase - Analytics and crash reporting
    • Helpshift - In-app customer support
    • Usabilla - User feedback and experience data
    • Sentry - Error and performance monitoring
    • Google Play Services - Platform and identity services
    • Google Maps - Mapping and location services

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy52/100
    Data Security40/100
    Network Security48/100
    Code Safety55/100
    Data Collection58/100
    Data Sharing62/100
    User Control68/100

    Positive Security Features

    • No positive security practices were identified during this analysis.

    Areas for Improvement

    • The number of advertising and analytics services receiving behavioral and location data is high, extending data sharing well beyond what core gameplay requires.
    • Controls that would let users limit data sharing with third-party advertising partners while still using the app are minimal.
    • Data transmitted to multiple tracking services increases the number of companies that can build a profile of location patterns and gameplay habits over time.

    About This Analysis

    This scorecard is based on static analysis of the app's code and observable data-handling behavior. Scores reflect the security and privacy posture of the version analyzed and are intended to help everyday users make informed decisions.

    App Details

    • App Name: Pokémon GO
    • Package ID: com.nianticlabs.pokemongo
    • Version: Latest (as of scan)
    • Scan Date: 2026-02-11
    • Platform: Android

    Right of Reply

    Developer not yet contacted