CITT

    Scan results

    Meta Horizon

    Android

    Meta Horizon is a social VR platform by Meta Platforms Inc connecting users to Oculus/Meta Quest experiences. Rated 4.5 stars with 10M+ downloads, it supports social features, gaming, and cross-platform integration with Meta services.

    CITT SCORE
    80
    out of 100
    TRUSTED

    Quick Verdict

    Best for: VR enthusiasts comfortable with Meta's ecosystem

    What It Means For You

    Activity is tracked across Meta, Google, Spotify, and Firebase services. Purchase and usage data flows through multiple analytics systems tied to the user's account. Some network connections send data with less protection than expected, but stored data and personal information are handled carefully.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (11)

    Data Security

    2 total
    2 Medium

    Network Security

    4 total
    2 Critical
    1 High
    1 Medium

    Code Security

    3 total
    3 Medium

    Privacy

    2 total
    2 Medium

    Third-Party Services

    Facebook Core SDK, Facebook Analytics, Facebook RTC (WebRTC), Facebook MQTT, Firebase Cloud Messaging, Firebase Core, Google Play Billing, Google Sign-In, Google Analytics, Google Cast, Google Play Services, Spotify SDK, React Native, OkHttp, Retrofit

    Security Strengths

    • ✓Certificate pinning implemented for Meta domains
    • ✓E2EE keys stored using EncryptedSharedPreferences with Android KeyStore
    • ✓Consent management system implemented
    • ✓SQL injection prevention via parameterized queries
    • ✓Backup disabled (android:allowBackup="false")
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    social
    vr
    messaging
    e2ee
    location
    camera
    contacts
    cross app tracking
    analytics heavy
    meta ecosystem

    Package

    com.oculus.twilight

    Version

    363.0.0.30.297

    Analysis Date

    Mar 26, 2026

    Classes Analyzed

    40,955

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 2 findings (2 medium)

    Network Security - 4 findings (2 critical, 1 high, 1 medium)

    Code Safety - 0 findings

    Privacy - 2 findings (2 medium)

    Privacy Concerns

    What Data is Collected

    Meta Horizon collects account information, VR interaction patterns, purchase history, and usage activity linked to the user's Meta account. This includes how users navigate experiences, in-app purchases processed through Google Play Billing, and audio preferences tied to the Spotify SDK.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • Meta platform (Facebook Core SDK, Facebook Analytics, Facebook RTC, Facebook MQTT): activity, usage, and real-time communication data shared within Meta's ecosystem
    • Google services (Firebase Cloud Messaging, Firebase Core, Google Analytics, Google Play Services, Google Sign-In, Google Cast, Google Play Billing): account identifiers and usage metrics
    • Spotify SDK: audio and music preference data associated with the user's session
    • Networking libraries (OkHttp, Retrofit, React Native): used for app functionality and server communication

    Understanding the Scores

    CategoryScore
    Security73/100
    Privacy97/100
    Data Security92/100
    Network Security69/100
    Code Safety96/100
    Data Collection97/100
    Data Sharing100/100
    User Control97/100

    Positive Security Features

    • Data stored on device is well-protected against unauthorized access
    • The app's code integrity measures are strong, reducing the risk of unwanted modification
    • Data sharing practices are transparent and meet high privacy standards
    • User controls provide meaningful options for managing personal data
    • No unnecessary data collection practices were identified

    Areas for Improvement

    • Some network connections do not enforce the strongest available protections, which means user data may not be fully protected during transmission under certain conditions.
    • A small number of network-level configurations allow connection patterns to be observed by third parties, even when content itself is protected.
    • Aligning network security practices with the app's otherwise strong data handling standards would provide more consistent protection across all data flows.

    About This Analysis

    App Details

    • App: Meta Horizon
    • Package: com.oculus.twilight
    • Version: 363.0.0.30.297
    • Scan Date: 2026-03-26
    • Total Findings: 11 (2 critical, 1 high, 8 medium)

    Right of Reply

    Developer not yet contacted