# Security & Privacy Scorecard

## ClearVPN - Fast & Secure VPN

**Version:** 3.4.2 | **Scanned:** 2026-03-24

| | Score |
|---|---|
| Security | 75/100 |
| Privacy | 52/100 |

## What This Means for You

App installs, usage patterns, and device details are shared with AppsFlyer and Firebase for analytics and attribution. OneSignal can push notifications tied to a user activity profile. User data is not sold to third parties, but several services build a picture of how the app is used.

## Recommendation: Use With Caution

**Best For:** Casual users wanting simple VPN protection
**Avoid If:** You want to minimize install and usage tracking

## Key Findings

**Data Security** - 2 findings (1 medium, 1 info)

**Network Security** - 2 findings (1 medium, 1 info)

**Code Safety** - 0 findings

**Privacy** - 4 findings (1 high, 2 medium, 1 info)

## Privacy Concerns

### What Data is Collected

The app collects device identifiers, install source data, usage patterns, and notification interaction history. Error and crash reports, which may include device state at the time of a crash, are transmitted to Sentry.

### Third-Party Data Sharing

Seven third-party services receive data from the device:

- **AppsFlyer** - receives install and usage data to measure advertising attribution
- **Firebase Messaging** - delivers push notifications and logs delivery events
- **OneSignal** - manages notifications linked to a user usage profile
- **Google Play Services** - handles app distribution and device integrations
- **Sentry** - receives crash reports and error diagnostics
- **Zendesk** - handles support requests if the user contacts the developer
- **Unleash** - receives feature flag queries reflecting the app configuration

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 75/100 |
| Privacy | 52/100 |
| Data Security | 98/100 |
| Network Security | 95/100 |
| Code Safety | 78/100 |
| Data Collection | 50/100 |
| Data Sharing | 100/100 |
| User Control | 70/100 |

## Positive Security Features

- Server communications are protected with strong transport security across all network connections
- Data stored on the device is protected using platform-level security mechanisms
- Personal data stays within the app's declared service providers and is not passed to data brokers

## Areas for Improvement

- Install and usage activity is shared with multiple analytics and attribution services, creating a behavioral profile across those platforms.
- Notifications are managed through OneSignal with limited user control over how app activity shapes the user notification profile.
- Seven third-party integrations collectively gather more information about app usage than the core service requires.

---

## About This Analysis

This scorecard is based on static analysis of the app's code and configuration. Scores reflect security and privacy practices observed in this version.

### App Details

- **App Name:** ClearVPN - Fast & Secure VPN
- **Package ID:** com.macpaw.clearvpn.android
- **Version:** 3.4.2 (108)
- **Scan Date:** 2026-03-24