PhotoSync – Transfer Photos Security & Privacy Scorecard
Android
Usage data is shared with Firebase Analytics and Google Ads to track behavior and serve advertising. Photos move through multiple cloud services the user connects, and how that data is protected has notable weaknesses. Users have limited control over what is collected about them.
Best for
Photo transfers with standard analytics and ads
Avoid if
You store sensitive or private photos
Findings
- 3 critical
- 1 high
- 7 medium
- 2 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- EncryptedSharedPreferences Disabled via Hardcoded Flag
- Backup Enabled with Plaintext Credentials (allowBackup=true)
- ObjectBox Database Stores SSH Private Keys in Plaintext
Top privacy issues
- Undisclosed Analytics Collection Contradicts Play Store Claims
- Firebase Installation ID Enables Persistent User Tracking
- Cleartext Traffic Allowed (android:usesCleartextTraffic="true")
Full analysis
PhotoSync - Transfer Photos
What This Means for You
Usage data is shared with Firebase Analytics and Google Ads to track behavior and serve advertising. Photos move through multiple cloud services the user connects, and how that data is protected has notable weaknesses. Users have limited control over what is collected about them.
Recommendation: Use With Caution
Best For: Photo transfers with standard analytics and ads
Avoid If: You store sensitive or private photos
Key Findings
Data Security - 4 findings (2 critical, 1 high, 1 medium)
Network Security - 1 finding (1 info)
Code Safety - 0 findings
Privacy - 2 findings (1 critical, 1 medium)
Privacy Concerns
What Data is Collected
PhotoSync collects data about how users interact with the app, including which features are used, how often, and from which device. Behavioral patterns and device identifiers are used to build a profile for analytics and advertising. Subscription and purchase activity is also recorded.
Third-Party Data Sharing
User data is shared with the following services:
- Firebase Analytics - Tracks app usage and builds behavioral profiles
- Firebase Crashlytics - Receives app stability and performance reports from the device
- Google Ads - Uses behavioral data to serve targeted advertising
- RevenueCat - Manages subscription status and purchase records
- Cloud storage integrations (Google Drive, Dropbox, OneDrive, Box, Flickr, SmugMug, pCloud, AWS S3, Backblaze B2, Wasabi) - Photos pass through whichever of these services the user connects to
Understanding the Scores
| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 40/100 |
| Data Security | 30/100 |
| Network Security | 75/100 |
| Code Safety | 70/100 |
| Data Collection | 50/100 |
| Data Sharing | 45/100 |
| User Control | 40/100 |
Positive Security Features
No notable positive security practices were identified in this version of the app.
Areas for Improvement
- How photos and personal data are protected during storage and transfer has significant weaknesses that could leave user content exposed.
- The app offers limited options to reduce or opt out of data collection tied to advertising and behavioral profiling.
- Photos may pass through a wide range of cloud services with varying levels of protection, and the app does not consistently enforce strong safeguards across all of them.
About This Analysis
This scorecard reflects a technical review of the published app version listed below. It covers data handling practices, third-party integrations, and security configuration as found in the app itself.
App Details
- App: PhotoSync - Transfer Photos
- Package: com.touchbyte.photosync
- Version: 4.2.4 (6226)
- Scan Date: 2026-02-01
- Platform: Android
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 42/100 |