CITT

    Scan results

    (my)cards

    Android

    Digitize loyalty, membership, and rewards cards in one secure place. Works offline with all data staying on your device. Supports barcode scanning, custom cards, and cloud backup.

    CITT SCORE
    50
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Organizing loyalty cards with standard analytics

    What It Means For You

    Usage patterns are tracked by Firebase and Mixpanel for analytics purposes. Locally stored card information may not be fully protected. The app provides limited options to control how data is handled once it leaves the device.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (11)

    Data Security

    3 total
    2 Critical
    1 Medium

    Network Security

    1 total
    1 Low

    Code Security

    1 total
    1 Critical

    Privacy

    5 total
    3 High
    2 Medium

    Third-Party Risk

    1 total
    1 Medium

    Third-Party Services

    Firebase Analytics, Mixpanel, Sentry, Google Drive API, Firebase Cloud Messaging, Google Play Services

    Security Strengths

    • ✓No WebView implementation (eliminates entire class of vulnerabilities)
    • ✓All SDKs up-to-date with no known CVEs
    • ✓HTTPS enforced for all network traffic
    • ✓Modern architecture with Jetpack Compose
    • ✓Code obfuscation enabled (R8/ProGuard)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    sensitive data
    ads
    financial

    Package

    com.rodehouse.storemycards

    Version

    1.3.5 (Build 197)

    Analysis Date

    Feb 6, 2026

    Classes Analyzed

    13,870

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (2 critical, 1 medium)

    Network Security - 1 finding (1 low)

    Code Safety - 0 findings

    Privacy - 5 findings (3 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    The app gathers data on how users interact with stored cards, including which cards are viewed and how frequently. Device identifiers and session information are collected to support analytics and crash reporting services.

    Third-Party Data Sharing

    Usage data is shared with the following third-party services:

    • Firebase Analytics - Tracks in-app activity and usage patterns
    • Mixpanel - Profiles user behavior for product analytics
    • Sentry - Receives crash and error reports that may include device information
    • Google Drive API - Enables backup and sync of card data
    • Firebase Cloud Messaging - Delivers push notifications
    • Google Play Services - Supports core platform functions

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy55/100
    Data Security35/100
    Network Security92/100
    Code Safety65/100
    Data Collection50/100
    Data Sharing55/100
    User Control40/100

    Positive Security Features

    • Network communications are handled securely, contributing to the app's strong network security score of 92/100.

    Areas for Improvement

    • Locally stored loyalty card data has limited protections, leaving it more accessible if someone gains access to the device.
    • Multiple analytics services collect behavioral data, and the app provides limited options to control or reduce this tracking.
    • Once data reaches third-party services like Mixpanel and Firebase, it falls under their separate privacy policies, reducing user visibility into how it is used.

    About This Analysis

    This scorecard reflects automated code analysis performed on the version listed below. Results represent the app's state at scan time and may not reflect later updates.

    App Details

    • App: (my)cards
    • Package: com.rodehouse.storemycards
    • Version: 1.3.5 (Build 197)
    • Scan Date: 2026-02-06

    Right of Reply

    Developer not yet contacted