# Security & Privacy Scorecard

## MyCredex

**App:** MyCredex 
**Package:** com.axsys.credex.android 
**Version:** 1.1.3 (Build 78) 
**Scan Date:** 2026-01-20

## What This Means for You

Usage and behavior are tracked by Firebase and Huawei analytics. The app collects biometric data for identity verification via third-party SDKs. Sensitive financial data stored on the device may not be fully protected if the device is compromised.

## Recommendation: Use With Caution

**Best For:** Credex users comfortable with analytics and biometrics

## Key Findings

**Data Security** - 4 findings (1 critical, 1 high, 2 medium)

**Network Security** - 1 finding (1 high)

**Code Safety** - 0 findings

**Privacy** - 3 findings (1 critical, 1 high, 1 medium)

## Privacy Concerns

### What Data is Collected

MyCredex collects biometric data including facial scans for identity verification. Multiple analytics services record how users interact with the app, including which features are used and when. This behavioral data builds a profile of in-app activity over time.

### Third-Party Data Sharing

Data is shared with the following third-party services:

- **Firebase Analytics** - Behavioral and usage tracking
- **Huawei HiAnalytics** - Behavioral and usage tracking
- **OneSignal** - Push notification delivery
- **Sentry** - Error and crash reporting
- **Idenfy SDK** - Identity document verification
- **FaceTec SDK** - Biometric face matching
- **Google ML Kit** - On-device machine learning features

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 65/100 |
| Privacy | 50/100 |
| Data Security | 45/100 |
| Network Security | 75/100 |
| Code Safety | 70/100 |
| Data Collection | 55/100 |
| Data Sharing | 60/100 |
| User Control | 50/100 |

## Positive Security Features

No notable positive security practices were identified in this version of the app.

## Areas for Improvement

- Sensitive financial data stored on the device needs stronger protection so that it remains secure if the device is lost, stolen, or accessed by someone else.
- The app shares behavioral data with two separate analytics platforms simultaneously, giving users no meaningful way to limit that collection while still using the app.
- User control over what personal information is gathered and retained is limited. Clearer choices about data retention and analytics participation would give users more say over their own information.

---

## About This Analysis

This scorecard reflects automated static analysis of the app's code and configuration. Scores represent the app's security and privacy posture at the time of the scan and may change with future updates.

### App Details

- **App Name:** MyCredex
- **Package:** com.axsys.credex.android
- **Version:** 1.1.3 (Build 78)
- **Platform:** Android
- **Scan Date:** 2026-01-20