Little Sprouts ABC

Mobile app · Bramble Kids Studio · com.example.sprouts

App identifier: com.example.sprouts
Publisher: Bramble Kids Studio
Platform: Android
Versions: App 5.1.2 · Android 13
Scan date and region: Apr 30, 2026 · US-East (Virginia lab)
Consent state: Parental gate accepted; rejection not offered in app
Scan method: Lab device — authorized runtime traffic capture
Coverage: Partial · methodology 0.8

Findings and evidence (3)

Observed 2
Unknown 1

Evidence records show the request as captured, with identifiers and tokens redacted. Findings labeled Unknown state what could not be established; they are not findings of absence.

ObservedSeverity: UnknownConfidence: High

Contact with an advertising recipient; contents not readable

The app contacted ads.adreach.example 9 times during lessons.

Why it matters: In a child-audience app, contact with an advertising service warrants attention. What was sent is unknown.
Conditions: Parental gate accepted · Android 13
Confidence basis: Destination observed; contents protected by certificate pinning.
Limits of this finding: Contents unreadable; purpose not established.
What you can do: Ask the publisher which data is sent to Adreach Exchange.

Evidence records (1)

R-LS-0044Consent acceptedt+00:03:10
POST https://ads.adreach.example/v2/req
Redacted request parameters for R-LS-0044
Parameter Value
(body) Not readable — pinned certificate

Redacted request parameters for R-LS-0044
Parameter	Value
(body)	Not readable — pinned certificate

ObservedSeverity: ModerateConfidence: High

Lesson events sent to analytics with a per-install identifier

Lesson completions and session length were sent to Tallymark Analytics with a stable install ID.

Why it matters: Usage events tied to a stable identifier can build a profile of a child’s activity over time.
Conditions: Parental gate accepted
Confidence basis: Readable contents.

Evidence records (1)

R-LS-0051Consent acceptedt+00:03:22
POST https://collect.tallymark.example/v1/e
Redacted request parameters for R-LS-0051
Parameter Value
event lesson_complete
iid s••••(redacted)

Redacted request parameters for R-LS-0051
Parameter	Value
event	lesson_complete
iid	s••••(redacted)

UnknownSeverity: UnknownConfidence: High

Contents of requests to 2 recipients could not be inspected

59% of requests were unreadable.

Why it matters: This report may understate exposure. Uninspected behavior is not counted as absence.
Conditions: All tested sessions
Confidence basis: Certificate pinning.

Evidence records (0)

No evidence record: this finding states what was not established.