# Did not meet TRUSTED criteria The app was assessed and did not meet all of the criteria for the TRUSTED mark. The specific items are listed below so the result can be weighed before installing. ## Trust Pillars - **Secure by Design**: Critical issue. Has a high-severity open item in this area, detailed below. - **Data Respect**: Not met. Did not meet one criterion in this area. - **Honest Experience**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## MOVA Smart Home ## What This Means for You Backend access information is embedded in the app's installable file, and device IDs and behavioral data are sent to ByteDance platforms with GPS tracking capability, Umeng, and Aliyun. These data flows are undisclosed in the App Store privacy label. ## Recommendation: Use With Caution The app controls MOVA and Dreame brand robot vacuums and smart home devices but embeds backend authentication information directly in the installable file, enabling backend access if the file is extracted. Analytics and behavioral data are shared with multiple providers, including ByteDance, Umeng, and Aliyun, that are not reflected in the App Store privacy label. JavaScript bridge interfaces in the in-app browser lack origin validation, which may allow a network attacker to access device identifiers or initiate payment actions without user interaction. **Best For:** Robot vacuum and smart home device users who want the full range of remote controls and scheduling features for MOVA and Dreame brand products. ## Key Findings **Data Security** - 1 finding (1 low) **Network Security** - 1 finding (1 medium) **Code Safety** - 6 findings (1 critical, 1 high, 2 medium, 2 low) **Privacy** - 0 findings ## Privacy Concerns ### What Leaves the Device - Device identifiers and install IDs: sent to ByteDance Rangers Analytics (BDAutoTrack), with GPS tracking capability, for behavioral analytics - Wi-Fi network name: may be exposed to ByteDance through the in-app browser analytics bridge - Device signals and identifiers: sent to BDASignalSDK (ByteDance) for device signal collection - Analytics and usage data: sent to Umeng Analytics (Alibaba) for performance tracking - Device and app data: sent to Aliyun EMAS (Alibaba Cloud) for cloud infrastructure services - Crash reports: sent to Firebase Crashlytics for stability monitoring - Advertising identifiers (with user consent): may be sent to Facebook SDK for analytics and attribution ### What Stays on the Device No sensitive data was identified as processed only on the device. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - ByteDance Rangers Analytics (BDAutoTrack) - behavioral analytics and device tracking - BDASignalSDK (ByteDance) - device signal collection and fingerprinting - Facebook SDK - advertising and analytics - Umeng Analytics (Alibaba) - app usage analytics - Aliyun EMAS (Alibaba Cloud) - cloud infrastructure services - Firebase Crashlytics - crash and stability reporting - FingerprintJS - device fingerprinting - Baidu Mobile Ads - advertising - AMap / Gaode Maps - mapping and location services - Tencent IoT Explorer - IoT device connectivity - Agora - real-time voice and video communication - PayPal PPRiskMagnes - payment fraud detection - Zendesk - customer support - Google Sign-In - account authentication - AWS Cognito / AWS IoT - cloud authentication and device connectivity - OpenInstall - app install attribution - GetUI - push notification delivery ## Understanding the Scores **Security:** 58/100 **Privacy:** 78/100 ### Security Breakdown - **Data Security:** 80/100. Login session information is stored in the iOS Keychain, which provides strong protection for account access. Some app files may remain accessible while the device screen is locked due to a weaker file protection configuration in the storage layer. - **Network Security:** 77/100. Standard HTTPS is used for most communications. The MQTT IoT layer links SSL bypass flags that, if active at runtime, may allow a network attacker to intercept device commands and sensor readings. - **Code Safety:** 66/100. Backend authentication information and encryption keys are embedded directly in the installable app file and can be recovered without any specialized tools. The Alipay and ByteDance in-app browser bridges do not validate the origin of web content before accepting calls, which may allow injected content to initiate payments or read device identifiers. ### Privacy Breakdown - **Data Collection:** 83/100. The ATT consent framework is integrated to gate advertising identifier access before any collection occurs. Firebase is limited in scope to crash reporting. Multiple analytics SDKs from ByteDance and Alibaba collect behavioral and persistent device identity data. - **Data Sharing:** 82/100. Data flows to a broad set of analytics and infrastructure providers. ByteDance, Umeng, and Aliyun receive device and behavioral data that the App Store privacy label does not currently disclose. - **User Control:** 87/100. The ATT consent framework gives users control over advertising identifier access before it is used. Zendesk integration provides a direct customer support channel, and Google Sign-In is available as an alternative account option. ## Positive Security Features - Login session information is stored in the iOS Keychain, providing stronger protection than unencrypted files or system settings storage. - Apple's device integrity framework is integrated to detect and block connections from compromised devices before they can interact with the backend. - The ATT consent framework is integrated, requesting user permission before any advertising identifier is accessed. - Widget data is shared only within the developer's own first-party app group and is not accessible to third-party services. - Firebase is limited to crash reporting and does not contribute to behavioral analytics or advertising data flows. ## Areas for Improvement ### GDPR / CCPA Compliance The app's privacy practices could be strengthened by: 1. **Accurate App Store Privacy Label** The App Store privacy label should reflect all third-party data flows, including data shared with ByteDance, Umeng, and Aliyun, to align with Apple's data collection disclosure requirements and give users an accurate picture before download. 2. **Privacy Manifest** Adding an app privacy manifest could make the App Store privacy label more complete and improve transparency around third-party SDK data usage. ### Security Enhancements 1. **Remove Embedded Backend Access Information** Backend authentication information and encryption keys shipped inside the installable app file can be extracted by anyone with a copy of the app. Moving to server-side or runtime-fetched access information would prevent unauthorized backend access. 2. **Strengthen IoT Encryption** The IoT communication layer uses a static embedded encryption key with a basic cipher configuration that does not protect against block-level pattern analysis or command-substitution attacks. Using authenticated encryption with randomly generated session keys would make IoT traffic significantly more resilient. 3. **Add In-App Browser Origin Validation** The Alipay and ByteDance JavaScript bridges in the in-app browser do not validate the origin of web content before accepting method calls. Adding origin checks would prevent a network attacker from using injected content to initiate payments or read device identifiers. 4. **Enable Stronger File Protection** Applying the strongest iOS file protection level app-wide would ensure that stored app data cannot be accessed while the device screen is locked. 5. **Remove Development Endpoints** Development and staging server addresses present in the production build should be removed before release to reduce exposure through less-secured environments. ## Technical Context **App Type:** IoT smart home controller (robot vacuum management and home automation) **Classes Analyzed:** Not applicable (iOS binary analysis) **Third-Party Services:** 20 identified **Context Tags:** iot, ads, third_party_risk, location, camera --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** MOVA Technology **Version:** 1.6.3 (Build 334) **Analysis Date:** 2026-08-04 **Package:** com.mova.smarthome ### Analysis Limitations - Static analysis only (code review without running the app) - Based on IPA version 1.6.3 analyzed on 2026-08-04 - May not reflect server-side security controls - Cannot detect all runtime behaviors