# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Critical issue. Has a high-severity open item in this area, detailed below. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## BLOKK: Privacy VPN & Blocker ## What This Means for You Build 1.3.24 contains code paths that send login information and VPN traffic history to a development server, and every unmatched incoming caller's phone number is sent to a third-party lookup service. A bundled session recording tool is registered as an active service in the app, positioned to send screen touch and navigation data to Microsoft. ## Recommendation: High Risk BLOKK is marketed as a privacy focused VPN and blocker that keeps data on the device, but the analyzed build embeds several data flows that run counter to that claim: login information and behavioral telemetry directed at a development server, phone number lookups sent to an outside spam-detection service, and an active session recording tool. Given that a VPN and call-blocking app is entrusted with browsing history, call activity, and account access, CITT's scoring rubric weighs these findings, together with the exported broadcast receivers that can pause the app's core blocking function and unused provider keys compiled into the package, as material to the overall risk assessment. **Best For:** People who want basic ad and tracker blocking with call screening for everyday browsing, and do not require confidentiality of their VPN traffic history, call activity, or login information. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 2 findings (1 high, 1 low) **Network Security:** 1 finding (1 high) **Code Safety:** 6 findings (1 high, 2 medium, 3 low) **Privacy:** 3 findings (3 high) ## Privacy Concerns ### What Leaves the Device - Login information (username and password): sent as URL query parameters to a development server (app-dataprofile-dev.azurewebsites.net) during a login-related purchase lookup. - VPN traffic history (resolved domains), data volume, WiFi status, country code, blocked app names, custom domain block/allow choices, and blocked call numbers: sent to the same development server, keyed to a persistent user identifier. - Incoming caller phone numbers: sent to callerapi.com, a third-party spam-lookup service, for calls not already matched on the device. - Screen touch events and navigation flow: positioned to upload to Microsoft through the bundled Clarity session recording tool, which is registered as an active, non-disabled service in the app's manifest. This code path was not observed running; whether and how often it fires was not tested. ### What Stays on the Device - Call and SMS numbers that match a locally stored list: checked against an on-device filter without a network lookup. - Locally stored traffic, call, and SMS records: Android backup is disabled for this app, so these records are not extractable through standard device backup tools. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Microsoft (Clarity) - session recording (screen touch events, navigation flow) - CallerAPI - phone number lookups for spam detection - Firebase Analytics - app usage data - Firebase Cloud Messaging - push notification delivery - Google App Measurement - app usage and device data - OneSignal - push notification delivery - RevenueCat - subscription and purchase management - Adyen - payment processing - Cash App Pay - payment processing - Google Play Billing - in-app purchase processing - Amazon IAP - in-app purchase processing - Microsoft MSAL - authentication library - Google AdServices - advertising - MaxMind - IP-based location lookup ## Understanding the Scores **Security:** 50/100 **Privacy:** 25/100 ### Security Breakdown - **Data Security:** 55/100. Unused provider server keys and account details for several outside VPN services are compiled into the distributed package; runtime code does not reference them, but they are recoverable from the build. A separate file-sharing path is also configured more broadly than needed, though it is not reachable from outside the app. - **Network Security:** 50/100. A login-related request builds its web address by embedding the username and password directly in the URL, which servers, proxies, and content-delivery logs along the request path typically record. - **Code Safety:** 55/100. Two broadcast receivers are open to any other app installed on the device without a permission check, one of which can pause the app's tracker and ad blocking for five minutes at a time with no limit on repetition. Several lower-severity items round out this category, including a fixed authentication key and a broadly scoped web content bridge. ### Privacy Breakdown - **Data Collection:** 20/100. Beyond the account and network activity described above, the build sends detailed behavioral telemetry, including resolved domains, data volume, and blocked-app names, to a development server tied to a persistent user identifier, with no disclosure of this telemetry identified in the app's privacy policy. - **Data Sharing:** 22/100. Caller phone numbers are sent to an outside spam-lookup service, and a session recording tool positioned to send screen activity to Microsoft is registered as an active service, both of which sit alongside a Play Store data safety label stating no data is shared with third parties. - **User Control:** 35/100. The app advertises no-account operation and on-device-only data handling, but the data flows above are not surfaced to the user as optional or disclosed choices within the app itself. ## Positive Security Features - Android backup is disabled for this app, which keeps the locally stored traffic, call, and SMS databases out of reach of standard device backup and restore tools. - Call and SMS number blocking against a locally stored list can run entirely on the device without a network lookup. - Analytics traffic through the bundled Countly tool is directed to the developer's own server rather than an outside analytics vendor. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Third-party sharing label vs. bundled services** Google Play's Data Safety guidance (https://support.google.com/googleplay?p=data-safety) asks developers to declare data shared with third parties. The label for this app, as retrieved, states "No data shared with third parties." Build 1.3.24 links the Microsoft Clarity session recording tool as an active, non-disabled service in its manifest, and contains code that sends incoming caller phone numbers to callerapi.com. Whether these code paths run in a typical user session, and how often, was not tested in this static analysis. 2. **Collected data types vs. observed code paths** The label also states "This app may collect these data types: App activity, App info and performance, and Device or other IDs." Build 1.3.24 additionally contains a code path that embeds login information in a URL sent to a development server, and a separate path that sends VPN traffic history and behavioral telemetry to the same server. Whether this reflects data categories beyond what is disclosed could not be fully determined without observing live network traffic. ### Security Enhancements 1. **Restrict the exported broadcast receivers** The two broadcast receivers that any co-installed app can currently message could require a signature-level permission so only the app itself can pause blocking or restart its service. 2. **Move login information out of the URL** The login-related request could carry the username and password in the request body instead of the URL, reducing how often this data is written into server and proxy logs along the way. 3. **Remove unused provider server keys from the distributed build** The private server keys and account details for several outside VPN services compiled into the package are not referenced by any runtime code path and could be removed from future builds. ## Technical Context **App Type:** VPN and privacy/security tool (handles network traffic, call, and SMS data; higher sensitivity) **Classes Analyzed:** 1,200 **Third-Party Services:** 15 identified **Context Tags:** vpn, financial, sensitive_data, location, contacts, ads --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** MyPA Limited **Version:** 1.3.24 (Build 1030024) **Analysis Date:** 2026-08-14 **Package:** com.revokevpnapp ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 1.3.24 analyzed on 2026-08-14 - May not reflect server-side security controls - Cannot detect all runtime behaviors