# Security & Privacy Scorecard

## PhotoSync - Transfer Photos

## What This Means for You

Usage data is shared with Firebase Analytics and Google Ads to track behavior and serve advertising. Photos move through multiple cloud services the user connects, and how that data is protected has notable weaknesses. Users have limited control over what is collected about them.

## Recommendation: Use With Caution

**Best For:** Photo transfers with standard analytics and ads
**Avoid If:** You store sensitive or private photos

## Key Findings

**Data Security** - 4 findings (2 critical, 1 high, 1 medium)

**Network Security** - 1 finding (1 info)

**Code Safety** - 0 findings

**Privacy** - 2 findings (1 critical, 1 medium)

## Privacy Concerns

### What Data is Collected

PhotoSync collects data about how users interact with the app, including which features are used, how often, and from which device. Behavioral patterns and device identifiers are used to build a profile for analytics and advertising. Subscription and purchase activity is also recorded.

### Third-Party Data Sharing

User data is shared with the following services:

- **Firebase Analytics** - Tracks app usage and builds behavioral profiles
- **Firebase Crashlytics** - Receives app stability and performance reports from the device
- **Google Ads** - Uses behavioral data to serve targeted advertising
- **RevenueCat** - Manages subscription status and purchase records
- **Cloud storage integrations** (Google Drive, Dropbox, OneDrive, Box, Flickr, SmugMug, pCloud, AWS S3, Backblaze B2, Wasabi) - Photos pass through whichever of these services the user connects to

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 40/100 |
| Data Security | 30/100 |
| Network Security | 75/100 |
| Code Safety | 70/100 |
| Data Collection | 50/100 |
| Data Sharing | 45/100 |
| User Control | 40/100 |

## Positive Security Features

No notable positive security practices were identified in this version of the app.

## Areas for Improvement

- How photos and personal data are protected during storage and transfer has significant weaknesses that could leave user content exposed.
- The app offers limited options to reduce or opt out of data collection tied to advertising and behavioral profiling.
- Photos may pass through a wide range of cloud services with varying levels of protection, and the app does not consistently enforce strong safeguards across all of them.

---

## About This Analysis

This scorecard reflects a technical review of the published app version listed below. It covers data handling practices, third-party integrations, and security configuration as found in the app itself.

### App Details

- **App:** PhotoSync - Transfer Photos
- **Package:** com.touchbyte.photosync
- **Version:** 4.2.4 (6226)
- **Scan Date:** 2026-02-01
- **Platform:** Android