CITT

    Can I Trust That App?

    We read the app's code, not its privacy policy.

    Free results in ~30 minutes. No signup required.

    2,300+ apps scanned. Search for any one.

    TRUSTED

    TRUSTED, by Can I Trust That?

    One mark. An app earns it by clearing every check below.

    Secure by Design

    Encrypted in transit and at rest, with no keys or passwords hardcoded in the app.

    Solid Security

    Data Minimization

    Collects only what it needs, and keeps its tracking to the app itself.

    Tracking Disclosure

    Manifest Mismatch

    It does what it declares on the screens you see, with nothing tracking behind them.

    Crystal Clear

    User Control

    People can export their data and leave at any time.

    No Lock-In

    Truly Local

    Sensitive data stays on the device, checked only when an app is meant to work offline.

    Truly Local

    Child-Safe

    Safe for kids, checked only when an app is made for children.

    Kids Safe

    Teardowns

    We reverse-engineer apps and write up what we find.

    Can we trust Mova AI Vacuum Cleaner?

    I monitored device setup flow, scanning the room, the map, AI features, voice commands on both the vacuum cleaner and on the iOS app. The product respects user privacy better than most but it could have been better. Default dangerous features are off with a consent screen for each. But when enabled, that data goes to cloud, including video stream and photo of the objects. And what does the app say? Tik Tak Tik Tak. Ad SDKs bundled, data shared and attribution is sent.

    9 min read

    Reverse engineering and decrypting the Temu app on iOS and Android

    I decompiled the Temu app on both platforms. On Android it erases all ten of its own native libraries from the file security scanners read, rewrites its own Java methods under a server flag, and seals its telemetry with a home-grown cipher that has no extractable key. Here is the code, and what it means for the phone in your pocket.

    27 min read

    Reverse engineering the Trump Accounts Android app (Robinhood wrapper)

    I decompiled the Google Play “Trump Accounts” app, listed under U.S. Department of the Treasury. It's a Robinhood wrapper compiled as an internal “Golden Eagle” flavor.

    10 min read
    All teardowns

    New teardowns by email

    Sign-up coming soon.

    NEW

    Ask the scan anything

    An AI model with code-search and inspection tools, working over the app's decompiled source. Ask in plain language, and it answers from the actual code, down to the file and line.

    Which file leaks the location?
    LocationHelper.java:142 passes coarse location to a third-party mapping SDK on launch, before any consent prompt.
    Try it on your app

    Trusted apps

    Apps that cleared all five checks.

    See all trusted apps

    The Hall of Trust lists apps that clear all five checks and hold that on every rescan.

    Run any app through the same five checks.

    Browse the Hall of Trust