Skip to content
Menu

Can I trust The White House?

NOT ASSESSED 89 Android Version 47.0.1 (versionCode 20; Play Store shows 47.6.2 available) Scanned build downloaded: Store version released: Last checked: The Official White House gov.whitehouse.app Scanned

This app has an open trust check or a verdict held for review.

Best for
Staying current on White House news and updates
What it means for you
No advertising networks, attribution trackers, or behavioral analytics infrastructure is present in this build, and no data broker sharing is configured. The build links OneSignal and Firebase Cloud Messaging for push notifications, and Firebase Installations for device registration. Barcode scanning is configured for on-device processing only; authentication credentials are stored locally and excluded from cloud backup.
Main concern
OneSignal includes code to send a device fingerprint to third-party servers without user consent on first launch
The developer's description
Official White House app delivering real-time news alerts, live streams of presidential addresses, videos, photos, and direct messaging. Stay informed on executive actions, policy initiatives, and key developments straight from the White House.
Third-party services
11
Findings rated low or higher
5

How the score and the label work

Open on Google PlayOpens the app's listing on Google Play in a new tab.

Full findings

Open this scan in your dashboard

The account that ran this scan sees every finding and the Rescan button there.

Trust checks

  • Secure by Design

    Items recorded, result pending review

    Security gaps detected

    Why this result

    This check looks for security issues at high severity or above in the code of this build, and at least one was recorded. Issues of this kind include a credential or token another app on the device can reach, sensitive data stored without protection, and network paths that expose information in transit.

  • Data Minimization

    One criterion not met

    Tracking lacks clear disclosure

    Why this result

    This build contains analytics or attribution code written to send data to companies other than the developer. No consent step was found before that code runs, and the app's disclosures do not describe the collection in full. Tracking by itself is ordinary; what this check reports is the combination of collection, recipient and absent disclosure.

  • Manifest Mismatch

    Strong

    Everything visible

    Why this result

    The check compares the app's privacy disclosures against what the code does: the data categories collected, the companies named in code as their recipients, and the identifiers attached to each. The comparison covers the store listing, the in-app privacy text and any privacy manifest shipped in the build. Every claim compared matched the code here.

    The listing also correctly notes that collected data cannot be deleted, matching the push service's retention behavior. The absence of advertising identifiers is also accurately reflected. No mismatch between the declared data practices and the observed code behavior was identified.

  • User Control

    Strong

    No lock-in

    Why this result

    The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.

    The app delivers government news and civic content and does not store user-generated data in proprietary formats or hold user content on its own servers in ways that create barriers to switching. Push notification identifiers are tied to the device and cleared on uninstall. No artificial obstacles to leaving the service were identified.

Strengths

  • No advertising SDKs, attribution trackers, or behavioral analytics SDKs are present
  • No Google Advertising ID (GAID) is used or declared in the manifest
  • Auth credentials are stored using AndroidKeyStore-backed AES-256 encryption via Expo SecureStore
  • SecureStore data is excluded from both ADB and cloud backup
  • Google ML Kit barcode scanning processes data on-device only with no external transmission
  • All 13 native binaries are clean with zero memory safety findings and no custom JNI attack surface
  • Traffic is enforced over HTTPS with WebView SSL errors correctly rejected (cancel() not proceed())
  • No data is sold to data brokers; no advertising network or cross-app tracking infrastructure present

What the app contains

  • 11 services

    Third-party services the scan names in the build:

    • OneSignal
    • Firebase Cloud Messaging
    • Firebase Installations
    • Firebase Analytics Connector (stub)
    • Google ML Kit (Barcode)
    • OpenTelemetry
    • OkHttp3
    • Apollo GraphQL (Expo DevLauncher stub)
    • Expo DevLauncher/DevMenu/DevClient
    • Bouncy Castle
    • PairIP License Check

Libraries

Libraries in the build of The White House
LibraryVersionAdvisory
ExoPlayer / media3not recordednone confirmed
Roomnot recordednone confirmed
Apollo GraphQLnot recordednone confirmed
Fresconot recordednone confirmed
Glidenot recordednone confirmed
Datatransportnot recordednone confirmed
Google Sign-In12451000none confirmed
Google Play Services12451000none confirmed
Material Componentsnot recordednone confirmed
Gsonnot recordednone confirmed
Show all 23 libraries

Changes since the previous scan

  • Version 47.0.1 (versionCode 20; Play Store shows 47.6.2 available), score 89.
  • Score 99 before, 89 after.
  • Version 47.0.1 (build) / 47.5.2 (Play Store) before, 47.0.1 (versionCode 20; Play Store shows 47.6.2 available) after.
  • Score change since version 47.0.1 (build) / 47.5.2 (Play Store): -10 points.
  • Since the previous scan: 10 findings added, 6 removed.
  • Version 47.0.1 (build) / 47.5.2 (Play Store), score 99.
  • Score 91 before, 99 after.
  • Version 47.0.1 (versionCode 20) before, 47.0.1 (build) / 47.5.2 (Play Store) after.
  • Version 47.0.1 (versionCode 20), score 91.
  • Score 76 before, 91 after.
  • Version 47.0.1 (versionCode 20), score 76.
  • Score 74 before, 76 after.
  • Version 47.0.0 (Build 68) before, 47.0.1 (versionCode 20) after.
  • Version 47.0.0 (Build 68), score 74.
  • First public scan of this app.

Method and limits

Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.

Build SHA-256
36d63445d570fb61384a6bc541013322419dac90f94b2e3a39c8fba3633193fe
Rule pack
citt-ruleset-2026-08-v1
Files decompiled
24,334
Scan date
12 August 2026

Corrections

No correction is published for this app.

Developer response

No response is published for this app.

Report an error Opens an email to [email protected] that names this app and this scan.

On this page