# Security & Privacy Scorecard

## SplitFlapSend

SplitFlapSend lets you create animated split-flap display messages like airport departure boards and share them as video or GIF. Choose preset phrases or customize up to 48 characters across 4 rows. Export as video with sound or animated GIF.

## What This Means for You

Your data stays entirely on your device and is never collected, tracked, or shared with anyone.

## Recommendation: Safe & Privacy-Focused

SplitFlapSend demonstrates strong privacy practices with no analytics, minimal permissions, and all processing on-device. Safe for general use with no data collection.

**Best For:** Users who want a fun, privacy-respecting animated message app with no data collection

## Key Findings

**Data Security** - 0 findings

**Network Security** - 0 findings

**Code Safety** - 0 findings

**Privacy** - 0 findings

## Privacy Concerns

### What Data is Collected

No personal data is collected by this app. All message creation, video encoding, and GIF generation happen locally on your device. No user accounts are required and no information is transmitted to the developer.

### Third-Party Data Sharing

No third-party data sharing was identified in this analysis.

## Understanding the Scores

**Security:** 100/100
**Privacy:** 100/100

### Security Breakdown

- **Data Security:** 100/100 - All processing is on-device with no data stored or transmitted externally
- **Network Security:** 100/100 - No backend server communication; network access is used only for Google Play Billing
- **Code Safety:** 100/100 - Pure Kotlin/Java code with no native binaries, no unsafe patterns identified

### Privacy Breakdown

- **Data Collection:** 100/100 - Zero analytics, telemetry, or tracking of any kind
- **Data Sharing:** 100/100 - No data shared with any third parties
- **User Control:** 100/100 - No accounts, no profiles, no persistent identifiers collected

## Positive Security Features

- No analytics or tracking - zero telemetry is collected from your device
- Minimal permissions - only network access for billing and license checks; no access to camera, microphone, location, contacts, or storage
- All processing on-device - message creation, video export, and GIF generation never leave your phone
- No user accounts - no sign-in, no profile, no personal information required to use the app
- External links open in your system browser rather than an in-app browser
- No native code - the entire app runs in the standard Android runtime with no low-level binary components

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices are already strong. One area to monitor:

1. **Firebase Datatransport Dependency**
   The app includes a dormant Google Firebase component pulled in as a side effect of Google Play Billing. It is not active today, but future updates that add Firebase features should be reviewed to ensure the privacy-first approach is maintained.

### Security Enhancements

1. **License Verification Network Traffic**
   The app contacts Google Play servers for license verification at launch. This is standard practice for paid apps, but users on restricted networks should be aware that a network check occurs on startup.

## Technical Context

**App Type:** Media and messaging utility (content rating: Everyone)
**Classes Analyzed:** 19,305
**Third-Party Services:** Google Play Billing, Google Play Services (GMS), Firebase Datatransport (dormant transitive dependency), PairIP License Check
**Context Tags:** media, messaging

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Mark Morris (uplink.to)
**Version:** 1.0.47 (Build 4)
**Analysis Date:** 2026-04-14
**Package:** com.markmorris.splitflapsend

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 1.0.47 analyzed on 2026-04-14
- May not reflect server-side security controls
- Cannot detect all runtime behaviors