# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Mastodon ## What This Means for You User content flows only to the user's chosen Mastodon server, no advertising or behavioral tracking services are linked in this build, and push notification content is protected by end-to-end encryption so the delivery provider cannot read message payloads. ## Recommendation: Very Secure CITT assesses this build as very secure: no third-party tracking SDKs are present, social data flows only to the user's chosen Mastodon server, and push notification payloads are end-to-end encrypted. Account session storage on the device could be strengthened by adding backup exclusion rules and scoping certificate trust to system-installed certificates only; per-instance two-factor authentication is recommended for accounts where security is a priority. **Best For:** People who follow writers, journalists, and communities across the fediverse and want their social activity confined to their chosen server, with no behavioral advertising or third-party profiling. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 1 finding (1 medium) **Network Security:** 1 finding (1 medium) **Code Safety:** 4 findings (4 low) **Privacy:** 1 finding (1 low) ## Privacy Concerns ### What Leaves the Device - User posts, follows, and direct messages: flow to the user's chosen Mastodon instance as the app's core function. - Push notification routing data: handled by Firebase Cloud Messaging (Google) for delivery. Notification payloads are end-to-end encrypted; the delivery provider cannot read their content. - A numeric identifier derived from the Mastodon username: included in donation campaign requests that flow to Mastodon's own servers each time the home timeline is loaded while a campaign is active. This identifier is stable across app sessions. ### What Stays on the Device - QR code and barcode scan data: processed on the device using on-device libraries; no scan results are transmitted externally. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Firebase Cloud Messaging (Google) - push notification routing and delivery (notification content is end-to-end encrypted and cannot be read by Google) No other third-party data sharing was identified in this analysis. ## Understanding the Scores **Security:** 88/100 **Privacy:** 95/100 ### Security Breakdown - **Data Security:** 82/100. Account session data is stored on the device in a local database. The current backup configuration does not define rules to exclude this database from device cloud backups, which means it may be included when the device backs up to the cloud. - **Network Security:** 91/100. All API and Mastodon instance connections use HTTPS with system-trusted certificate validation. - **Code Safety:** 93/100. No native libraries are present in this build, eliminating a large category of memory-safety risk. A secure authorization flow is implemented for authentication on Mastodon servers that support it. ### Privacy Breakdown - **Data Collection:** 96/100. No advertising identifier is requested or used. No analytics or behavioral tracking SDK is linked in this build. - **Data Sharing:** 100/100. All social data flows only to the user's chosen Mastodon server or Mastodon's own first-party infrastructure. - **User Control:** 99/100. Users select their own Mastodon server and can migrate between servers while retaining followers. The app provides filtering, list management, and content warning controls. ## Positive Security Features - No third-party analytics, advertising, or tracking SDKs are linked in this build; user behavior is not profiled by any vendor. - Push notification content is end-to-end encrypted, preventing the delivery provider from reading notification payloads. - All social data flows only to the user's chosen Mastodon server and Mastodon's own first-party infrastructure. - QR code and barcode scanning is processed entirely on the device; no scan data is transmitted externally. - No native libraries are present in this build, eliminating a large category of memory-safety risk. - A secure authorization flow (PKCE) is implemented for authentication on Mastodon servers that support it. - No advertising identifier is requested or used. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Donation Request Identifier and Data Safety Declaration** The Play Store data safety section for this build (retrieved 2026-08-11) states "No data collected." The build contains code that constructs a numeric identifier derived from the user's Mastodon username and includes it as a parameter in requests to Mastodon's donation campaign servers. The identifier is stable across sessions and tied to the user's account handle. Whether this element falls within the Play Store's definition of "collected" data is a question for the developer and Google to resolve; CITT reports only what the build contains and how the published data safety label reads. ### Security Enhancements 1. **Cloud Backup Scope** The build's backup configuration does not define rules to exclude the account session database from cloud backups. Adding backup exclusion rules for sensitive database files would limit what is included when device backups are created. 2. **Network Certificate Trust Scope** The build's network security configuration extends certificate trust to user-installed certificates for all connections in production. Scoping this trust to debug builds only would align with Android's default behavior for apps targeting API 24 and above. 3. **Diagnostic Logging in Release Build** The release build retains diagnostic logging statements that emit internal operational details. These are accessible only via a physical USB connection or on a modified device, but removing diagnostic logging from release builds is a standard hardening step. 4. **Authorization Flow on Older Servers** When connecting to older Mastodon servers that do not support PKCE, the build falls back to a simpler authorization flow. Encouraging use of PKCE-capable server versions, or removing the plain-secret fallback, would close this gap for users on older instances. ## Technical Context **App Type:** Decentralized social networking **Classes Analyzed:** 2,288 **Third-Party Services:** 8 **Context Tags:** social, messaging, federated, privacy --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Mastodon GmbH **Version:** 2.13.2 (Build 189) **Analysis Date:** 2026-08-13 **Package:** org.joinmastodon.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 2.13.2 analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors