CITT

    Scan results

    PhotoSync – Transfer Photos

    Android

    Wirelessly transfer, backup and share photos & videos between Android devices, computers, cloud services (Google Drive, Dropbox, OneDrive), NAS, and mobile storage. Features automatic background sync, cross-platform support with native apps.

    CITT SCORE
    42
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Photo transfers with standard analytics and ads

    Not For: You store sensitive or private photos

    What It Means For You

    Usage data is shared with Firebase Analytics and Google Ads to track behavior and serve advertising. Photos move through multiple cloud services the user connects, and how that data is protected has notable weaknesses. Users have limited control over what is collected about them.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (18)

    Data Security

    4 total
    2 Critical
    1 High
    1 Medium

    Network Security

    1 total
    1 Info

    Code Security

    5 total
    2 Medium
    2 Low
    1 Info

    Privacy

    2 total
    1 Critical
    1 Medium

    Third-Party Risk

    5 total
    3 Medium
    2 Info

    Permission Usage

    1 total
    1 Info

    Third-Party Services

    Firebase Crashlytics, Firebase Analytics, Google Ads, RevenueCat, Google Drive, Dropbox, OneDrive, Box, Flickr, SmugMug, pCloud, AWS S3, Backblaze B2, Wasabi

    Security Strengths

    • ✓Modern encryption available (AES-256, RClone, Libsodium)
    • ✓No critical code vulnerabilities (SQL injection, XSS, RCE)
    • ✓HTTPS for all cloud services
    • ✓No custom WebView JavaScript interfaces
    • ✓Production build properly configured (DEBUG=false)
    • ✓Password masking in UI
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    cloud storage
    sensitive data
    ads
    analytics
    location
    photo video

    Package

    com.touchbyte.photosync

    Version

    4.2.4 (6226)

    Analysis Date

    Feb 1, 2026

    Classes Analyzed

    1,912

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (2 critical, 1 high, 1 medium)

    Network Security - 1 finding (1 info)

    Code Safety - 0 findings

    Privacy - 2 findings (1 critical, 1 medium)

    Privacy Concerns

    What Data is Collected

    PhotoSync collects data about how users interact with the app, including which features are used, how often, and from which device. Behavioral patterns and device identifiers are used to build a profile for analytics and advertising. Subscription and purchase activity is also recorded.

    Third-Party Data Sharing

    User data is shared with the following services:

    • Firebase Analytics - Tracks app usage and builds behavioral profiles
    • Firebase Crashlytics - Receives app stability and performance reports from the device
    • Google Ads - Uses behavioral data to serve targeted advertising
    • RevenueCat - Manages subscription status and purchase records
    • Cloud storage integrations (Google Drive, Dropbox, OneDrive, Box, Flickr, SmugMug, pCloud, AWS S3, Backblaze B2, Wasabi) - Photos pass through whichever of these services the user connects to

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy40/100
    Data Security30/100
    Network Security75/100
    Code Safety70/100
    Data Collection50/100
    Data Sharing45/100
    User Control40/100

    Positive Security Features

    No notable positive security practices were identified in this version of the app.

    Areas for Improvement

    • How photos and personal data are protected during storage and transfer has significant weaknesses that could leave user content exposed.
    • The app offers limited options to reduce or opt out of data collection tied to advertising and behavioral profiling.
    • Photos may pass through a wide range of cloud services with varying levels of protection, and the app does not consistently enforce strong safeguards across all of them.

    About This Analysis

    This scorecard reflects a technical review of the published app version listed below. It covers data handling practices, third-party integrations, and security configuration as found in the app itself.

    App Details

    • App: PhotoSync - Transfer Photos
    • Package: com.touchbyte.photosync
    • Version: 4.2.4 (6226)
    • Scan Date: 2026-02-01
    • Platform: Android

    Right of Reply

    Developer not yet contacted