# Security & Privacy Scorecard

## (my)cards

## What This Means for You

Usage patterns are tracked by Firebase and Mixpanel for analytics purposes. Locally stored card information may not be fully protected. The app provides limited options to control how data is handled once it leaves the device.

## Recommendation: Use With Caution

**Best For:** Organizing loyalty cards with standard analytics

## Key Findings

**Data Security** - 3 findings (2 critical, 1 medium)

**Network Security** - 1 finding (1 low)

**Code Safety** - 0 findings

**Privacy** - 5 findings (3 high, 2 medium)

## Privacy Concerns

### What Data is Collected

The app gathers data on how users interact with stored cards, including which cards are viewed and how frequently. Device identifiers and session information are collected to support analytics and crash reporting services.

### Third-Party Data Sharing

Usage data is shared with the following third-party services:

- **Firebase Analytics** - Tracks in-app activity and usage patterns
- **Mixpanel** - Profiles user behavior for product analytics
- **Sentry** - Receives crash and error reports that may include device information
- **Google Drive API** - Enables backup and sync of card data
- **Firebase Cloud Messaging** - Delivers push notifications
- **Google Play Services** - Supports core platform functions

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 55/100 |
| Data Security | 35/100 |
| Network Security | 92/100 |
| Code Safety | 65/100 |
| Data Collection | 50/100 |
| Data Sharing | 55/100 |
| User Control | 40/100 |

## Positive Security Features

- Network communications are handled securely, contributing to the app's strong network security score of 92/100.

## Areas for Improvement

- Locally stored loyalty card data has limited protections, leaving it more accessible if someone gains access to the device.
- Multiple analytics services collect behavioral data, and the app provides limited options to control or reduce this tracking.
- Once data reaches third-party services like Mixpanel and Firebase, it falls under their separate privacy policies, reducing user visibility into how it is used.

---

## About This Analysis

This scorecard reflects automated code analysis performed on the version listed below. Results represent the app's state at scan time and may not reflect later updates.

### App Details

- **App:** (my)cards
- **Package:** com.rodehouse.storemycards
- **Version:** 1.3.5 (Build 197)
- **Scan Date:** 2026-02-06