# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Critical issue. Has a high-severity open item in this area, detailed below. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Strong. Strong result in this area. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Akedo: Offline Games No WiFi ## What This Means for You The build bundles Firebase Analytics and Google AdMob, which may share behavioral data and advertising identifiers with Google, though the Play Store Data Safety label for this app declared no data collected or shared as of 2026-09-10. ## Recommendation: TRUSTED CITT rates this build trustworthy for casual gaming. The binary links Firebase Analytics and AdMob, which are not reflected in the Play Store Data Safety label. Hardware-backed secure storage and no required user login contribute to the overall trustworthiness of this build. **Best For:** Casual players who want offline arcade games without creating an account. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 1 finding (1 medium) **Network Security:** 1 finding (1 medium) **Code Safety:** 1 finding (1 low) **Privacy:** 2 findings (2 medium) ## Privacy Concerns ### What Leaves the Device - Behavioral data (app interactions, session events, device identifiers): may be shared with Firebase Analytics for usage analytics - Advertising identifiers and ad impression data: may be shared with Google AdMob for ad delivery and measurement - Interest-category signals and conversion attribution data: may be shared with participating ad technology companies via Android Privacy Sandbox APIs ### What Stays on the Device - Game state and progress data: stored locally on the device ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Google (Firebase Analytics) - behavioral analytics and session data - Google (AdMob) - ad delivery and measurement - Ad technology companies participating in Android Privacy Sandbox - interest categorization and conversion attribution ## Understanding the Scores **Security:** 90/100 **Privacy:** 78/100 ### Security Breakdown - **Data Security:** 88/100. Strong protection for stored data. Sensitive data uses hardware-backed Android Keystore encryption, and device backups are disabled to prevent unauthorized extraction. - **Network Security:** 85/100. Core communications use HTTPS. A build-level flag also permits unencrypted connections, with a recommendation addressed in the Areas for Improvement section. - **Code Safety:** 95/100. Excellent code safety posture. No user account system eliminates an entire class of login-data risks, and no sensitive personal data types are handled by the build. ### Privacy Breakdown - **Data Collection:** 82/100. The build bundles ad and analytics services that may share behavioral and advertising data with Google. No health, financial, biometric, location, contact, or message data is involved. - **Data Sharing:** 90/100. Data sharing is limited to Google's services and the developer's own servers. No data brokers or additional advertising networks are present beyond AdMob. - **User Control:** 83/100. No user account is required. The Privacy Sandbox configuration could be narrowed to restrict which advertising technology companies can access interest-category signals. ## Positive Security Features - Sensitive stored data uses hardware-backed Android Keystore encryption - ADB backup and Google Drive Auto Backup are disabled, preventing data extraction from the device - No user account is required, eliminating login data theft and account takeover as attack surfaces - No health, financial, biometric, location, contact, or message data is involved - Games run offline after downloading, with no ongoing server calls during gameplay - Data sharing is limited to Google (Firebase, AdMob) and the developer's own servers; no data brokers or additional advertising network integrations are present ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Play Store Data Safety label** The Play Store Data Safety section for this app, as retrieved on 2026-09-10, declares "No data collected" and "No data shared with third parties." The build bundles Firebase Analytics and Google AdMob components configured to auto-start at application launch. Google's Firebase Play Data Disclosure guide states that apps using Firebase Analytics must declare App Interactions, Device IDs, and Advertising IDs in the Data Safety form when these integrations are present. Whether the label was accurate at the time of its original submission could not be determined from the binary alone. 2. **Privacy Sandbox access scope** The build includes an ad services configuration that sets access to "allow all" for both the Android Privacy Sandbox Topics API and Attribution API. Google's AdMob developer documentation recommends restricting access to explicitly listed ad technology companies rather than all participants, to limit the scope of data sharing. ### Security Enhancements 1. **Restrict unencrypted connections** The build permits HTTP connections for all network paths via a global flag in the app manifest. Adding a Network Security Configuration to restrict connections to HTTPS would reduce the risk of tampered content being delivered over unencrypted connections, particularly for game bundle downloads. 2. **Browser storage data protection** Session data cached in the browser storage layer could be moved to hardware-backed secure storage, consistent with how other sensitive data is already protected elsewhere in the build. 3. **Custom URL scheme restrictions** The custom URL scheme registered in the app manifest could be strengthened by adding host and path constraints, or by migrating to verified App Links, to limit which URIs other installed apps can deliver to this app. ## Technical Context **App Type:** Arcade/casual gaming, ad-supported, rated Everyone **Classes Analyzed:** 5,726 **Third-Party Services:** 12 **Context Tags:** ads, analytics, offline, gaming --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** VOLASIM Limited **Version:** 1.1.5 (versionCode 62) **Analysis Date:** 2026-09-10 **Package:** gg.akedo.akedo_app ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 1.1.5 (versionCode 62) analyzed on 2026-09-10 - May not reflect server-side security controls - Cannot detect all runtime behaviors