CITT

    Scan results

    Xfinity Stream

    Android

    Watch live TV, sports, movies, and shows with Xfinity Stream. Access 250+ channels of live TV on the go, stream On Demand content, schedule DVR recordings from any device, and download to watch offline. Requires Xfinity or NOW TV subscription.

    CITT SCORE
    68
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Xfinity subscribers comfortable with broad data sharing

    Not For: You want to limit ad targeting and data profiling

    What It Means For You

    Viewing habits, device activity, and usage patterns are tracked by multiple analytics and advertising companies including Adobe, Nielsen, Google, and Oracle BlueKai. The data is used to build ad profiles and measure audiences across platforms. Users have limited control over this data collection.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (13)

    Data Security

    1 total
    1 Medium

    Network Security

    4 total
    1 Critical
    3 Medium

    Code Security

    4 total
    2 Medium
    2 Low

    Privacy

    4 total
    1 Critical
    1 High
    2 Medium

    Third-Party Services

    Adobe Analytics, Nielsen Digital Measurement, Sift Science, Firebase Analytics, Google Analytics, Firebase Crashlytics, Firebase Cloud Messaging, Firebase Remote Config, Google Play Services Cast, FreeWheel, Oracle BlueKai

    Security Strengths

    • ✓EncryptedSharedPreferences for token storage (AES-256-GCM)
    • ✓Backup protection enabled (allowBackup=false)
    • ✓Code obfuscation enabled (R8/ProGuard)
    • ✓SQL injection protection via Room ORM
    • ✓Modern AndroidX Jetpack libraries
    • ✓Hardware-backed encryption keys via Android Keystore
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    streaming
    video
    ads
    location
    extensive tracking
    multi vendor analytics
    sensitive data

    Package

    com.xfinity.cloudtvr

    Version

    8.13.0.2840

    Analysis Date

    Jan 31, 2026

    Classes Analyzed

    20,110

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 1 finding (1 medium)

    Network Security - 4 findings (1 critical, 3 medium)

    Code Safety - 0 findings

    Privacy - 4 findings (1 critical, 1 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    The app collects viewing habits, device identifiers, usage patterns, and behavioral signals. This data is used to measure audiences, personalize content recommendations, and deliver targeted advertising.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • Adobe Analytics
    • Nielsen Digital Measurement
    • Sift Science
    • Firebase Analytics
    • Google Analytics
    • Firebase Crashlytics
    • Firebase Cloud Messaging
    • Firebase Remote Config
    • Google Play Services Cast
    • FreeWheel
    • Oracle BlueKai

    Understanding the Scores

    CategoryScore
    Security72/100
    Privacy65/100
    Data Security85/100
    Network Security68/100
    Code Safety80/100
    Data Collection60/100
    Data Sharing62/100
    User Control55/100

    Positive Security Features

    • No standout positive security practices were identified in this version of the app.

    Areas for Improvement

    • User data is shared with over ten advertising and analytics services, including behavioral profiling platforms such as Oracle BlueKai and FreeWheel, giving a wide range of companies access to viewing activity and device usage.
    • User control over data collection and use is limited, reflected in a User Control score of 55/100, with no clear in-app options to opt out of audience measurement or advertising data use.
    • Data sent between the app and remote services may travel with less protection than expected.

    About This Analysis

    This scorecard is based on static analysis of the app binary and configuration at the version listed below. Scores reflect observed data practices, third-party integrations, and security configuration at the time of analysis.

    App Details

    • App Name: Xfinity Stream
    • Package ID: com.xfinity.cloudtvr
    • Version: 8.13.0.2840
    • Scan Date: 2026-01-31

    Right of Reply

    Developer not yet contacted