Winnie — Go Out and Play 1.15 (iOS / App Store) on Jul 21, 2016

privacymeteronline
28 июл. 2016 г.
6 мин. чтения

Our examination revealed total 18 items, where were 8 DAR items and 10 DIT items. Among DAR items 1 best item found and among DIT items 0 best items found. Also 0 worst item found and 0 worst items found. This application is available for iOS here. This app was designed to help parents navigate the world with their children.

The latest build was released on Jul 16, 2016. Let's cite the description of this application below: ------------------------------------------- Winnie helps parents navigate the world with their children. We give moms, dads, and people who care for children the information they need to find great activities and destinations for families. With data on over 100,000 locations, here are some of the things you can do with Winnie: * Find kids' activities and places to play, including the best parks, playgrounds and libraries nearby. * Search for family-friendly restaurants with changing tables, kids menus, highchairs and whatever else you need for a stress-free outing. * Locate the closest place to nurse a baby, change a diaper, or use a potty. * Add stories about the places you visit and keep track of where you travel with your kids. Winnie currently works best in the San Francisco Bay Area, New York City, and Seattle. Early access is available for other parts of the country. -------------------------------------------

Protection levels.

Locally stored data (Data-at-Rest, DAR). Locally stored data groups include Media Information, Credentials Information, Social Information, Analytics 'n' Ads Information. The average DAR value is 3.94 points (7.00 points of system protection and 0.88 points of own protection). It is higher than a typical value (3.5 points, where's 7 points of system protection and 0 points of own protection).

Items #1 with average value 7.00 points (7 points of system protection, 7 points of own protection) means data protection levels have following definitions. Frankly talking, complianced but there are publicly known techniques to access the data where system protection case - root/jailbreak is required but not possible without wiping device data, and own protection case - data is not available in backups. - Screen Snapshots ('Media Information' Group) - Screenshots of your device screen running certain apps (by default available for iOS device but happens for any 3rd party apps that have such features). This data item related to mentioned group meant to be lot of data like photo, image, video, audio

Items #2 with average value 3.50 points (7 points of system protection, 0 points of own protection) means data protection levels have following definitions. Frankly talking, extra data found that shouldn't be accessed where system protection case - root/jailbreak is required but not possible without wiping device data, and own protection case - stored as is. - Credentials (Tokens) ('Credentials Information' Group) - Different tokens used to get an access to your account except passwords but incl. app or 3rd party tokens, secret keys and etc. (usually give a full access to your account). This data item related to mentioned group meant to be any types of credentials incl. basic (ids only), passwords, tokens, etc., - Credentials (IDs) ('Credentials Information' Group) - Only account IDs like app or 3rd party user IDs incl. emails, phone number, usernames and etc. (depends on apps). This data item related to mentioned group meant to be any types of credentials incl. basic (ids only), passwords, tokens, etc., - Credentials (Tokens) ('Social Information' Group) - Different tokens used to get an access to your account except passwords but incl. app or 3rd party tokens, secret keys and etc. (usually give a full access to your account). This data item related to mentioned group meant to be info grabbed from 3rd party social networks, - Media URLs ('Social Information' Group) - URLs related to media info such as stream media or profile's media, etc. This data item related to mentioned group meant to be info grabbed from 3rd party social networks, - Credentials (IDs) ('Social Information' Group) - Only account IDs like app or 3rd party user IDs incl. emails, phone number, usernames and etc. (depends on apps). This data item related to mentioned group meant to be info grabbed from 3rd party social networks, - Application Configs ('Analytics 'n' Ads Information' Group) - Different configuration files created by your app, perhaps app permissions. This data item related to mentioned group meant to be any kind of info related to analytics services like flurry, google analytics, etc. or advertisements, - Address Data ('Analytics 'n' Ads Information' Group) - Home, work or another type of owner address stored by apps. This data item related to mentioned group meant to be any kind of info related to analytics services like flurry, google analytics, etc. or advertisements

Also, keep in mind, using jailbroken device means the system protection level is 0 points and you're using out-of-dated iOS < 8.3 the system protection level is 2 points. If some data marked as shareable via iTunes, then the system protection level is 4 points.

Transferred data (Data-in-Transit, DIT). Transferred data groups include Location 'n' Maps Information, Credentials Information, Social Information. The average DIT value is 4.00 points (4.00 points of system protection and 4.00 points of own protection). It equals to a typical value (4 points, where's 4 points of system protection and 4 points of own protection).

Items with average value 4.00 points (4 points of system protection, 4 points of own protection) means data protection levels have following definitions. Frankly talking, data available if it's allowed only and may require user action where system protection case - informs if fake certificate imported into a device, and own protection case - bypassed by fake/stolen root certificates (doesn't check certificate path). - GEO Data ('Location 'n' Maps Information' Group) - Any kind of GEO info stored as plain text referred to the places or tracked activity. This data item related to mentioned group meant to be any type of GEO data from trackers, social networks, GPS, etc., - Credentials (IDs) ('Credentials Information' Group) - Only account IDs like app or 3rd party user IDs incl. emails, phone number, usernames and etc. (depends on apps). This data item related to mentioned group meant to be any types of credentials incl. basic (ids only), passwords, tokens, etc., - Credentials (Tokens) ('Social Information' Group) - Different tokens used to get an access to your account except passwords but incl. app or 3rd party tokens, secret keys and etc. (usually give a full access to your account). This data item related to mentioned group meant to be info grabbed from 3rd party social networks, - Credentials (IDs) ('Social Information' Group) - Only account IDs like app or 3rd party user IDs incl. emails, phone number, usernames and etc. (depends on apps). This data item related to mentioned group meant to be info grabbed from 3rd party social networks, - Credentials (Passwords) ('Social Information' Group) - Well known passwords or PINs you're using to get an access to your account (usually worse than tokens because gives a full access to your account). This data item related to mentioned group meant to be info grabbed from 3rd party social networks, - Credentials (Tokens) ('Credentials Information' Group) - Different tokens used to get an access to your account except passwords but incl. app or 3rd party tokens, secret keys and etc. (usually give a full access to your account). This data item related to mentioned group meant to be any types of credentials incl. basic (ids only), passwords, tokens, etc., - Address Data ('Location 'n' Maps Information' Group) - Home, work or another type of owner address stored by apps. This data item related to mentioned group meant to be any type of GEO data from trackers, social networks, GPS, etc., - Place Details ('Location 'n' Maps Information' Group) - Any info about public place (city, country, address, contacts) stored in text or media file format. This data item related to mentioned group meant to be any type of GEO data from trackers, social networks, GPS, etc., - Location History ('Location 'n' Maps Information' Group) - History list of addresses, GEO data, etc. This data item related to mentioned group meant to be any type of GEO data from trackers, social networks, GPS, etc., - Tracked Data 'n' Favourites ('Location 'n' Maps Information' Group) - Any kind of favourites data or tracked data marked as desirable by users and for users (Like is that user is on fb messenger, viber, bank client or favourite hotel, room type, flight route, airline). This data item related to mentioned group meant to be any type of GEO data from trackers, social networks, GPS, etc.

Keep in mind if you're using out-of-dated iOS < 9.0, the system level equals 2 points instead of 4. It means your data can be stolen without involving your actions.

Below you find two infographics summarizing what we described above.

First pic includes info about data items combined into groups and best protected items found.

Second pic includes info about data items separately from group and worst protected items found

Privacy Policy Full application privacy policy is available here. You may find privacy policy details proceeding the link above to compare developer's vision on data protection with our results.