# Security & Privacy Scorecard

## Skimmer Pro

## What This Means for You

Usage patterns and behavior are tracked by Pendo Analytics and shared with Sentry for error reporting. A critical finding was identified, meaning account data may not be fully protected. Google Sign-In links user activity to their Google account.

## Recommendation: Use With Caution

**Best For:** Pool service pros comfortable with standard analytics

## Key Findings

**Data Security** - 4 findings (1 critical, 2 medium, 1 low)

**Network Security** - 0 findings

**Code Safety** - 0 findings

**Privacy** - 5 findings (3 high, 2 medium)

## Privacy Concerns

### What Data is Collected

In-app activity and feature usage are collected by Pendo Analytics, which builds a profile of how users interact with the app over time. Error and crash data, which may include device details and app state at the time of a problem, are sent to Sentry. Location access is required for Google Maps features. Signing in with Google ties app identity to the user's broader Google account. Bluetooth device information is handled locally by Shiny Bluetooth LE when connecting to compatible hardware.

### Third-Party Data Sharing

Usage data is shared with Pendo Analytics and error data with Sentry. Google receives location requests and account information through Maps and Sign-In. Azure Mobile Services processes data on the backend. Multiple parties receive data generated by everyday use of the app, and the controls available to users over that sharing are limited.

## Understanding the Scores

| Category | Score |
|---|---|
| Overall Security | 45/100 |
| Overall Privacy | 50/100 |
| Data Security | 70/100 |
| Network Security | 80/100 |
| Code Safety | 40/100 |
| Data Collection | 55/100 |
| Data Sharing | 50/100 |
| User Control | 60/100 |

## Positive Security Features

- Network communications between the app and its servers score relatively well, suggesting data moving between the device and the backend receives a reasonable level of protection in transit.
- Account login is handled through Google Sign-In, an externally managed identity provider, which means password management is delegated to a widely-used and maintained system rather than built in-house.

## Areas for Improvement

- A critical issue in how account data is stored or handled puts it at greater risk than it should be. Stronger protections are needed to keep user information secure at rest.
- The app's code safety practices scored low, meaning user data may not be well-protected at the code level against unauthorized access by other software on the device.
- Data flows to several third-party services with limited controls offered to users over what is shared and with whom. Clearer opt-out options would give users more confidence in how their information is used.

---

## About This Analysis

This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed at the time of the scan.

### App Details

- **App:** Skimmer Pro
- **Package:** com.getskimmer.skimmerphone
- **Version:** 12.8.2 (Build 27529)
- **Scan Date:** 2026-02-07
- **Platform:** Android