Permanent Disclosure Ledger
The discipline, demonstrated
We decompile publicly distributed Android and iOS apps and trace their data flows to real endpoints in real countries. We document what we observe, distinguish verified findings from interpretation, and preserve the evidence behind every conclusion. No company can buy a better result — every organisation is held to the same standard, whether it pays us or not. This permanent disclosure ledger puts that principle into practice.
This is what a Security engagement produces. See what you’d receive →
387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found and documented
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
19 of 387 entries · sorted by elapsed ↓
Showing the report for ORF TVthek, ORF Ö3, ORF Radio Burgenland, ORF Radio Kärnten, ORF Radio Niederösterreich, ORF Radio Oberösterreich, ORF Radio Salzburg, ORF Radio Steiermark, ORF Radio Tirol, ORF Radio Vorarlberg, ORF Radio Wien, ORF News, ORF Ö1, ORF SOUND, ORF Sport, ORF Fußball, ORF Teletext, ORF Radio FM4, ORF ORFit.
OrganisationNotifiedStatusSEVIntel (click to expand)StatutesResolvedDisclosureElapsedReport
ORF TVthek
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's TV app, funded by a mandatory household levy, reads your Google advertising identifier and runs a full stack of advertising and audience-measurement tools while you watch. Every app across the whole ORF family shares one single Firebase access key, so a public broadcaster people are required to pay for still builds an advertising profile from what you watch.
com.nousguide.android.orftvthek. ORF (levy-funded public broadcaster), built by nousguide GmbH. Full ad-tech on a compulsorily-funded broadcaster: AppsFlyer attribution + Google Ad Manager/IMA + INFOnline/ÖWA + GfK Sensic + Bitmovin + Sentry + Didomi CMP; the Google Advertising ID is actively read. The whole at.orf.* family hangs off one shared Firebase orf-push key. Consent gating attempted (Didomi) but pre-consent tracker init unverified (R2). Art. 9 (news). R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 5(1)(a)GDPR Art. 7GDPR Art. 32+1
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Ö3
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's Ö3 radio app, part of the levy-funded public broadcaster's family, reads your advertising identifier and shares the same tracking setup as its sister apps, but also allows fully unencrypted connections and requests camera, microphone and precise-location permissions that a radio app has no clear need for.
at.orf.android.oe3. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; shared Firebase orf-push key AIzaSyDDPB… . DELTA: global cleartext NSC + CAMERA / RECORD_AUDIO / FINE_LOCATION permissions beyond the family set. Part of the ORF app family. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Radio Burgenland
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's regional radio app for Burgenland, built from the same template used across all nine Austrian states, reads your advertising identifier and shares one single access key with every other ORF app, so a publicly funded local station still runs the same advertising-tracking setup on its listeners.
at.orf.android.orfburgenland. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; shared Firebase orf-push key AIzaSyDDPB… + Sentry. One identical APA/ORF regional build across all 9 Landesstudios. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Radio Kärnten
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's regional radio app for Carinthia reads your advertising identifier and runs on the exact same build and shared access key as every other ORF regional station, so a publicly funded local broadcaster feeds listener data into the same advertising-tracking system.
at.orf.android.orfkaernten. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; shared Firebase orf-push key AIzaSyDDPB… . Identical APA regional build. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Radio Niederösterreich
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's regional radio app for Lower Austria reads your advertising identifier and shares the identical build and access key used by all nine ORF regional stations, so a publicly funded local broadcaster runs the same advertising-tracking setup on its listeners.
at.orf.android.orfniederoesterreich. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; shared Firebase orf-push key AIzaSyDDPB… . Identical APA regional build. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Radio Oberösterreich
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's regional radio app for Upper Austria reads your advertising identifier and runs on the same identical build and shared access key as every other ORF regional station, so a publicly funded local broadcaster feeds listener data into the same advertising-tracking system.
at.orf.android.orfoberoesterreich. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; shared Firebase orf-push key AIzaSyDDPB… . Identical APA regional build. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Radio Salzburg
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's regional radio app for Salzburg reads your advertising identifier and shares the identical build and access key used across all nine ORF regional stations, so a publicly funded local broadcaster runs the same advertising-tracking setup on its listeners.
at.orf.android.orfsalzburg. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; shared Firebase orf-push key AIzaSyDDPB… . Identical APA regional build. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Radio Steiermark
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's regional radio app for Styria reads your advertising identifier and runs on the same identical build and shared access key as every other ORF regional station, so a publicly funded local broadcaster feeds listener data into the same advertising-tracking system.
at.orf.android.orfsteiermark. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; shared Firebase orf-push key AIzaSyDDPB… . Identical APA regional build. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Radio Tirol
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's regional radio app for Tyrol reads your advertising identifier and shares the identical build and access key used across all nine ORF regional stations, so a publicly funded local broadcaster runs the same advertising-tracking setup on its listeners.
at.orf.android.orftirol. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; shared Firebase orf-push key AIzaSyDDPB… . Identical APA regional build. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Radio Vorarlberg
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's regional radio app for Vorarlberg reads your advertising identifier and runs on the same identical build and shared access key as every other ORF regional station, so a publicly funded local broadcaster feeds listener data into the same advertising-tracking system.
