Scan results

Recommendation: TRUSTED

CITT rates this build trustworthy for casual gaming. The binary links Firebase Analytics and AdMob, which are not reflected in the Play Store Data Safety label. Hardware-backed secure storage and no required user login contribute to the overall trustworthiness of this build.

Key Findings

Data Security: 1 finding (1 medium)

Network Security: 1 finding (1 medium)

Code Safety: 1 finding (1 low)

Privacy: 2 findings (2 medium)

Privacy Concerns

What Leaves the Device

• Behavioral data (app interactions, session events, device identifiers): may be shared with Firebase Analytics for usage analytics
• Advertising identifiers and ad impression data: may be shared with Google AdMob for ad delivery and measurement
• Interest-category signals and conversion attribution data: may be shared with participating ad technology companies via Android Privacy Sandbox APIs

What Stays on the Device

• Game state and progress data: stored locally on the device

Third-Party Data Sharing

Third parties that may receive data from the app:

• Google (Firebase Analytics) - behavioral analytics and session data
• Google (AdMob) - ad delivery and measurement
• Ad technology companies participating in Android Privacy Sandbox - interest categorization and conversion attribution

Understanding the Scores

Security: 90/100
Privacy: 78/100

Security Breakdown

• Data Security: 88/100. Strong protection for stored data. Sensitive data uses hardware-backed Android Keystore encryption, and device backups are disabled to prevent unauthorized extraction.
• Network Security: 85/100. Core communications use HTTPS. A build-level flag also permits unencrypted connections, with a recommendation addressed in the Areas for Improvement section.
• Code Safety: 95/100. Excellent code safety posture. No user account system eliminates an entire class of login-data risks, and no sensitive personal data types are handled by the build.

Privacy Breakdown

• Data Collection: 82/100. The build bundles ad and analytics services that may share behavioral and advertising data with Google. No health, financial, biometric, location, contact, or message data is involved.
• Data Sharing: 90/100. Data sharing is limited to Google's services and the developer's own servers. No data brokers or additional advertising networks are present beyond AdMob.
• User Control: 83/100. No user account is required. The Privacy Sandbox configuration could be narrowed to restrict which advertising technology companies can access interest-category signals.

Positive Security Features

• Sensitive stored data uses hardware-backed Android Keystore encryption
• ADB backup and Google Drive Auto Backup are disabled, preventing data extraction from the device
• No user account is required, eliminating login data theft and account takeover as attack surfaces
• No health, financial, biometric, location, contact, or message data is involved
• Games run offline after downloading, with no ongoing server calls during gameplay
• Data sharing is limited to Google (Firebase, AdMob) and the developer's own servers; no data brokers or additional advertising network integrations are present

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Play Store Data Safety label
   The Play Store Data Safety section for this app, as retrieved on 2026-09-10, declares "No data collected" and "No data shared with third parties." The build bundles Firebase Analytics and Google AdMob components configured to auto-start at application launch. Google's Firebase Play Data Disclosure guide states that apps using Firebase Analytics must declare App Interactions, Device IDs, and Advertising IDs in the Data Safety form when these integrations are present. Whether the label was accurate at the time of its original submission could not be determined from the binary alone.

2. Privacy Sandbox access scope
   The build includes an ad services configuration that sets access to "allow all" for both the Android Privacy Sandbox Topics API and Attribution API. Google's AdMob developer documentation recommends restricting access to explicitly listed ad technology companies rather than all participants, to limit the scope of data sharing.

Security Enhancements

1. Restrict unencrypted connections
   The build permits HTTP connections for all network paths via a global flag in the app manifest. Adding a Network Security Configuration to restrict connections to HTTPS would reduce the risk of tampered content being delivered over unencrypted connections, particularly for game bundle downloads.

2. Browser storage data protection
   Session data cached in the browser storage layer could be moved to hardware-backed secure storage, consistent with how other sensitive data is already protected elsewhere in the build.

3. Custom URL scheme restrictions
   The custom URL scheme registered in the app manifest could be strengthened by adding host and path constraints, or by migrating to verified App Links, to limit which URIs other installed apps can deliver to this app.

Technical Context

App Type: Arcade/casual gaming, ad-supported, rated Everyone
Classes Analyzed: 5,726
Third-Party Services: 12
Context Tags: ads, analytics, offline, gaming

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: VOLASIM Limited
Version: 1.1.5 (versionCode 62)
Analysis Date: 2026-09-10
Package: gg.akedo.akedo_app

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.1.5 (versionCode 62) analyzed on 2026-09-10
• May not reflect server-side security controls
• Cannot detect all runtime behaviors