# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Temper Staff ## What This Means for You Build 1.21.2 links Firebase Analytics, Salesforce Marketing Cloud, and Intercom in configurations that appear designed to route account and device data to US-based servers before the in-app consent prompt is shown; AppsFlyer, Mixpanel, and Sentry are separately gated so they receive data only after the user grants consent. ## Recommendation: Solid CITT rates this build Solid: the login flow uses a robust authorization code method that limits the impact of code interception, API communications are well-secured, and three analytics services require explicit consent before receiving any data. Weighed against those strengths are preconsent data flows to Firebase, Salesforce Marketing Cloud, and Intercom, and account and location data stored without encryption on the device. **Best For:** Gig workers seeking flexible, shift-based employment who want an all-in-one app for finding shifts, managing hours, and receiving payments. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 1 finding (1 medium) **Network Security:** 2 findings (2 medium) **Code Safety:** 3 findings (2 medium, 1 low) **Privacy:** 0 findings ## Privacy Concerns ### What Leaves the Device - Account and device identifiers: shared with Firebase Analytics, Salesforce Marketing Cloud, and Intercom, with the initial data routing occurring before the in-app consent prompt is presented on first launch - Usage analytics: shared with Firebase Analytics and, after consent is granted, with Mixpanel (EU-region endpoint) - Crash reports and performance diagnostics: shared with Firebase Crashlytics and Firebase Performance, and after consent with Sentry - Advertising identifier: shared with AppsFlyer for install attribution, gated behind user consent - Identity document and biometric data: shared with Onfido during identity verification onboarding - Push notification registration: device identifiers shared with Firebase Messaging to enable push notifications - Location proximity data: the binary links AltBeacon and the Salesforce Marketing Cloud proximity SDK; whether location data is shared at runtime could not be determined from static analysis ### What Stays on the Device No sensitive data was identified as processed only on the device in this analysis. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Firebase (Analytics, Crashlytics, Performance, Messaging) - usage analytics, crash reporting, performance monitoring, push notifications - Salesforce Marketing Cloud - marketing communications and in-app messaging - Intercom - in-app customer support and messaging - AppsFlyer - install attribution (consent-gated) - Onfido - identity verification and document review - Mixpanel - usage analytics, routed to EU region (consent-gated) - Sentry - error and crash reporting (consent-gated) - Usercentrics - consent management platform - AltBeacon - proximity beacon infrastructure (runtime activation not determined from static analysis) - Google Maps Platform - map display - Usersnap - in-app user feedback ## Understanding the Scores **Security:** 85/100 **Privacy:** 65/100 ### Security Breakdown - **Data Security:** 58/100. Account and location data are stored on the device without encryption, and the backup configuration includes files that may contain session and account data not currently excluded from cloud or device backup. These areas could be strengthened. - **Network Security:** 84/100. API communications are secured with server-identity verification at the transport layer. The Intercom in-app messaging component allows HTTP resources to load within HTTPS pages while a JavaScript interface is attached, which could be leveraged by a network-positioned attacker to inject content into the in-app support view. - **Code Safety:** 84/100. Login uses a robust authorization code flow with PKCE (per RFC 7636), reducing the risk of authorization code interception. Testing framework components and non-production server addresses are present in this release build. ### Privacy Breakdown - **Data Collection:** 72/100. Several analytics and messaging services are present; AppsFlyer, Mixpanel, and Sentry are gated behind user consent, while Firebase Analytics, Intercom, and Salesforce Marketing Cloud appear configured to route data before the consent prompt is shown on first launch. - **Data Sharing:** 75/100. Sharing is scoped to services with defined purposes such as attribution, analytics, support, and identity verification; no broad advertising network SDK is present. - **User Control:** 82/100. A Usercentrics consent platform gives the user control over several analytics services. The Play Store label indicates users may request deletion of their data. ## Positive Security Features - API communications in this build are secured with server-identity verification at the transport layer, with no bypass configuration found - Login uses a robust authorization code flow (PKCE per RFC 7636) that reduces the risk of authorization code interception - AppsFlyer, Mixpanel, and Sentry are gated behind the Usercentrics consent platform and are not configured to receive data before user consent is granted - Identity verification is managed through a short-lived, server-generated session via Onfido, running in an isolated process rather than a hardcoded client identifier - Mixpanel is configured to route analytics exclusively to an EU-region endpoint, keeping that data within EU jurisdiction - No broad advertising network SDK is present; the only attribution service (AppsFlyer) is limited to install attribution and is consent-gated ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Preconsent data routing on first launch** Google Play's Data Safety guidance (retrieved 2026-08-12) requires disclosure when personal data is shared with third parties. The binary links Firebase Analytics, Salesforce Marketing Cloud, and Intercom in configurations that appear capable of routing device and account data before the in-app consent prompt is shown on first launch. Whether server-side controls prevent data from reaching those services before consent is granted could not be determined from static analysis alone. 2. **Beacon proximity infrastructure not reflected in Play Store label** The binary includes AltBeacon and the Salesforce Marketing Cloud proximity SDK, libraries associated with Bluetooth beacon-based location tracking. The Google Play Data Safety label (retrieved 2026-08-12) does not name proximity or beacon tracking among the data types shared with third parties. Whether these libraries route location data at runtime could not be determined from static analysis. 3. **Install attribution recipient not named in Play Store label** The binary links AppsFlyer, configured to receive the advertising identifier when the user grants consent. The Play Store Data Safety label (retrieved 2026-08-12) discloses that "Personal info" may be shared with third parties but does not name AppsFlyer as a recipient by name. ### Security Enhancements 1. **Expand backup exclusions to cover account and session data files** The current backup configuration excludes only AppsFlyer-specific files. Expanding the exclusion rules to cover account preference files and session data storage would prevent those files from being copied to cloud backup or restored to a different device. 2. **Restrict mixed-content loading in in-app messaging views** The Intercom in-app messaging component allows HTTP resources within HTTPS pages in its views. Configuring those views to reject HTTP subresources would reduce the risk of network-based content injection affecting in-app actions. 3. **Remove testing framework components from production builds** This release build includes testing framework activities that any co-installed app can start without restriction. Ensuring debug-only dependencies are excluded from the production build configuration would reduce the exposed surface area. ## Technical Context **App Type:** Business - gig work and temporary employment platform (sensitive: employment, financial, biometric, location data) **Classes Analyzed:** 0 **Third-Party Services:** 16 **Context Tags:** employment, financial, sensitive_data, location, ads, biometric --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Temper IP B.V. **Version:** 1.21.2 (versionCode 290) **Analysis Date:** 2026-08-12 **Package:** temper.worker.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 1.21.2 analyzed on 2026-08-12 - May not reflect server-side security controls - Cannot detect all runtime behaviors