# Security & Privacy Scorecard

## Mój Orange

## What This Means for You

Your in-app activity is shared with five analytics companies, and a session recording service may capture your billing and payment screens. A design issue in the app's web-integrated login pages could allow malicious or compromised web content to capture your account password.

## Recommendation: Acceptable

If you're an Orange Poland customer, this app is necessary for managing your account, paying invoices, and controlling your services. A design issue in the app's web-integrated login pages could allow compromised web content to capture your account password, and five analytics services receive your behavioral data. Session recordings may also include sensitive billing and payment screen activity.

**Best For:** Orange Poland customers who need to manage their account and are comfortable with third-party analytics tracking.

## Key Findings

**Data Security** - 3 findings (3 info)

**Network Security** - 2 findings (2 medium)

**Code Safety** - 3 findings (1 high, 1 medium, 1 low)

**Privacy** - 2 findings (2 medium)

## Privacy Concerns

### What Data is Collected

- Personal information: Account name, phone number, and billing details sent to Orange servers for account management.
- Device information: Device advertising ID and Android ID shared with AppsFlyer, Synerise, and Firebase Analytics for attribution and behavioral analytics.
- Usage data: In-app interactions and session recordings shared with QuantumMetric, Synerise, Firebase Analytics, and Google Tag Manager. Google Tag Manager may also inject additional tracking behavior without requiring an app update.
- Location data: Precise location is accessed on your device to support service-related features. Depending on how analytics services are configured, it may be transmitted to analytics partners.

### Third-Party Data Sharing

**The following third parties may receive your data:**
- AppsFlyer - Install attribution and in-app purchase event tracking
- Firebase Analytics - App usage event reporting and behavioral analytics
- Synerise - CRM and behavioral analytics, including device type, network type, push notification consent, and app launch events
- QuantumMetric - Session replay and screen interaction recording
- Google Tag Manager - Dynamic behavior configuration that may add tracking without requiring an app update

## Understanding the Scores

**Security:** 76/100
**Privacy:** 72/100

### Security Breakdown

- **Data Security:** 100/100 - Sensitive data stored on your device is well protected. Local storage uses hardware-backed encryption aligned with Android security best practices.
- **Network Security:** 80/100 - Most communication with Orange servers is protected. A network configuration exception permits unencrypted connections to two primary API server addresses, though static analysis alone cannot confirm whether any active code path currently uses this exception.
- **Code Safety:** 76/100 - The app's overall structure is reasonably solid. A login bridge accessible from web page content and an exposed debugging mechanism present risks that would benefit from remediation.

### Privacy Breakdown

- **Data Collection:** 78/100 - Device identifiers and behavioral data are shared with five analytics services. Each service receives a portion of your in-app activity, contributing to a broad combined data profile.
- **Data Sharing:** 74/100 - Your usage behavior and device identifiers flow to multiple third parties including install attribution, session recording, and CRM analytics providers.
- **User Control:** 82/100 - The app supports data deletion on request and encrypts data in transit. Individual opt-out controls for specific third-party analytics services are less visible to users.

## Positive Security Features

- Sensitive data stored locally on your device is protected with hardware-backed encryption, following strong Android security practices.
- App backups via developer tools are disabled, preventing unauthorized extraction of app data from the device.
- The Synerise marketing platform connection uses an additional layer of server identity verification beyond standard encrypted connections.
- Data is encrypted during transmission between the app and Orange servers.

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Session Recording Transparency**
   The screen interaction recording service may capture payment and billing screens. Documenting which screens are excluded from session recordings and making that information accessible to users would strengthen privacy compliance for a telecom app serving 10M+ customers.

2. **Per-Service Analytics Consent**
   Five separate analytics services receive behavioral data. Providing users with individual opt-out controls for each service would help meet the requirement for a separate lawful basis per third-party data transfer.

### Security Enhancements

1. **Network Configuration Hardening**
   Removing the configuration exception that permits unencrypted connections to the two primary API server addresses would eliminate the theoretical risk of unprotected data transmission to those endpoints.

2. **Web Login Bridge Protection**
   Adding origin validation to the web-to-native login mechanism would prevent compromised or malicious web content from triggering the native login flow and capturing account passwords.

## Technical Context

**App Type:** Telecom account management - high sensitivity (billing, authentication, personal data)
**Classes Analyzed:** 3,400
**Third-Party Services:** 16
**Context Tags:** financial, sensitive_data, telecom, session_recording, gdpr

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Orange Polska
**Version:** 5.144.0.15921 (versionCode 65921)
**Analysis Date:** 2026-06-13
**Package:** pl.orange.mojeorange

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 5.144.0.15921 analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors