ObservedSeverity: UnknownConfidence: High
Contact with an advertising recipient; contents not readable
The app contacted ads.adreach.example 9 times during lessons.
Little Sprouts ABC
Mobile app · Bramble Kids Studio · com.example.sprouts
- App identifier
- com.example.sprouts
- Publisher
- Bramble Kids Studio
- Platform
- Android
- Versions
- App 5.1.2 · Android 13
- Scan date and region
- Apr 30, 2026 · US-East (Virginia lab)
- Consent state
- Parental gate accepted; rejection not offered in app
- Scan method
- Lab device — authorized runtime traffic capture
- Coverage
- Partial · methodology 0.8
Privacy exposure
38 / 100
Moderate measured exposure
Summary of the tested session
During the tested session, the app contacted 4 recipient companies, including one advertising service. Contents of requests to 2 recipients could not be read, so this report may understate what was shared.
Evidence coverage: Partial
Meets the minimum for rating, but significant parts of behavior could not be observed. Readable request contents: 41%.
Principal findings
ObservedSeverity: ModerateConfidence: High
Lesson events sent to analytics with a per-install identifier
Lesson completions and session length were sent to Tallymark Analytics with a stable install ID.
UnknownSeverity: UnknownConfidence: High
Contents of requests to 2 recipients could not be inspected
59% of requests were unreadable.
What information was involved
A permission alone is not treated as evidence of collection or transmission.
| Category | Status | Detail |
|---|---|---|
| Advertising and device identifiers | Observed in a transmission | Per-install identifier sent to analytics. |
| Network information | Observed in a transmission | IP address visible to contacted servers. |
| Approximate or precise location | Not assessable with this method | Unreadable requests may or may not contain location. |
| Browsing and interaction events | Not assessable with this method | Not assessable for unreadable requests. |
| App usage and viewing events | Observed in a transmission | Lesson completion events. |
| Account or contact information | Declared by the publisher | Publisher declares parent email for progress reports. Not tested. |
| Sensitive contextual information | Not assessable with this method | Not assessable for unreadable requests. |
Behavior under tested privacy choices
| Scenario | Status | Recipients contacted | Companies |
|---|---|---|---|
| Consent accepted | Tested | 4 | Adreach Exchange, Tallymark Analytics, Orbital Cloud, Nimbus Edge |
| Consent rejected | Not tested | Unknown | Not established |
| Consent withdrawn | Not tested | Unknown | Not established |
Why this rating
Illustrative · methodology 0.8
Sensitivity of observed information8/20
Persistence and linkability of identifiers8/20
Recipient roles and dissemination evidence10/20
Behavior under tested privacy choices6/20
Disclosure–observation discrepancies6/20
Five dimensions, 0 to 20 each, sum to the score. Coverage gaps never lower a score.
What remains unknown
- Requests to Adreach Exchange and Orbital Cloud used certificate pinning; contents unreadable (59% of requests).
- The app offers no in-app rejection; rejection and withdrawal scenarios could not be tested.
- Scanned under methodology 0.8; evidence is approaching the 180-day staleness threshold.
What you can do
Ask the publisher what is sent to the advertising recipient
May clarify the contents we could not inspect.
Review a recipient’s privacy information
Some recipients offer their own opt-out or deletion process.
Not a legal compliance certification or a safety guarantee. Child-audience assessment: Publisher-declared (separate from this rating). 4 recipient companies observed in this scan.