# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Strong. Strong result in this area. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Critical issue. Has a high-severity open item in this area, detailed below. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## RemindMeWhere Reminders ## What This Means for You Firebase Analytics and Facebook SDK components in this build initialize at launch and may send analytics data and advertising identifiers to Google and Meta before any user action; precise location data used to trigger geofence reminders stays on the device and is not sent to advertising networks. ## Recommendation: TRUSTED CITT rates RemindMeWhere Reminders at 84/100. Login information is protected with device-backed encryption, and precise location data stays on the device rather than going to advertising networks. Firebase Analytics and Facebook SDK components initialize at launch and may send analytics and advertising identifiers to Google and Meta, and the Play Store Data Safety section does not currently reflect this sharing. **Best For:** People who want location-triggered reminders with their precise location data kept on the device. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 1 finding (1 medium) **Network Security:** 1 finding (1 low) **Code Safety:** 5 findings (1 medium, 4 low) **Privacy:** 1 finding (1 medium) ## Privacy Concerns ### What Leaves the Device - Advertising identifier and session data: may be sent to Google via Firebase Analytics and to Meta via the Facebook SDK at launch (runtime behavior was not observed in this analysis). - Account and reminder data: may be sent to Google Firebase servers to support the cross-device sync feature described in the app listing. ### What Stays on the Device - Precise location data: used on the device to trigger geofence reminders and not shared with advertising networks. This data stays under the user's control. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Google (Firebase Analytics, Firebase Auth, Firebase Realtime Database, Firebase Firestore, Firebase Cloud Messaging, Google Play Services) - analytics, authentication, and cross-device data sync - Meta (Facebook SDK) - app analytics and advertising measurement ## Understanding the Scores **Security:** 89/100 **Privacy:** 82/100 ### Security Breakdown - **Data Security:** 89/100. Login information is protected with device-backed encryption. The local reminder database uses a storage library whose default behavior, when no encryption is configured, is to store data without encryption; the configuration visible in this build does not confirm whether encryption is applied at the application layer. - **Network Security:** 97/100. All network communications in this build use encrypted connections and the overall network security posture is strong. - **Code Safety:** 91/100. The app's core security architecture is solid, with login data protected by device-backed encryption and cloud-stored data gated behind account authentication. ### Privacy Breakdown - **Data Collection:** 83/100. Precise location data stays on the device. Analytics and advertising identifiers may be sent to Google and Meta at launch before any user action. - **Data Sharing:** 84/100. Location data used for geofence reminders is not shared with advertising networks. Analytics data sharing with Google and Meta is not currently reflected in the Play Store Data Safety label. - **User Control:** 85/100. Account data deletion can be requested per the Play Store listing, and cloud-stored reminder data requires account authentication before access. ## Positive Security Features - Login information is protected with device-backed encryption, making it resistant to extraction even if the device is compromised. - App data is excluded from device backups, preventing extraction of local data via backup tools. - Cloud-stored reminder data requires account authentication before any access is permitted. - Precise location data used for geofence reminders stays on the device and is not shared with advertising networks. - No advertising SDK is bundled in this build; the analytics and authentication components serve analytics and login functions, not ad serving. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Play Store Data Safety label and linked SDK discrepancy** Google's Data Safety guidelines (support.google.com/googleplay?p=data-safety) require developers to disclose third-party data sharing. The Play Store page for this build (retrieved 2026-09-10) states "No data shared with third parties." The build links Firebase Analytics (Google) and the Facebook SDK (Meta), both of which may send analytics data and advertising identifiers to their respective servers at launch. Whether this sharing falls within the scope of the Data Safety form's definitions could not be determined from the build alone; a reader comparing the label against the linked libraries will see the difference. ### Security Enhancements 1. **Geofence notification handler access** The geofence event handler in this build is configured to accept signals from any installed app on the device. Restricting it to accept signals only from the app's own components would reduce the risk of spoofed location-trigger events. 2. **Local database encryption** The local reminder database uses a storage library whose default behavior is to store data without encryption when no encryption configuration is applied. Confirming and documenting that encryption is enabled at the application layer would give users clearer assurance about the security of on-device reminder data. 3. **Attribution data access restriction** The Android attribution configuration in this build allows all installed apps to observe attribution events. Restricting this to a declared list of trusted partners would limit exposure of install source and campaign data to other apps on the device. ## Technical Context **App Type:** Productivity - location-based reminder **Classes Analyzed:** 13,199 **Third-Party Services:** 17 **Context Tags:** location, privacy --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** VOLASIM Limited **Version:** 1.1.22 (versionCode 48) **Analysis Date:** 2026-09-10 **Package:** com.volasim.remindmewhere ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 1.1.22 analyzed on 2026-09-10 - May not reflect server-side security controls - Cannot detect all runtime behaviors