Hello Google Cloud reCAPTCHA Team,
We are reviewing the Google Play Data Safety declarations for our published Android application SEYCHAS.
Application environment:
-
Framework: Flutter
-
Android minSdk: 24
-
Android targetSdk: 36
-
reCAPTCHA Android SDK: 18.7.1
-
Integration: Firebase Authentication (conditional reCAPTCHA verification)
Our technical investigation confirmed that the primary reCAPTCHA endpoint uses HTTPS. However, we could not establish complete transport guarantees for auxiliary requests using dynamically supplied URLs and for embedded WebView navigation, redirects, and subresources.
We have not identified any confirmed unencrypted transmission of user data or demonstrated security vulnerability.
We would appreciate clarification of the following questions:
1. Encryption in transit
Does reCAPTCHA Android SDK 18.7.1 ensure that all SDK-controlled network requests carrying user or device data use HTTPS/TLS, including auxiliary GET requests, dynamically supplied URLs, WebView navigation, redirects, and subresources?
Does this also apply on Android API levels 24–27, where the platform's default cleartext policy differs from newer Android versions?
2. Data collection
Which data categories are actually collected by SDK version 18.7.1 when invoked through Firebase Authentication?
In particular, we would like to clarify the collection of app interactions, device identifiers, installed-app information, and diagnostic data, including which collection is automatic or conditional.
3. Google Play Data Safety
What processing purposes, sharing classifications, and retention practices apply to these SDK operations?
4. Official technical guidance
Is there version-specific documentation or guidance from the reCAPTCHA engineering team confirming the applicable transport security guarantees and recommended configuration?
Our goal is to ensure that our Google Play Data Safety declarations accurately reflect the actual SDK behavior.
Thank you for your assistance.