at.orf.android.orfvorarlberg. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; shared Firebase orf-push key AIzaSyDDPB… . Identical APA regional build. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Radio Wien
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's regional radio app for Vienna reads your advertising identifier and shares the identical build and access key used across all nine ORF regional stations, so a publicly funded local broadcaster runs the same advertising-tracking setup on its listeners.
at.orf.android.orfwien. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; shared Firebase orf-push key AIzaSyDDPB… (identical across the whole family). Identical APA regional build. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF News
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's news app reads your advertising identifier, allows fully unencrypted connections and full device backups, and runs its own separate tracking setup on top of the shared ORF advertising stack. A publicly funded source of political news quietly builds a profile of your reading behaviour, which can reveal your political leanings.
at.orf.news. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; OWN Firebase project news-8d549 (not orf-push) + Bitmovin video; cleartext HTTP + allowBackup=true. Art. 9 political content (news-reading behaviour). R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 9(1)GDPR Art. 32(1)(b)+1
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Ö1
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's Ö1 cultural radio app reads your advertising identifier, allows unencrypted connections for its audio streams, and requests your approximate location, so even a levy-funded cultural broadcaster layers advertising tracking and location data onto its listeners.
at.orf.oe1. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; Firebase orf-push key + Crashlytics + Sentry; NSC base cleartext=true (APA radio streams); COARSE_LOCATION. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32GDPR Art. 5(1)(c)
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF SOUND
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's SOUND music app carries the heaviest advertising setup of the whole ORF family, reading your advertising identifier, requesting your precise location inside what is just an audio player, and allowing unencrypted connections and full device backups, so a publicly funded music service quietly gathers detailed data about its listeners.
at.orf.sound. ORF (levy-funded public broadcaster). Heaviest audio ad stack: AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; Firebase orf-push + Crashlytics; ACCESS_FINE_LOCATION in an audio app; cleartext; allowBackup=true. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 5(1)(c)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Sport
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's sports app reads your advertising identifier and runs its own separate tracking project alongside the shared ORF advertising stack, while also allowing fully unencrypted connections and full device backups. A publicly funded sports service still profiles what you read while leaving your data less protected both in transit and in backups.
at.orf.sport. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; OWN Firebase project sport-9a2eb (not orf-push) + Bitmovin video; cleartext + allowBackup=true. Art. 9-adjacent (reading behaviour). R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32(1)(b)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Fußball
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's football app carries the widest range of tracking tools of any app in the ORF family, reading your advertising identifier and allowing unencrypted connections, alongside a broken phone-state permission declaration. A publicly funded sports app pulls in more listener and device data than any other ORF service reviewed.
at.orf.sport.fussball. ORF (levy-funded public broadcaster). Heaviest stack of the family: AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP + GfK Sensic + Bitmovin; GAID read; Firebase orf-push + Crashlytics; cleartext; malformed ANDROID.PERMISSION.READ_PHONE_STATE. Art. 9-adjacent. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 32(1)(b)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Teletext
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's Teletext app reads your advertising identifier and allows unencrypted connections, while also bundling two custom certificate authorities that can undermine the app's ability to actually prove it is talking to the real ORF server. Even a simple public-service text news page ends up layering advertising tracking and a potential interception risk onto your news reading.
at.orf.teletext. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; Firebase orf-push + Crashlytics; NSC cleartext=true + 2 bundled custom CA roots. Art. 9 political content (news-page reading). R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 9(1)GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF Radio FM4
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's FM4 app runs under a package name built by an outside agency rather than ORF itself, which raises the question of who is actually responsible for the data it collects. It still reads your advertising identifier and allows both unencrypted connections and full device backups of your listening data.
at.zuggabecka.radiofm4. ORF (levy-funded public broadcaster). AppsFlyer + Google Ad Manager + INFOnline/ÖWA + Didomi CMP; GAID read; Firebase orf-push + Crashlytics under a NON-ORF package namespace (at.zuggabecka.* agency build) - processor/joint-controller question; cleartext; allowBackup=true. R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 6(1)GDPR Art. 26GDPR Art. 32
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
ORF ORFit
PUBLIC
2026-07-01
108d ago
RESOLVED
HIGH
ORF's fitness app, built by an outside company, has no consent tool at all, yet it still runs several ad networks and reads your advertising identifier while collecting real health data: your activity, precise location, and heart rate from a connected Bluetooth device. It also routes through Huawei's Chinese services, so a public broadcaster's fitness app tracks both your behaviour and your health with no consent gate protecting any of it.
com.catapult.orf. ORF (levy-funded public broadcaster), third-party Catapult fitness build - the outlier. NO CMP at all (no Didomi/INFOnline) while shipping AppsFlyer + Google AdMob + AppLovin + GAID; Firebase = Catapult project catapult-268006 (AIzaSy…ocB4, not orf-push); Art. 9 HEALTH data (ACTIVITY_RECOGNITION + FINE_LOCATION + Bluetooth Polar heart-rate) + Huawei HMS (China). R1 2026-07-01. ORF app family (19 apps): disclosed 2026-07-01, 10 messages over 73 days, zero replies, published 2026-10-17, 18 days past the 2026-09-29 embargo.
click to expand
GDPR Art. 7GDPR Art. 9GDPR Art. 26
YES
CLOSED
DISCLOSURE
108d 00h 00m 00s
PUBLISHED
this ledger is updated in real time as companies respond. silence is public. severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius. · github.com/rfi-irfos/android-security-audit-2026