CITT

    Scan results

    Yuka - Food & Cosmetic Scanner

    Android

    Yuka scans food, beauty & personal care products to evaluate their impact on your health using a simple color code. With 77 million users, it provides detailed ingredient analysis and independent product recommendations without advertising.

    CITT SCORE
    90
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Health-conscious shoppers comfortable with Google and

    What It Means For You

    Scans, usage patterns, and account activity are shared with Firebase Analytics, Google, and Facebook. Crash reports and performance data are sent to Google automatically. Barcode scans and product interactions help personalize the experience but are processed by multiple third-party services.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (7)

    Data Security

    1 total
    1 Low

    Network Security

    1 total
    1 Low

    Code Security

    3 total
    2 Medium
    1 Low

    Privacy

    2 total
    1 Medium
    1 Low

    Third-Party Services

    Firebase Analytics, Firebase Crashlytics, Firebase Authentication, Firebase Firestore, Firebase Storage, Firebase Remote Config, Firebase Performance, Firebase In-App Messaging, Firebase Cloud Messaging, Google ML Kit, Google Play Services, Facebook SDK, Algolia Search, Scandit DataCapture SDK, Pairip License Protection

    Security Strengths

    • ✓SQLCipher database encryption (AES-256)
    • ✓HTTPS-only enforcement via targetSdkVersion 36
    • ✓Proper SSL/TLS validation without bypass
    • ✓Privacy-friendly SDK configuration (advertising disabled)
    • ✓WebView file access disabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    food
    health
    barcode scanning
    camera
    location
    analytics
    third party sdks
    firebase

    Package

    io.yuka.android

    Version

    4.54.1 (build 834)

    Analysis Date

    Jan 30, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 1 finding (1 low)

    Network Security - 1 finding (1 low)

    Code Safety - 0 findings

    Privacy - 2 findings (1 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    • Barcode scans and product lookups
    • Account activity and app usage patterns
    • Crash reports and performance diagnostics, sent to Google automatically
    • Device identifiers and behavioral interaction data

    Third-Party Data Sharing

    • Firebase Analytics - usage and behavioral tracking
    • Google Play Services and ML Kit - core app functions and crash reporting
    • Facebook SDK - behavioral data, potentially used for advertising
    • Algolia Search - product and ingredient search queries
    • Scandit DataCapture SDK - barcode scanning processing
    • Pairip License Protection - app license verification

    Understanding the Scores

    CategoryScore
    Security92/100
    Privacy88/100
    Data Security98/100
    Network Security95/100
    Code Safety92/100
    Data Collection85/100
    Data Sharing100/100
    User Control80/100

    Positive Security Features

    • Network communications are well-protected, keeping user data secure in transit
    • Data handling practices are strong, with high scores for how user information is stored and managed
    • Third-party data sharing earned a perfect score, indicating controlled and transparent practices
    • The app's code is built with careful security practices, reducing risk from software flaws

    Areas for Improvement

    • Behavioral data is shared with Facebook, which may be unexpected in a health-focused app. Reviewing the app's privacy settings can help clarify what sharing can be adjusted.
    • User controls over data preferences are limited, leaving fewer options to manage background data collection by third-party services.
    • Crash and performance data is sent to Google automatically in the background, with limited opportunity for users to adjust this behavior.

    About This Analysis

    This scorecard is based on static analysis of the app's code and data practices at the time of the scan. Scores reflect the app's behavior as observed during analysis.

    App Details

    • App Name: Yuka - Food & Cosmetic Scanner
    • Package ID: io.yuka.android
    • Version: 4.54.1 (build 834)
    • Scan Date: 2026-01-30
    • Platform: Android

    Right of Reply

    Developer not yet contacted