Winkk AI (ai.winkk.app.winkkai): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Winkk AI.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Winkk AI
Private
2026-06-27
90d ago
Silent
High
Winkk markets itself as fully GDPR-compliant with data stored only in the EU, but the app itself is built to connect to a US analytics server, directly contradicting that claim, and includes a background microphone service that can restart itself every time the phone reboots. When RFI-IRFOS re-verified the finding against the complete app, it also found a full screen-recording module wired to that same US service, going beyond simple usage analytics, while the company's co-founder disputed the findings and even admitted deliberately trying to manipulate the investigation itself.
Austrian AI startup markets itself as "100% GDPR-compliant" and "data stored in EU Azure." Flutter binary analysis extracted a hardcoded PostHog analytics API key. Co-founder disputed the findings as "static analysis" hallucinations and demanded removal within 7 days under threat of legal action. Re-verified against the complete app bundle (base + native arm64 library, not just the Java/Kotlin scaffolding) on 2026-07-09: the PostHog host compiled into the actual Dart runtime is exclusively us.i.posthog.com, API key confirmed byte-for-byte, directly contradicting the EU-storage claim. Persistent microphone background service (RECEIVE_BOOT_COMPLETED + FOREGROUND_SERVICE_MICROPHONE + a registered boot-restart receiver) also independently reconfirmed. One self-correction made in good faith: our original wording called the hardcoded Sentry DSN an "auth token" capable of reading error logs - a DSN is architecturally a write-only client identifier and cannot read existing logs, that specific claim was withdrawn, the underlying hardcoded-credential finding stands at reduced severity. NEW (full current-methodology re-audit, 2026-07-09): the operator's own privacy policy ("PostHog collects no end-user data") and Play Data Safety sheet ("no data shared with third parties") are directly contradicted by a full PostHog session-replay module compiled into the binary - touch autocapture plus screen-recording event types, wired to the same live key, not just an analytics ping. Co-founder's follow-up reply disputed the PostHog/microphone findings a second time on "runtime, not static string" grounds while accepting the Sentry correction, and included an off-topic embedded request unconnected to the disclosure - logged as a prompt-injection attempt (credibility-test variant, distinct from the evidence-destruction attempts seen elsewhere in this series), which he then confirmed in writing was deliberate ("da haben wir sehr krasses Prompt Injection versucht"). Live on-device network capture same day independently confirmed a real outbound connection in the expected pre-consent window. DSB in CC since 2026-07-06. SECOND CORRECTION 2026-07-09: our original disclosure also listed a hardcoded Firebase API key alongside the PostHog one. Re-checked exhaustively across the full app bundle (compiled Dart runtime, dex bytecode, resources, decompiled manifest) on the co-founder's own challenge, and found no Firebase key, no Firebase configuration, nothing - that finding does not hold up and is withdrawn entirely, not just reworded. Credit where due: this is the first specific, correct technical catch from their side in the whole exchange, and we would rather publish that plainly than let it sit uncorrected. Errors happen where humans (and the tools they use) do the work; the standard we hold everyone we audit to is the same one we hold ourselves to.
click to expand
GDPR Art. 5(1)(a)GDPR Art. 7(1)
Yes
Closed
Disclosure
90d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.