Culture Cloud Security & Privacy Scorecard
Android
In-app behavior is recorded by FullStory, which can capture screen interactions and session replays. User activity is also tracked by Firebase and Google Analytics. Some data protections fall short of expectations, meaning sensitive information submitted may not be fully protected.
Best for
Employees required to use it for workplace recognition
Avoid if
You prefer work apps that don't record your screen activity
Findings
- 2 critical
- 4 high
- 5 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Unencrypted OAuth Tokens in Storage
- Hardcoded Database Encryption Passphrase
- Debugging Tools Active in Production Build
Top privacy issues
- FullStory Session Recording Without User Consent
- Missing FLAG_SECURE on Activities with Award Amounts
- Exposed API Keys and Firebase Credentials
Full analysis
Culture Cloud
Security Score: 45/100 | Privacy Score: 55/100
What This Means for You
In-app behavior is recorded by FullStory, which can capture screen interactions and session replays. User activity is also tracked by Firebase and Google Analytics. Some data protections fall short of expectations, meaning sensitive information submitted may not be fully protected.
Recommendation: Use With Caution
Best For: Employees required to use it for workplace recognition
Avoid If: You prefer work apps that don't record your screen activity
Key Findings
Data Security - 4 findings (2 critical, 2 high)
Network Security - 1 finding (1 high)
Code Safety - 0 findings
Privacy - 2 findings (2 medium)
Privacy Concerns
What Data is Collected
Culture Cloud collects behavioral and interaction data throughout user sessions. FullStory captures screen activity and session replays of in-app behavior. Firebase and Google Analytics collect usage patterns, device information, and engagement data. The Embrace SDK gathers performance and stability information from the device.
Third-Party Data Sharing
User data is shared with the following external services:
- FullStory - Screen and session recording
- Firebase Analytics - Usage and behavioral analytics
- Google Analytics - Engagement and activity tracking
- Embrace SDK - App performance monitoring
- Tenor GIF API - GIF content delivery
- Pluto - In-app diagnostic tooling
- Stetho - In-app diagnostic tooling
Understanding the Scores
| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 55/100 |
| Data Security | 35/100 |
| Network Security | 65/100 |
| Code Safety | 50/100 |
| Data Collection | 60/100 |
| Data Sharing | 70/100 |
| User Control | 50/100 |
Positive Security Features
- No positive security features were identified in this version of the app.
Areas for Improvement
- Sensitive data entered in the app may not be stored with adequate protections, putting personal and workplace information at risk.
- Session activity is recorded by third-party services without clear in-app notice, limiting user awareness and control over what is captured.
- Some communications between the app and its servers lack adequate protection, and data may travel with less protection than expected.
About This Analysis
This scorecard is based on static analysis of the app's code and configuration. Results reflect the state of the app at the time of the scan.
App Details
- App: Culture Cloud
- Package ID: com.octanner.android.culturecloud
- Version: 1.26.1 (Build 1117)
- Scan Date: 2026-02-08
- Platform: Android
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 50/100 |