Easy Voice Recorder (com.coffeebeanventures.easyvoicerecorder): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Easy Voice Recorder.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Easy Voice Recorder
Private
2026-06-25
92d ago
Silent
High
This voice-recording app leaves your recordings eligible for automatic backup to Google's servers with no way to opt out and no disclosure that this happens, meaning medical dictations, confidential conversations, or private memos could leave your device without you ever being told. Google's advertising system also starts running inside the app before your phone is even unlocked. Across twelve separate messages, RFI-IRFOS received only one generic automated ticket confirmation and no human response.
com.coffeebeanventures.easyvoicerecorder v2.10.2.1. All five findings re-scored under CVSS v4.0. allowBackup left enabled with no exclusion rules, meaning every recorded audio file, medical dictations, confidential conversations, professional memos included, is eligible for Google Cloud Backup with no disclosed opt-out, reaches HIGH/8.7 on the computed CVSS score alone. AdMob and Firebase both directBootAware=true, initOrder=100, initializing before device unlock, a hardcoded Firebase key, and Privacy Sandbox Topics inference from recording patterns all correct to MEDIUM. Undocumented WRITE_SETTINGS + READ_PHONE_STATE correct to LOW. Twelve messages sent across 79 days to support@/privacy@digipom.com; only one automated ticket confirmation ever came back, no human engagement across the entire correspondence.
click to expand
GDPR Art. 7GDPR Art. 5(1)(c)GDPR Art. 32+1
Yes
Closed
Disclosure
92d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.