Pebble Drop Saga

Mobile app · Pebblestone Games · com.example.pebbledrop

App identifier: com.example.pebbledrop
Publisher: Pebblestone Games
Platform: Android
Versions: App 3.8.1 · Android 14
Scan date and region: Oct 19, 2026 · EU (Ireland lab)
Consent state: Accepted and rejected tested; withdrawal not tested
Scan method: Lab device — authorized runtime traffic capture
Coverage: Substantial · methodology 0.9

Findings and evidence (7)

Observed 4
Unknown 2
Inferred 1

Evidence records show the request as captured, with identifiers and tokens redacted. Findings labeled Unknown state what could not be established; they are not findings of absence.

ObservedSeverity: HighConfidence: High

Advertising identifier sent to two advertising recipients

With consent accepted, requests to Adreach Exchange and Lanternfly Ads included the device’s advertising identifier.

Why it matters: The advertising ID lets advertising companies associate activity across apps on the same device.
Conditions: Consent accepted · Android 14 · App 3.8.1 · EU lab
Confidence basis: Readable request contents; value matched the test device’s advertising ID in 14 requests.
Limits of this finding: What recipients did afterward is not observable.
What you can do: Delete or disable the advertising ID in Android settings.

Evidence records (2)

R-PB-0142Consent acceptedt+00:01:12
POST https://ads.adreach.example/v2/req
Redacted request parameters for R-PB-0142
Parameter Value
ifa 3f2a••••-••••-••••(redacted)
bundle com.example.pebbledrop
lmt 0
R-PB-0157Consent acceptedt+00:01:20
POST https://bid.lanternfly.example/ortb
Redacted request parameters for R-PB-0157
Parameter Value
device.ifa 3f2a••••(redacted)
device.geo.lat 53.35
device.geo.lon -6.26

Redacted request parameters for R-PB-0142
Parameter	Value
ifa	3f2a••••-••••-••••(redacted)
bundle	com.example.pebbledrop
lmt	0

Redacted request parameters for R-PB-0157
Parameter	Value
device.ifa	3f2a••••(redacted)
device.geo.lat	53.35
device.geo.lon	-6.26

ObservedSeverity: HighConfidence: High

Coordinates rounded to about 1 km sent in an ad bid request

Bid requests to Lanternfly Ads included latitude and longitude rounded to two decimals, alongside the advertising ID.

Why it matters: Location at ~1 km precision can indicate neighborhood and routine when combined with an identifier.
Conditions: Consent accepted · location permission granted · EU lab
Confidence basis: Readable request; coordinates matched lab location to two decimal places.
Limits of this finding: Location permission was granted during the test. With permission denied, this was not tested.
What you can do: Set location permission for this app to “Don’t allow”.

Evidence records (1)

R-PB-0157Consent acceptedt+00:01:20
POST https://bid.lanternfly.example/ortb
Redacted request parameters for R-PB-0157
Parameter Value
device.geo.lat 53.35
device.geo.lon -6.26
device.geo.type 1

Redacted request parameters for R-PB-0157
Parameter	Value
device.geo.lat	53.35
device.geo.lon	-6.26
device.geo.type	1

ObservedSeverity: HighConfidence: Medium

Persistent installation identifier observed across sessions

The same installation ID was sent to Keystone Identity Graph in each tested session.

Why it matters: A stable identifier sent to an identity-resolution company can support linking activity over time.
Conditions: Consent accepted · 3 sessions · EU lab
Confidence basis: Same value in 3 sessions across 2 days (observed). Linkability across services is inferred from Keystone’s documented identity-resolution role.
Limits of this finding: Reinstalling the app was not tested.
What you can do: Reject consent at first launch.

Evidence records (1)

R-PB-0170Consent acceptedt+00:01:31
GET https://sync.keystoneid.example/id
Redacted request parameters for R-PB-0170
Parameter Value
iid k7••••••(redacted)
p pebblestone

Redacted request parameters for R-PB-0170
Parameter	Value
iid	k7••••••(redacted)
p	pebblestone

ObservedSeverity: ModerateConfidence: High

Requests to an advertising recipient continued after consent rejection

After rejection, the app still contacted Adreach Exchange with contextual ad requests (app name, level number) and no advertising ID.

Why it matters: Contact continued, but no advertising ID was observed in these requests. This describes behavior under the tested condition, not a legal conclusion.
Conditions: Consent rejected · EU lab
Confidence basis: Observed in every rejected session.
Limits of this finding: Withdrawal after earlier acceptance was not tested.
What you can do: Request a scan of the withdrawal scenario.

Evidence records (1)

R-PB-0233Consent rejectedt+00:00:48
POST https://ads.adreach.example/v2/req
Redacted request parameters for R-PB-0233
Parameter Value
ifa (absent)
bundle com.example.pebbledrop
ctx.level 12

Redacted request parameters for R-PB-0233
Parameter	Value
ifa	(absent)
bundle	com.example.pebbledrop
ctx.level	12

UnknownSeverity: UnknownConfidence: Low

Unresolved recipient: t.t-sync.example

The app sent 6 requests to t.t-sync.example. The operator could not be identified and contents were unreadable.

Why it matters: Without knowing the operator, the role and purpose of this contact cannot be assessed.
Conditions: Consent accepted · EU lab
Confidence basis: Operator not identified; association with Lanternfly Ads is inferred from shared certificate and IP range only.
Limits of this finding: Shared infrastructure does not establish common operation.

Evidence records (1)

R-PB-0188Consent acceptedt+00:01:40
POST https://t.t-sync.example/s
Redacted request parameters for R-PB-0188
Parameter Value
(body) Not readable — encrypted at application layer

Redacted request parameters for R-PB-0188
Parameter	Value
(body)	Not readable — encrypted at application layer

InferredSeverity: ModerateConfidence: MediumUnder review

Store disclosure says identifiers are not linked to you; linkable IDs observed

The publisher’s store data-safety section says device identifiers are not linked to identity. The app sent a persistent installation ID to Keystone Identity Graph.

Why it matters: A specific disclosure may not match observed behavior.
Conditions: Consent accepted · Store listing captured 2026-10-19
Confidence basis: Premise 1 (Declared): store listing states device IDs are “not linked to the user.” Premise 2 (Observed): a persistent ID was sent to an identity-resolution company.
Limits of this finding: “Linked” may be defined differently by the publisher.

Correction history

Oct 27, 2026: Publisher submitted a correction request (COR-2026-0181). Finding remains visible while under review.

Evidence records (1)

D-PB-STOREConsent acceptedt+—
DOC Store listing snapshot, 2026-10-19
Redacted request parameters for D-PB-STORE
Parameter Value
Device or other IDs “Collected · Not linked to you”

Redacted request parameters for D-PB-STORE
Parameter	Value
Device or other IDs	“Collected · Not linked to you”

UnknownSeverity: UnknownConfidence: High

Requests to Orbital Cloud could not be inspected

22 requests to events.orbitalcloud.example were encrypted inside the TLS session.

Why it matters: Contents and purpose of these requests remain unknown. Hosting contact does not establish purpose.
Conditions: Both scenarios · EU lab
Confidence basis: Application-layer encryption prevented reading contents.
Limits of this finding: Only destination and timing metadata available.

Evidence records (1)

R-PB-0301Consent acceptedt+00:02:02
POST https://events.orbitalcloud.example/b
Redacted request parameters for R-PB-0301
Parameter Value
(body) Not readable — 2.1 KB binary