# Security & Privacy Scorecard

## Smart M-Air

## What This Means for You

Usage data is shared with Firebase and Google services for push notifications and analytics. Network communication sends data with less protection than expected, which may affect users on public Wi-Fi. Data stored on the device is encrypted, but permission access to device features warrants review before granting.

## Recommendation: Use With Caution

**Best For:** Smart M-Air device owners needing remote control
**Avoid If:** You rely on the app over untrusted public Wi-Fi

## Key Findings

**Data Security** - 3 findings (1 high, 1 medium, 1 low)

**Network Security** - 5 findings (1 critical, 2 high, 1 medium, 1 low)

**Code Safety** - 0 findings

**Privacy** - 2 findings (1 medium, 1 low)

## Privacy Concerns

### What Data is Collected

The app collects device identifiers and usage activity to support its remote control features. Firebase services record how users interact with the app, including session patterns and feature usage. Google Play Services access device information to deliver notifications about the connected device.

### Third-Party Data Sharing

User data is shared with these third-party services:

- **Firebase Cloud Messaging** - Delivers push notifications to the device
- **Firebase Core/Common** - Collects usage and session analytics
- **Google Play Services (GMS)** - Supports device notifications and identification
- **AWS Mobile SDK** - Handles communication with the app's cloud backend

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 42/100 |
| Privacy | 62/100 |
| Data Security | 48/100 |
| Network Security | 32/100 |
| Code Safety | 68/100 |
| Data Collection | 72/100 |
| Data Sharing | 82/100 |
| User Control | 78/100 |

## Positive Security Features

- Local data storage is protected with encryption
- Third-party integrations are focused on core app functionality rather than broad data gathering
- User control settings are available within the app

## Areas for Improvement

- Network connections between the device and the app's cloud services send data with less protection than expected. On public or shared Wi-Fi, commands and device status may be visible to others on the same network.
- The app requests access to device features beyond what its core remote control function requires. Users should review each permission carefully and only grant those necessary for their use.
- Third-party analytics services receive data about how users interact with the app. The scope of this collection could be reduced without affecting the core remote control experience.

---

## About This Analysis

### App Details

| Field | Value |
|---|---|
| App Name | Smart M-Air |
| Package | jp.co.mhi_mth.smartmair |
| Version | 1.4.003 (build 34) |
| Scan Date | 2026-02-18 |
| Developer | - |