Storytel - Audiobooks Library Security & Privacy Scorecard

by Storytel Sweden AB · iOS

92
Overall trust score
Very Secure
90
Security
96
Privacy

Listening habits and app usage are shared with Firebase Analytics, Adjust, Facebook, and Braze for measurement and marketing. Google and Facebook ad conversion tools can link in-app activity to ad campaigns seen elsewhere. Usercentrics manages consent, so data-sharing choices depend on which permissions are granted at setup.

Best for

Audiobook lovers comfortable with standard analytics

Findings

  • 0 critical
  • 0 high
  • 4 medium
  • 4 low
  • 6 info

1 issue identified across security and privacy analysis.

Top security issues

  • Colibrio DRM license API secret hardcoded in Info.plist — enables DRM license impersonation against colibrio.storytel.net
  • ATS cleartext HTTP allowed on all 12 first-party storytel.* TLDs including all subdomains — broad interception surface on untrusted networks
  • Keychain auth credentials stored with deprecated kSecAttrAccessibleAlways — accessible regardless of device lock state on compromised devices

Top privacy issues

  • kSecAttrSynchronizable may expose session/refresh tokens to iCloud Keychain — compromised Apple ID gives access without device
  • GoogleAdsOnDeviceConversion v3.3.0 lacks PrivacyInfo.xcprivacy — on-device ad conversion tracking not disclosed in App Store privacy label
  • NSPrivacyTrackingDomains for Adjust consent misplaced in Info.plist — tracking domains absent from App Store privacy label aggregation

Full analysis

Version 26.14.0 (Build 1245.1) | Analyzed: 2026-04-09

Overall Score: 93/100 (A)

What This Means for You

Listening habits and app usage are shared with Firebase Analytics, Adjust, Facebook, and Braze for measurement and marketing. Google and Facebook ad conversion tools can link in-app activity to ad campaigns seen elsewhere. Usercentrics manages consent, so data-sharing choices depend on which permissions are granted at setup.

Recommendation: Trustworthy

Best For: Audiobook lovers comfortable with standard analytics

Key Findings

Data Security - 4 findings (3 medium, 1 info)

Network Security - 4 findings (1 medium, 1 low, 2 info)

Code Safety - 0 findings

Privacy - 2 findings (1 low, 1 info)

Privacy Concerns

What Data is Collected

The app collects listening activity, including which titles are opened, how long a user listens, and where playback stops. Device identifiers, app usage patterns, and account details are gathered to personalize the experience and measure engagement with content.

Third-Party Data Sharing

User data is shared with these services:

  • Firebase Analytics and GoogleAppMeasurement - tracks app usage so the developer can understand usage patterns across the user base
  • Adjust - a mobile attribution service that records installs and in-app events to measure the effectiveness of advertising campaigns
  • Facebook iOS SDK - sends signals so Facebook can determine whether their ads contributed to user activity in the app
  • Braze - a marketing platform that uses in-app behavior to send targeted push notifications and in-app messages
  • GoogleAdsOnDeviceConversion - connects in-app actions to Google ad campaigns seen outside the app

Understanding the Scores

Category Score
Security 90/100
Privacy 96/100
Data Security 91/100
Network Security 90/100
Code Safety 96/100
Data Collection 97/100
Data Sharing 97/100
User Control 98/100

Positive Security Features

  • Usercentrics consent management lets users decide which data-sharing permissions to grant before tracking begins, giving users meaningful control at setup
  • Firebase App Check is used to verify that the app communicates only with its own services, reducing exposure to interference
  • Standard authentication protocols protect account access via GoogleSignIn and AppAuth
  • Secure on-device storage is used for account session data

Areas for Improvement

  • Some locally stored app data uses configurations that could be strengthened to better protect against access on a shared or compromised device
  • A small number of outbound connections could apply stricter transport security settings for stronger protection in transit
  • Privacy preference controls could be surfaced more prominently within the app so users can review or adjust data-sharing choices after the initial setup

About This Analysis

This report is based on automated static analysis of the app binary and associated code. Scores reflect observed security and privacy practices at the time of the scan.

App Details

  • Package: com.storytel.iphone
  • Version: 26.14.0 (Build 1245.1)
  • Scan Date: 2026-04-09
  • Analysis Method: Static binary and code analysis

Versions & scan history

ScanDateOverall score
#1 (current) 92/100