# Security & Privacy Scorecard

## आर्य महासंघ

## What This Means for You

Location data is looked up via an external service (ipapi.co) and map data is loaded from third-party CDNs, meaning the user's IP and location are shared outside the app. Crash reports are sent to Sentry, and account data is stored on Supabase cloud servers. Several findings suggest stored user information may not be fully protected.

## Recommendation: Use With Caution

**Best For:** Members comfortable with basic cloud-connected community

## Key Findings

**Data Security** - 2 findings (2 critical)

**Network Security** - 1 finding (1 high)

**Code Safety** - 0 findings

**Privacy** - 4 findings (2 high, 1 medium, 1 low)

## Privacy Concerns

### What Data is Collected

The user's IP address and approximate location are collected each time the app's map features are used. Account details provided by users are stored on Supabase cloud servers. When the app encounters a problem, diagnostic information about the device and session is transmitted to Sentry for crash reporting.

### Third-Party Data Sharing

The user's IP address and derived location are sent to ipapi.co automatically each time the app performs a location lookup. Map tiles and geographic data are fetched from OpenStreetMap Nominatim and unpkg.com CDN servers, which also receive the user's IP address as part of those requests. Google Play Services receives standard usage signals as part of Android platform integration.

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 45/100 |
| Data Security | 25/100 |
| Network Security | 80/100 |
| Code Safety | 40/100 |
| Data Collection | 60/100 |
| Data Sharing | 55/100 |
| User Control | 70/100 |

## Positive Security Features

- Network communications are handled using standard secure transport protocols, resulting in a relatively strong network security score.
- Basic user account controls are present, giving users some ability to manage their own data within the app.

## Areas for Improvement

- The app's protection of stored account data may not be sufficient, meaning user personal information may not be fully protected from unauthorized access.
- User location and IP address are shared with multiple outside services, with limited disclosure or controls available to users.
- The app's internal data handling could be substantially strengthened to better protect information processed on the device.

---

## About This Analysis

Independent automated analysis of the app's code and data-handling practices. Results reflect this specific app version and may not capture changes introduced in later releases.

### App Details

- **App:** आर्य महासंघ
- **Package:** com.aryamahasangh
- **Version:** 1.0.18 (Build 10018)
- **Scan Date:** 2026-02-02
- **Developer:** (not listed)