CITT

    Scan results

    Hiya: Spam Blocker & Caller ID

    Android

    Hiya is a spam blocker and caller ID app providing real-time protection against scam calls with advanced AI-driven caller identification. Features include visual voicemail transcription, spam detection, number lookup, and call screening for safer communications.

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Users comfortable with ad and analytics data sharing

    Not For: You prefer not sharing data with advertising networks

    What It Means For You

    Usage patterns and device data are shared with Firebase, Google, and Groupon tracking for advertising purposes. RevenueCat tracks purchase activity, and Zendesk handles support interactions. The app has notable code quality concerns that could affect how safely user data is handled.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (25)

    Data Security

    6 total
    3 High
    3 Low

    Network Security

    3 total
    2 High
    1 Medium

    Code Security

    11 total
    3 Critical
    7 Medium
    1 Low

    Privacy

    5 total
    1 Critical
    2 High
    2 Medium

    Third-Party Services

    Firebase (Analytics, Performance, Crashlytics, App Check, Remote Config, In-App Messaging), Google Play Services, RevenueCat, Zendesk, Groupon tracking

    Security Strengths

    • ✓Play Integrity API anti-tampering implemented
    • ✓EncryptedSharedPreferences for premium data (AES-256-SIV/GCM)
    • ✓APK signature verification for anti-tampering
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    communications
    contacts
    phone calls
    sensitive data
    ads
    analytics
    tracking

    Package

    com.webascender.callerid

    Version

    Not specified in header

    Analysis Date

    Jan 31, 2026

    Classes Analyzed

    14,501

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (3 high, 3 low)

    Network Security - 3 findings (2 high, 1 medium)

    Code Safety - 0 findings

    Privacy - 5 findings (1 critical, 2 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    The app collects device identifiers, call activity data, usage patterns, and behavioral information. This data is associated with the user's device and processed across multiple analytics and advertising systems.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Firebase (Analytics, Performance, Crashlytics, App Check, Remote Config, In-App Messaging) - usage tracking, performance monitoring, and behavioral analytics
    • Google Play Services - core platform integration
    • RevenueCat - purchase and subscription activity tracking
    • Zendesk - customer support interactions
    • Groupon - advertising and marketing data sharing

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy45/100
    Data Security40/100
    Network Security70/100
    Code Safety30/100
    Data Collection55/100
    Data Sharing60/100
    User Control50/100

    Positive Security Features

    No notable positive security practices were identified in this version of the app.

    Areas for Improvement

    • User data is shared with advertising networks, including Groupon, beyond what is necessary to deliver the app's core spam-blocking service. Reducing this sharing would better protect user privacy.
    • Code quality concerns create risk that personal data may not be handled safely on the device. Addressing these issues would lower the chance of data being accessible to other apps or processes.
    • The ability to opt out of behavioral profiling or limit advertising data collection is restricted, giving users little control over how their information is used.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect observable security and privacy practices at the time of the scan.

    App Details

    • App: Hiya: Spam Blocker & Caller ID
    • Package: com.webascender.callerid
    • Scan Date: 2026-01-31

    Right of Reply

    Developer not yet contacted