Frameo Security & Privacy Scorecard

Frameo

What This Means for You

Your name, email address, and approximate location are shared with Facebook and Customer.io for advertising purposes, and the keys that protect your photo transfers are stored in a way that could be accessed by certain device-level tools.

Recommendation: Use With Caution

Frameo uses end-to-end encrypted peer-to-peer photo transfers, which is a strong privacy-protective design choice. However, the app shares personal data including your name, email, and location-derived signals with Facebook and Customer.io for advertising, and photo transfer keys are stored in files rather than the device's secure storage system. These six medium-severity issues warrant caution, particularly for families sharing photos of children.

Best For: Families sharing photos between devices who accept some third-party data sharing and use cloud-connected social logins

Key Findings

Data Security - 5 findings (2 medium, 3 low)

Network Security - 1 finding (1 info)

Code Safety - 4 findings (2 low, 2 info)

Privacy - 5 findings (4 medium, 1 low)

Privacy Concerns

What Data is Collected

• Personal information: name, email address, user ID
• Device information: device ID, installation identifier
• Usage data: app interactions, product events, push notification engagement
• Location data: approximate location inferred from network connection (IP-based)

Third-Party Data Sharing

The following third parties may receive your data:

• Facebook (Meta) - advertising tracking, login authentication, device and user ID linked to third-party advertising
• Customer.io - CRM and marketing automation, receives name and email for promotional messaging
• Google (Firebase, Analytics, App Measurement) - crash reporting, push notifications, analytics
• Microsoft (MSAL) - authentication services

Understanding the Scores

Security: 90/100

Privacy: 84/100

Security Breakdown

• Data Security: 87/100 - Strong media encryption in transit, but photo transfer keys are stored in files rather than the device's secure enclave storage, and some media file metadata is accessible without authentication
• Network Security: 100/100 - All network connections enforce secure transport with no exceptions; no arbitrary connections permitted
• Code Safety: 99/100 - Well-structured codebase with local-only web rendering and validated linking architecture; internal configuration files included in the production release

Privacy Breakdown

• Data Collection: 89/100 - Collects name, email, device identifiers, and IP-derived location; app functionality data is expected, but advertising uses go beyond core app needs
• Data Sharing: 92/100 - Limited external sharing with Facebook Login active and advertising tracking declared in bundled SDK manifests
• User Control: 90/100 - Sign in with Apple available as a privacy-preserving login option; Facebook automatic ad tracking and analytics disabled at runtime

Positive Security Features

• End-to-end encrypted peer-to-peer photo transfer using strong modern cryptography (libsodium)
• Facebook advertiser ID collection and automatic event logging both disabled at runtime
• Firebase Analytics disabled at runtime
• App Transport Security enforced with no exceptions - all connections are secured
• Sign in with Apple integrated as a privacy-preserving login alternative
• Web content rendered from local bundle only - no remote code loading
• Link handling uses verified universal links rather than open URL schemes
• Media encryption keys protected with secure storage transforms in the local database

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Align Privacy Disclosures
   The app's main privacy manifest states no tracking is occurring, while bundled Facebook SDK components declare advertising tracking to the same Facebook domain. Aligning these declarations would give users an accurate picture of data flows.

2. Clarify Advertising Use of Registration Data
   User name and email collected during account creation are declared for developer advertising purposes. Users should be clearly informed of this use and offered a way to opt out, as required under GDPR and CCPA.

3. Disclose Location-Based Advertising
   Approximate location inferred from your network connection is used for analytics and advertising. This use should be clearly disclosed at account creation or in app settings.

Security Enhancements

1. Move Transfer Keys to Secure Device Storage
   Cryptographic keys used for P2P photo transfers are currently stored in files. Storing these in the device's dedicated secure storage system would prevent extraction even if the device is accessed by specialized tools.

2. Strengthen Media File Protection
   Some media files are configured to remain accessible even when the device is locked. Using stronger file protection would prevent access to these files before the device is unlocked by the owner.

3. Remove Internal Configuration Files from Production Builds
   Development and test configuration files are included in the production app. These expose internal project identifiers and should be removed from releases distributed to users.

Technical Context

App Type: Family photo-sharing, peer-to-peer communication, moderate sensitivity (family photos including children)

Classes Analyzed: 528

Third-Party Services: 19

Context Tags: photos, family, social, analytics, children, thirdpartyrisk, p2p

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Frameo

Version: 1.38.3 (Build 1774422916)

Analysis Date: 2026-05-01

Package: net.frameo.app

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 1.38.3 analyzed on 2026-05-01
• May not reflect server-side security controls
• Cannot detect all runtime behaviors