Can I trust RemindMeWhere Reminders?
This app did not meet two or more trust checks, has a critical issue in one, or has a red flag.
- What it means for you
- Geofence locations and reminder data are stored on the device and are not shared with advertising networks. The app includes code to send usage data and authentication activity to Firebase Analytics and Facebook SDK. Cloud-synced data requires authentication before access.
- Main concern
- Firebase and Facebook SDKs include code to transmit GAID to third parties before user consent (GDPR)
- The developer's description
- RemindMeWhere is the ultimate location reminder app designed to help you stay organized and on top of your tasks. Whether you need to remember to pick up groceries, drop off a package, or call a friend when you're nearby, RemindMeWhere ensures you never miss a thing.
- Third-party services
- 17
- Findings rated low or higher
- 8
Open on Google PlayOpens the app's listing on Google Play in a new tab.
Full findings
Open this scan in your dashboardThe account that ran this scan sees every finding and the Rescan button there.
Trust checks
Secure by Design
StrongStrong security foundation
Why this result
This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.
Authentication credentials are encrypted using AES-256 with hardware-backed key storage on the device. Cloud backup and ADB extraction are both disabled by manifest configuration, closing those data-theft channels. The app's Firebase backend rejects unauthenticated access, confirmed by a live request that returned a permission-denied response. Exported Android components allow co-installed apps to trigger fake geofence events or start the location service unexpectedly, but neither path exposes sensitive data to a remote attacker or enables credential theft. No hardcoded secrets, weak cryptography, cleartext network traffic, or certificate validation bypass was found.
Data Minimization
One criterion not metTracking lacks clear disclosure
Why this result
This build contains analytics or attribution code written to send data to companies other than the developer. No consent step was found before that code runs, and the app's disclosures do not describe the collection in full. Tracking by itself is ordinary; what this check reports is the combination of collection, recipient and absent disclosure.
Manifest Mismatch
An item rated high or above is openDisclosure incomplete or contradicted
Why this result
The check compares the app's privacy disclosures against what the code does, and at least one claim did not match in this build. Mismatches of this kind include a data category collected but not disclosed, a recipient the disclosure omits, and an identifier attached to data the disclosure describes as anonymous.
User Control
StrongNo lock-in
Why this result
The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.
No proprietary data formats that would trap reminder content, no confirmed barriers to account deletion, and no artificial obstacles to switching services were identified in the app's code or behavior.
Red flags
The app's privacy declarations do not match its code
Why this result
The privacy declarations shipped in this build, or the ones on the store listing, state less than the code does. Declarations of this kind are what a store, a regulator and a person comparing two apps rely on.
Strengths
- Login credentials and auth tokens are encrypted with AES-256-GCM backed by the Android Keystore
- Backup channel is disabled (allowBackup=false), preventing extraction of local data via ADB or cloud backup
- Firebase Realtime Database is protected by security rules that require authentication before any data access
What the app contains
17 services
Third-party services the scan names in the build:
- Firebase Analytics
- Firebase Auth
- Firebase Realtime Database
- Firebase Firestore
- Firebase Cloud Messaging
- Firebase Installations
- Facebook SDK
- Google Play Services Auth
- Google Play Services Location
- Realm
- PairIP
- AppSet ID
- Install Referrer
- Google AdServices (Privacy Sandbox)
- flutter_background_service
- flutter_local_notifications
- flutter_secure_storage
Libraries
| Library | Version | Advisory |
|---|---|---|
| ExoPlayer / media3 | not recorded | none confirmed |
| Room | not recorded | none confirmed |
| Facebook SDK | 16.3.0 | none confirmed |
| Datatransport | not recorded | none confirmed |
| Google Advertising ID client | 12451000 | none confirmed |
| Google Sign-In | 12451000 | none confirmed |
| Google Play Services | 12451000 | none confirmed |
| Google Play Services Location | 12451000 | none confirmed |
| Play Core | not recorded | none confirmed |
| Play Integrity | not recorded | none confirmed |
Show all 18 librariesShow fewer
Method and limits
Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.
- Build SHA-256
- 4d4bf46cddc80a3f28c3832fcd9720e139ce69b56123b055f02c4056f9653c38
- Rule pack
- citt-ruleset-2026-08-v1
- Files decompiled
- 13,199
- Scan date
- 10 September 2026
Corrections
No correction is published for this app.
Developer response
No response is published for this app.
Report an error Opens an email to [email protected] that names this app and this scan.