Flutterwave / AndroidSDK

Rave's Android Drop In UI
7 stars 8 forks source link

Privacy Violation: Application Uses Trackable Device Identifiers #242

Closed asif-ullah closed 3 years ago

asif-ullah commented 3 years ago

Privacy Violation: Application Uses Trackable Device Identifiers Low Location ID 21549359 - com​/flutterwave​/raveandroid​/data​/DeviceIdGetter​.java ID 21549360 - com​/flutterwave​/raveandroid​/data​/Utils​.java ID 21549361 - com​/flutterwave​/raveandroid​/rave_presentation​/data​/Utils​.java

Summary The application was found to access identifiers that can be used to track a specific device.

Explanation The application was found to access identifiers that can be used to track a specific device across applications and potentially across device factory resets. Use of these identifiers may cause privacy concerns and/or be regulated in certain jurisdictions. The application was found to have

return Settings.Secure.getString((ContentResolver)this.context.getContentResolver(), (String)"android_id"); that accesses Android ID which can be used to track a specific device.

Recommendation Review all uses of trackable identifiers. Consider replacing with a randomly generated instance lifetime identifier unique to the application.

bolaware commented 3 years ago

Hello @asif-ullah,

Thanks for your concern. Using the sdk means you've accepted our privacy policy here(https://flutterwave.com/us/privacy-policy) when signing up. Flutterwave is a financial company and personal details might be needed as deemed by fit by the organisation for identity verification and fraud mitigation. If you aren't comfortable with that, it's however not an issue to be addressed on an android sdk level, you might have to contact our central team at privacy@flutterwavego.com.