Scan results

Recommendation: TRUSTED

CITT rates RemindMeWhere Reminders at 84/100. Login information is protected with device-backed encryption, and precise location data stays on the device rather than going to advertising networks. Firebase Analytics and Facebook SDK components initialize at launch and may send analytics and advertising identifiers to Google and Meta, and the Play Store Data Safety section does not currently reflect this sharing.

Key Findings

Data Security: 1 finding (1 medium)

Network Security: 1 finding (1 low)

Code Safety: 5 findings (1 medium, 4 low)

Privacy: 1 finding (1 medium)

Privacy Concerns

What Leaves the Device

• Advertising identifier and session data: may be sent to Google via Firebase Analytics and to Meta via the Facebook SDK at launch (runtime behavior was not observed in this analysis).
• Account and reminder data: may be sent to Google Firebase servers to support the cross-device sync feature described in the app listing.

What Stays on the Device

• Precise location data: used on the device to trigger geofence reminders and not shared with advertising networks. This data stays under the user's control.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google (Firebase Analytics, Firebase Auth, Firebase Realtime Database, Firebase Firestore, Firebase Cloud Messaging, Google Play Services) - analytics, authentication, and cross-device data sync
• Meta (Facebook SDK) - app analytics and advertising measurement

Understanding the Scores

Security: 89/100
Privacy: 82/100

Security Breakdown

• Data Security: 89/100. Login information is protected with device-backed encryption. The local reminder database uses a storage library whose default behavior, when no encryption is configured, is to store data without encryption; the configuration visible in this build does not confirm whether encryption is applied at the application layer.
• Network Security: 97/100. All network communications in this build use encrypted connections and the overall network security posture is strong.
• Code Safety: 91/100. The app's core security architecture is solid, with login data protected by device-backed encryption and cloud-stored data gated behind account authentication.

Privacy Breakdown

• Data Collection: 83/100. Precise location data stays on the device. Analytics and advertising identifiers may be sent to Google and Meta at launch before any user action.
• Data Sharing: 84/100. Location data used for geofence reminders is not shared with advertising networks. Analytics data sharing with Google and Meta is not currently reflected in the Play Store Data Safety label.
• User Control: 85/100. Account data deletion can be requested per the Play Store listing, and cloud-stored reminder data requires account authentication before access.

Positive Security Features

• Login information is protected with device-backed encryption, making it resistant to extraction even if the device is compromised.
• App data is excluded from device backups, preventing extraction of local data via backup tools.
• Cloud-stored reminder data requires account authentication before any access is permitted.
• Precise location data used for geofence reminders stays on the device and is not shared with advertising networks.
• No advertising SDK is bundled in this build; the analytics and authentication components serve analytics and login functions, not ad serving.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Play Store Data Safety label and linked SDK discrepancy
   Google's Data Safety guidelines (support.google.com/googleplay?p=data-safety) require developers to disclose third-party data sharing. The Play Store page for this build (retrieved 2026-09-10) states "No data shared with third parties." The build links Firebase Analytics (Google) and the Facebook SDK (Meta), both of which may send analytics data and advertising identifiers to their respective servers at launch. Whether this sharing falls within the scope of the Data Safety form's definitions could not be determined from the build alone; a reader comparing the label against the linked libraries will see the difference.

Security Enhancements

1. Geofence notification handler access
   The geofence event handler in this build is configured to accept signals from any installed app on the device. Restricting it to accept signals only from the app's own components would reduce the risk of spoofed location-trigger events.

2. Local database encryption
   The local reminder database uses a storage library whose default behavior is to store data without encryption when no encryption configuration is applied. Confirming and documenting that encryption is enabled at the application layer would give users clearer assurance about the security of on-device reminder data.

3. Attribution data access restriction
   The Android attribution configuration in this build allows all installed apps to observe attribution events. Restricting this to a declared list of trusted partners would limit exposure of install source and campaign data to other apps on the device.

Technical Context

App Type: Productivity - location-based reminder
Classes Analyzed: 13,199
Third-Party Services: 17
Context Tags: location, privacy

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: VOLASIM Limited
Version: 1.1.22 (versionCode 48)
Analysis Date: 2026-09-10
Package: com.volasim.remindmewhere

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.1.22 analyzed on 2026-09-10
• May not reflect server-side security controls
• Cannot detect all runtime behaviors