Hiya: Spam Blocker & Caller ID Security & Privacy Scorecard
Android
Usage patterns and device data are shared with Firebase, Google, and Groupon tracking for advertising purposes. RevenueCat tracks purchase activity, and Zendesk handles support interactions. The app has notable code quality concerns that could affect how safely user data is handled.
Best for
Users comfortable with ad and analytics data sharing
Avoid if
You prefer not sharing data with advertising networks
Findings
- 4 critical
- 8 high
- 10 medium
- 4 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Deep Link URL Injection Enables File Access and JavaScript Execution
- Hardcoded Private Key with Weak Obfuscation
- Weak 512-bit RSA Key for Call Screener Encryption
Top privacy issues
- Phone Numbers Exposed in Firebase Performance Monitoring
- Analytics Initialized Before User Consent
- Extensive Multi-Platform User Profiling
Full analysis
Hiya: Spam Blocker & Caller ID
com.webascender.callerid | Scanned: 2026-01-31
What This Means for You
Usage patterns and device data are shared with Firebase, Google, and Groupon tracking for advertising purposes. RevenueCat tracks purchase activity, and Zendesk handles support interactions. The app has notable code quality concerns that could affect how safely user data is handled.
Recommendation: Use With Caution
Best For: Users comfortable with ad and analytics data sharing
Avoid If: You prefer not sharing data with advertising networks
Key Findings
Data Security - 6 findings (3 high, 3 low)
Network Security - 3 findings (2 high, 1 medium)
Code Safety - 0 findings
Privacy - 5 findings (1 critical, 2 high, 2 medium)
Privacy Concerns
What Data is Collected
The app collects device identifiers, call activity data, usage patterns, and behavioral information. This data is associated with the user's device and processed across multiple analytics and advertising systems.
Third-Party Data Sharing
User data is shared with the following third-party services:
- Firebase (Analytics, Performance, Crashlytics, App Check, Remote Config, In-App Messaging) - usage tracking, performance monitoring, and behavioral analytics
- Google Play Services - core platform integration
- RevenueCat - purchase and subscription activity tracking
- Zendesk - customer support interactions
- Groupon - advertising and marketing data sharing
Understanding the Scores
| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 45/100 |
| Data Security | 40/100 |
| Network Security | 70/100 |
| Code Safety | 30/100 |
| Data Collection | 55/100 |
| Data Sharing | 60/100 |
| User Control | 50/100 |
Positive Security Features
No notable positive security practices were identified in this version of the app.
Areas for Improvement
- User data is shared with advertising networks, including Groupon, beyond what is necessary to deliver the app's core spam-blocking service. Reducing this sharing would better protect user privacy.
- Code quality concerns create risk that personal data may not be handled safely on the device. Addressing these issues would lower the chance of data being accessible to other apps or processes.
- The ability to opt out of behavioral profiling or limit advertising data collection is restricted, giving users little control over how their information is used.
About This Analysis
This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect observable security and privacy practices at the time of the scan.
App Details
- App: Hiya: Spam Blocker & Caller ID
- Package: com.webascender.callerid
- Scan Date: 2026-01-31
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 40/100 |