CITT

    Scan results

    DeFlock.me

    Android

    DeFlock maps surveillance infrastructure like AI cameras and license plate readers. Privacy-first, open-source app with zero tracking or data collection. Community-driven platform powered by OpenStreetMap to help users understand surveillance in their neighborhoods.

    CITT SCORE
    100
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Anyone wanting to spot hidden tracking devices nearby

    What It Means For You

    Device location is used locally to detect nearby AirTags and similar trackers, with map tiles loaded from OpenStreetMap. Tag identification relies on the TagInfo API. No advertising or behavioral analytics services receive user data.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (4)

    Data Security

    1 total
    1 Medium

    Code Security

    3 total
    3 Low

    Third-Party Services

    OpenStreetMap, Google Play Services Location, TagInfo API

    Security Strengths

    • ✓Zero tracking SDKs (top 2% of apps)
    • ✓AES-256-GCM encryption for credentials via Google Tink
    • ✓Hardware-backed key storage using Android Keystore
    • ✓HTTPS enforced, no SSL bypasses
    • ✓No JavaScript interfaces in WebView (eliminates RCE risk)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    location
    privacy focused
    surveillance mapping
    open source backend
    local first

    Package

    me.deflock.deflockapp

    Version

    2.3.1 (versionCode 38)

    Analysis Date

    Feb 9, 2025

    Classes Analyzed

    2,128

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Very Secure

    Key Findings

    Data Security - 1 finding (1 medium)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 0 findings

    Privacy Concerns

    What Data is Collected

    DeFlock.me accesses device location to scan for nearby tracking devices. Location data is processed on the device and is not sent to advertising or analytics platforms.

    Third-Party Data Sharing

    Map tiles are loaded from OpenStreetMap to display the local area. Tracker identification queries are sent to the TagInfo API. Google Play Services Location is used for on-device positioning. None of these connections serve advertising or behavioral profiling purposes.

    Understanding the Scores

    CategoryScore
    Security100/100
    Privacy100/100
    Data Security100/100
    Network Security100/100
    Code Safety100/100
    Data Collection100/100
    Data Sharing100/100
    User Control100/100

    Positive Security Features

    • Location processing happens on-device, keeping position data off remote servers
    • No advertising networks or behavioral tracking services are embedded in the app
    • Data sharing is limited to the three functional services the app needs to operate
    • No account creation or personal information is required to use the app

    Areas for Improvement

    • One medium-priority data-handling item was noted and could be addressed in a future update
    • Additional in-app transparency about which external services are contacted during normal use would further strengthen user confidence

    About This Analysis

    This report is based on static analysis of the app's code, examining data flows, network communications, and third-party integrations.

    App Details

    App NameDeFlock.me
    Package IDme.deflock.deflockapp
    Version2.3.1 (build 38)
    DeveloperNot specified
    Analysis Date2026-02-09

    Right of Reply

    Developer not yet contacted