# Did not meet TRUSTED criteria The app was assessed and did not meet all of the criteria for the TRUSTED mark. The specific items are listed below so the result can be weighed before installing. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Respect**: Not met. Did not meet one criterion in this area. - **Honest Experience**: Critical issue. Has a high-severity open item in this area, detailed below. - **User Control**: Under review. This area was not fully assessed in this version. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Hearoes ## What This Means for You Firebase Analytics sends behavioral data and device identifiers to Google, and RevenueCat receives the Google Advertising ID along with subscription and purchase details. The app's Play Store privacy label states no data is shared with third parties, which conflicts with what the code shows. ## Recommendation: Use With Caution Hearoes delivers structured auditory rehabilitation training with fully secured network communications and no advertising networks in the data pipeline. The primary concern is transparency: Firebase Analytics initializes automatically without a user consent step, and the developer's Play Store privacy label declares no data is shared with third parties, which the code does not support. Hearing training progress goes to the developer's own Firebase backend and is not passed on to data brokers or ad platforms. **Best For:** People with cochlear implants or hearing aids working through gamified auditory rehabilitation exercises. ## Key Findings **Data Security:** 1 finding (1 high) **Network Security:** 0 findings **Code Safety:** 7 findings (1 medium, 6 low) **Privacy:** 1 finding (1 high) ## Privacy Concerns ### What Leaves the Device - Behavioral data and device identifiers: sent to Google via Firebase Analytics for app usage tracking - Google Advertising ID, purchase receipts, subscription details, and device information: sent to RevenueCat for subscription management ### What Stays on the Device No sensitive data was identified as processed only on the device. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Google (Firebase Analytics) - behavioral analytics and device event tracking - RevenueCat - subscription and purchase management ## Understanding the Scores **Security:** 73/100 **Privacy:** 48/100 ### Security Breakdown - **Data Security:** 42/100. Subscription state and backup data are stored on the device without encryption, creating risk on older Android versions. For a health-adjacent app where subscription status can indicate a hearing impairment, this is worth addressing. - **Network Security:** 100/100. All communications use HTTPS or WSS (TLS). No unencrypted connections were identified. - **Code Safety:** 88/100. Strong overall code safety posture. Several lower-severity configuration issues exist in Unity game engine components and the Android manifest, including an exported activity without a permission requirement and a debug module compiled into the production build. ### Privacy Breakdown - **Data Collection:** 74/100. Firebase Analytics initializes at app launch and sends behavioral data and device identifiers to Google without a user consent gate. The advertising identifier is passed to RevenueCat for subscription management. - **Data Sharing:** 80/100. Sharing is limited to analytics and subscription management partners. No data brokers, ad networks, or session recording services are present in the code. - **User Control:** 75/100. Both RevenueCat and Unity honor the system-level "Limit Ad Tracking" setting and skip advertising ID collection when opted out. No in-app consent mechanism is present for analytics collection. ## Positive Security Features - All network communications use HTTPS or WSS (TLS). No unencrypted connections were identified. - Firebase backend access is protected by Play Integrity attestation, preventing unauthorized access from modified or sideloaded installs. - Memory safety hardening is active in the native code layer, detecting heap corruption in the Unity binary at runtime. - No advertising networks are present. Despite having advertising ID permissions, no ad SDK receives behavioral targeting data. - Hearing training data is stored in the developer's own Firebase infrastructure and is not shared with data brokers or third-party analytics aggregators. - Both RevenueCat and Unity honor the system-level ad tracking opt-out and skip advertising ID collection when Limit Ad Tracking is enabled. ## Areas for Improvement ### GDPR / CCPA Compliance The app's privacy practices could be strengthened by: 1. **Accurate Play Store Data Safety disclosure** The Play Store privacy label states no data is shared with third parties. Updating it to reflect that behavioral data goes to Google Firebase Analytics and subscription data goes to RevenueCat would bring the disclosure into alignment with what the code shows. 2. **User consent before analytics initialization** Firebase Analytics starts collecting data at app launch before any user action. Adding a consent step before analytics activates would align with the expectations of GDPR and CCPA. ### Security Enhancements 1. **Restrict Android backup scope** Explicitly configuring backup rules to exclude subscription state, sign-in data, and purchase metadata would prevent that data from being accessible via device backup tools on Android 9 and below. 2. **Remove debug modules from production builds** A Firebase App Check debug module is compiled into the production APK. Stripping it from release builds reduces the information available to anyone inspecting the app. ## Technical Context **App Type:** Auditory rehabilitation and hearing training (health-adjacent), Unity game engine **Classes Analyzed:** 0 **Third-Party Services:** 21 identified **Context Tags:** health, sensitive_data, financial --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** GAMES 4 HEAROES PTY LTD **Version:** 1.4.05 (versionCode: 330014005) **Analysis Date:** 2026-08-06 **Package:** com.Games4Hearoes.G4H ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 1.4.05 analyzed on 2026-08-06 - May not reflect server-side security controls - Cannot detect all runtime behaviors