NRC Audio - Podcasts Security & Privacy Scorecard

Android

96
Overall trust score
Very Secure
91
Security
100
Privacy

Listening activity is tracked by Firebase Analytics and Google Tag Manager, and the device's advertising ID is accessible to Google. A consent tool is built in, giving users control over how their data is used. Personal data stays on the device and is not shared with third parties beyond these analytics services.

Best for

NRC subscribers who listen on the go

Findings

  • 0 critical
  • 1 high
  • 2 medium
  • 2 low
  • 3 info

1 issue identified across security and privacy analysis.

Top security issues

  • Cleartext HTTP Traffic Globally Permitted
  • Debug Certificate Trust Configuration in Network Config
  • Exported Google Tag Manager Preview Activity

Top privacy issues

  • Advertising Tracking Permissions Declared
  • Firebase Core Initialization Before Didomi Consent SDK
  • JavaScript Interface Exposure in Didomi Consent WebView

Full analysis

NRC Audio - Podcasts

What This Means for You

Listening activity is tracked by Firebase Analytics and Google Tag Manager, and the device's advertising ID is accessible to Google. A consent tool is built in, giving users control over how their data is used. Personal data stays on the device and is not shared with third parties beyond these analytics services.

Recommendation: Trustworthy

Best For: NRC subscribers who listen on the go

Key Findings

Data Security - 1 finding (1 info)

Network Security - 2 findings (1 high, 1 medium)

Code Safety - 0 findings

Privacy - 2 findings (2 info)

Privacy Concerns

What Data is Collected

The app collects listening activity and device identifiers, including the advertising ID, through Firebase Analytics and Google Tag Manager. Firebase Crashlytics collects anonymized crash data to support app stability. The Didomi consent tool is built in, allowing users to review and adjust data preferences at any time.

Third-Party Data Sharing

Usage data flows to Google through Firebase Analytics and Google Tag Manager. The advertising ID is accessible to Google services within the app. The Didomi consent management platform gives users direct control over these data flows.

Understanding the Scores

Category Score
Security 91/100
Privacy 100/100
Data Security 100/100
Network Security 93/100
Code Safety 97/100
Data Collection 100/100
Data Sharing 100/100
User Control 100/100

Positive Security Features

  • A built-in consent management tool (Didomi) provides visible control over data-sharing choices before they take effect.
  • Push notifications are handled through Firebase Cloud Messaging, a well-maintained platform that keeps messaging infrastructure out of custom code.
  • The app uses established networking libraries (OkHttp, Retrofit) that follow current best practices for mobile communication.

Areas for Improvement

  • Some network connections could be configured with stronger protections to better secure user data while in transit.
  • A setting that permits fallback to less secure network connections is present, which means user data may not be fully protected on untrusted public networks.

About This Analysis

This scorecard reflects the app's privacy and security posture based on analysis of the app's code and configuration.

App Details

  • App: NRC Audio - Podcasts
  • Package: nl.nrc.audio
  • Version: 2.3.0 (Build 40)
  • Scan Date: March 7, 2026
  • Platform: Android

Versions & scan history

ScanDateOverall score
#1 (current) 96/100