PrepMyApp Security & Privacy Scorecard

PrepMyApp

What This Means for You

Your employment profile (salary expectations, resume, and work history) is stored in a way that could be accessed if your device is compromised, and your career data is shared with 8 separate analytics and advertising vendors.

Recommendation: Use With Caution

PrepMyApp stores sensitive employment profile data (salary, resume content, and work history) without protection on your device, making it accessible on modified devices or through physical device access. Your career information is also shared with 8 analytics vendors, which is unusually extensive for a productivity app handling sensitive professional data. Secure login protection and HTTPS communications reduce some risk, but users should be aware of the broad data sharing scope before installing.

Best For: Job seekers who want automated application convenience and do not use modified devices.

Key Findings

Data Security - 3 findings (1 medium, 2 info)

Network Security - 1 finding (1 low)

Code Safety - 1 finding (1 medium)

Privacy - 3 findings (2 low, 1 info)

Privacy Concerns

What Data is Collected

• Personal information: full name, phone number, email address
• Professional information: resume content, work history, education, skills, certifications, desired salary
• Financial information: in-app purchase history, subscription details
• Device information: device identifiers, advertising IDs
• Usage data: app interactions, job application activity, email metadata (Smart Email Management feature)

Third-Party Data Sharing

The following third parties may receive your data:

• Firebase Analytics - behavioral analytics and ad personalization
• Amplitude - product analytics
• AppsFlyer - mobile attribution and advertising measurement
• Adjust - attribution and performance analytics
• Branch - attribution analytics
• CleverTap - customer engagement analytics
• Mixpanel - product analytics
• Braze - marketing automation and messaging
• RevenueCat - subscription management (links your email and phone to cross-vendor advertising profiles)

Understanding the Scores

Security: 93/100
Privacy: 87/100

Security Breakdown

• Data Security: 90/100 - Employment profile data is stored without protection on-device, though login access is well-protected with hardware-backed device encryption.
• Network Security: 97/100 - All communications use HTTPS. A third-party billing script loads from an external server without integrity verification.
• Code Safety: 93/100 - The Apple Sign-In flow has a URL handling issue that could expose sign-in data if the browser navigates to an unexpected page during authentication.

Privacy Breakdown

• Data Collection: 88/100 - Collects comprehensive career information including resume content, work history, salary expectations, and email metadata via the Smart Email Management feature.
• Data Sharing: 87/100 - Career data is shared with 8 analytics vendors. The Play Store data safety disclosure understates the scope of this sharing.
• User Control: 90/100 - Data deletion is available on request. No user consent is requested before analytics tracking begins.

Positive Security Features

• Login access is protected using hardware-backed device encryption
• Device backups are disabled, preventing data extraction over USB
• Crash reporting data collection is explicitly disabled
• Backend integrity verification is active via Google Play
• All server communications use HTTPS

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. More Accurate Data Safety Disclosure
   The Play Store data safety section currently lists only financial info and device IDs as shared with third parties. Career PII (including resume and work history data) flows to 8 analytics vendors. Updating this disclosure would give users a clearer picture before installing.

2. Consent Before Analytics Initialization
   The developer is based in Berlin, Germany (EU GDPR jurisdiction). Implementing a user consent layer before analytics SDKs are initialized would align the app with GDPR requirements and give users meaningful control over which companies receive their career data.

3. Encrypted Profile Storage
   Employment profile data (salary expectations, resume, work history) stored on-device could be better protected by using the same encrypted storage already in place for login access. This would protect users if their device is ever accessed by someone else.

Security Enhancements

1. Apple Sign-In Flow Hardening
   The Apple Sign-In authentication flow could be improved by restricting which pages can access sign-in data during the process, preventing potential exposure if the browser navigates to an unexpected destination.

2. Billing Script Integrity
   The Paddle billing checkout loads a script from a third-party server without verifying the script has not been altered. Adding integrity verification would protect users if that external server were ever compromised.

Technical Context

App Type: Career automation and job application productivity - handles highly sensitive employment PII
Classes Analyzed: 320
Third-Party Services: 21
Context Tags: career, sensitive_data, email, ads, financial, location

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: PrepMyApp, LLC
Version: 1.2.11 (Build 30)
Analysis Date: April 13, 2026
Package: com.prepmyapp.mobile

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.2.11 analyzed on April 13, 2026
• May not reflect server-side security controls
• Cannot detect all runtime behaviors