Scan results

Recommendation: High Risk

BLOKK is marketed as a privacy focused VPN and blocker that keeps data on the device, but the analyzed build embeds several data flows that run counter to that claim: login information and behavioral telemetry directed at a development server, phone number lookups sent to an outside spam-detection service, and an active session recording tool. Given that a VPN and call-blocking app is entrusted with browsing history, call activity, and account access, CITT's scoring rubric weighs these findings, together with the exported broadcast receivers that can pause the app's core blocking function and unused provider keys compiled into the package, as material to the overall risk assessment.

Key Findings

Data Security: 2 findings (1 high, 1 low)

Network Security: 1 finding (1 high)

Code Safety: 6 findings (1 high, 2 medium, 3 low)

Privacy: 3 findings (3 high)

Privacy Concerns

What Leaves the Device

• Login information (username and password): sent as URL query parameters to a development server (app-dataprofile-dev.azurewebsites.net) during a login-related purchase lookup.
• VPN traffic history (resolved domains), data volume, WiFi status, country code, blocked app names, custom domain block/allow choices, and blocked call numbers: sent to the same development server, keyed to a persistent user identifier.
• Incoming caller phone numbers: sent to callerapi.com, a third-party spam-lookup service, for calls not already matched on the device.
• Screen touch events and navigation flow: positioned to upload to Microsoft through the bundled Clarity session recording tool, which is registered as an active, non-disabled service in the app's manifest. This code path was not observed running; whether and how often it fires was not tested.

What Stays on the Device

• Call and SMS numbers that match a locally stored list: checked against an on-device filter without a network lookup.
• Locally stored traffic, call, and SMS records: Android backup is disabled for this app, so these records are not extractable through standard device backup tools.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Microsoft (Clarity) - session recording (screen touch events, navigation flow)
• CallerAPI - phone number lookups for spam detection
• Firebase Analytics - app usage data
• Firebase Cloud Messaging - push notification delivery
• Google App Measurement - app usage and device data
• OneSignal - push notification delivery
• RevenueCat - subscription and purchase management
• Adyen - payment processing
• Cash App Pay - payment processing
• Google Play Billing - in-app purchase processing
• Amazon IAP - in-app purchase processing
• Microsoft MSAL - authentication library
• Google AdServices - advertising
• MaxMind - IP-based location lookup

Understanding the Scores

Security: 50/100
Privacy: 25/100

Security Breakdown

• Data Security: 55/100. Unused provider server keys and account details for several outside VPN services are compiled into the distributed package; runtime code does not reference them, but they are recoverable from the build. A separate file-sharing path is also configured more broadly than needed, though it is not reachable from outside the app.
• Network Security: 50/100. A login-related request builds its web address by embedding the username and password directly in the URL, which servers, proxies, and content-delivery logs along the request path typically record.
• Code Safety: 55/100. Two broadcast receivers are open to any other app installed on the device without a permission check, one of which can pause the app's tracker and ad blocking for five minutes at a time with no limit on repetition. Several lower-severity items round out this category, including a fixed authentication key and a broadly scoped web content bridge.

Privacy Breakdown

• Data Collection: 20/100. Beyond the account and network activity described above, the build sends detailed behavioral telemetry, including resolved domains, data volume, and blocked-app names, to a development server tied to a persistent user identifier, with no disclosure of this telemetry identified in the app's privacy policy.
• Data Sharing: 22/100. Caller phone numbers are sent to an outside spam-lookup service, and a session recording tool positioned to send screen activity to Microsoft is registered as an active service, both of which sit alongside a Play Store data safety label stating no data is shared with third parties.
• User Control: 35/100. The app advertises no-account operation and on-device-only data handling, but the data flows above are not surfaced to the user as optional or disclosed choices within the app itself.

Positive Security Features

• Android backup is disabled for this app, which keeps the locally stored traffic, call, and SMS databases out of reach of standard device backup and restore tools.
• Call and SMS number blocking against a locally stored list can run entirely on the device without a network lookup.
• Analytics traffic through the bundled Countly tool is directed to the developer's own server rather than an outside analytics vendor.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Third-party sharing label vs. bundled services
   Google Play's Data Safety guidance (https://support.google.com/googleplay?p=data-safety) asks developers to declare data shared with third parties. The label for this app, as retrieved, states "No data shared with third parties." Build 1.3.24 links the Microsoft Clarity session recording tool as an active, non-disabled service in its manifest, and contains code that sends incoming caller phone numbers to callerapi.com. Whether these code paths run in a typical user session, and how often, was not tested in this static analysis.

2. Collected data types vs. observed code paths
   The label also states "This app may collect these data types: App activity, App info and performance, and Device or other IDs." Build 1.3.24 additionally contains a code path that embeds login information in a URL sent to a development server, and a separate path that sends VPN traffic history and behavioral telemetry to the same server. Whether this reflects data categories beyond what is disclosed could not be fully determined without observing live network traffic.

Security Enhancements

1. Restrict the exported broadcast receivers
   The two broadcast receivers that any co-installed app can currently message could require a signature-level permission so only the app itself can pause blocking or restart its service.

2. Move login information out of the URL
   The login-related request could carry the username and password in the request body instead of the URL, reducing how often this data is written into server and proxy logs along the way.

3. Remove unused provider server keys from the distributed build
   The private server keys and account details for several outside VPN services compiled into the package are not referenced by any runtime code path and could be removed from future builds.

Technical Context

App Type: VPN and privacy/security tool (handles network traffic, call, and SMS data; higher sensitivity)
Classes Analyzed: 1,200
Third-Party Services: 15 identified
Context Tags: vpn, financial, sensitive_data, location, contacts, ads

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: MyPA Limited
Version: 1.3.24 (Build 1030024)
Analysis Date: 2026-08-14
Package: com.revokevpnapp

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.3.24 analyzed on 2026-08-14
• May not reflect server-side security controls
• Cannot detect all runtime behaviors