# Security & Privacy Scorecard

## my moldcell

## What This Means for You

Your account data may be exposed on public or shared Wi-Fi due to flaws in how the app verifies secure connections, and your GPS location and device details are sent to a third-party marketing service running in the background.

## Recommendation: Use With Caution

The app handles essential account management for Moldcell subscribers, but two serious flaws in how it handles secure connections create real risk on untrusted networks. A third-party marketing SDK also sends your location and hardware details to external servers without prominent disclosure. Use this app on trusted home or mobile networks only.

**Best For:** Moldcell subscribers who manage their account primarily on trusted home or mobile networks.

## Key Findings

**Data Security** - 3 findings (1 high, 2 low)

**Network Security** - 2 findings (2 critical)

**Code Safety** - 3 findings (1 high, 1 medium, 1 info)

**Privacy** - 3 findings (2 medium, 1 low)

## Privacy Concerns

### What Data is Collected

- Account information: phone number, subscriber ID, and account details shared with Moldcell servers during normal app use
- Location data: GPS coordinates shared with EVAM AB's marketing servers on every location change
- Device information: device ID, phone model and brand, OS version, battery level, and storage capacity shared with EVAM AB
- Analytics data: your account's persistent unique identifier shared with Google (Firebase Analytics) alongside every screen view and in-app action
- Advertising ID: may be shared with Google via advertising attribution services declared in the app

### Third-Party Data Sharing

**The following third parties may receive your data:**
- EVAM AB (Sweden) - marketing campaign targeting; receives GPS coordinates, device ID, and hardware telemetry
- Google (Firebase Analytics) - usage tracking; receives your non-resettable account identifier with every app interaction
- Google (Firebase Crashlytics) - crash and performance reporting
- Google (Ad Services) - advertising attribution and advertising ID collection
- Facebook - app usage analytics via Facebook SDK

## Understanding the Scores

**Security:** 60/100
**Privacy:** 74/100

### Security Breakdown

- **Data Security:** 72/100 - Session data handling has weaknesses, including sensitive account identifiers appearing in device diagnostic logs on some devices.
- **Network Security:** 52/100 - Two legacy components that handle push notifications and image loading do not verify secure connections properly, creating a meaningful risk of account data interception on untrusted networks.
- **Code Safety:** 82/100 - Core app logic is generally well-structured, though some authentication mechanisms rely on older cryptographic approaches that could be modernized.

### Privacy Breakdown

- **Data Collection:** 87/100 - The app collects a limited set of account-related data, most of which is tied directly to service functionality.
- **Data Sharing:** 79/100 - Data is shared with several third-party services, including a marketing SDK that transmits location and device telemetry to external servers without prominent user disclosure.
- **User Control:** 90/100 - Users can request deletion of their account data, and the app supports standard account management controls throughout.

## Positive Security Features

- The main account management network client uses properly verified, secure connections backed by a custom trusted certificate
- The app blocks unencrypted HTTP traffic at the system level, preventing accidental data exposure over insecure connections
- Users can request deletion of their data, as confirmed in the Play Store data safety declaration

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Location Data Transparency**
   The EVAM marketing SDK continuously tracks GPS coordinates and shares them with external servers. Users should be clearly informed before location access is granted, with the option to decline background tracking without losing core account functionality.

2. **Analytics Identifier Reduction**
   Attaching a non-resettable account identifier to every analytics event ties behavioral data to a real telecom account. Switching to a resettable or anonymous identifier would meaningfully reduce privacy exposure without affecting app functionality.

### Security Enhancements

1. **Remove Legacy Insecure Network Components**
   Two older network components in the app do not verify secure connections. Removing these or replacing them with the properly configured main network client would eliminate the risk of account data interception on untrusted networks.

2. **Strengthen Session Data Protection**
   The fixed keys used to protect session data passed to the service portal are embedded in the app. Generating these keys dynamically and storing them securely on the device would make session data significantly harder to read if intercepted.

## Technical Context

**App Type:** Telecom account management, sensitive financial and account data
**Classes Analyzed:** 1800
**Third-Party Services:** 12
**Context Tags:** financial, sensitive_data, location, third_party_tracking

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Moldcell S.A.
**Version:** 1.41.0 (versionCode 12450)
**Analysis Date:** 2026-06-13
**Package:** md.moldcell.selfservice

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 1.41.0 analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors