Mobile app business due diligence in Canada

Diligence on a mobile app business is a set of reconciliations. A buyer under a letter of intent can match reported revenue to what the stores paid, the third-party code in the build to what the privacy policy says, the repository to the people who wrote it, and every account to its legal holder. Each begins with a specific document request and ends with a finding that is closed, priced or made a condition of closing. This page follows that order and says what each finding means when it appears. It describes checks, not outcomes.

Rebuild revenue from the store reports

Start with the stores’ own financial and payout reports for the full period, then the ad networks’ statements and the bank deposits, and tie the three together. The analytics dashboard comes last, because it is the seller’s tool rather than the platform’s record. Read the monthly series for a step that matches a store feature, a press mention or a viral post, since revenue from one moment may not recur. Check refunds, cancellations and failed renewals for subscriptions, look at the split by country and by store, and compare the installs the analytics claim with the store’s own count. Any gap between what the dashboard says and what the platform paid is the first finding, and a buyer can work from the lower figure until the gap is explained.

Check what is inside the build

Ask for a list of every third-party software development kit in the current build: analytics, advertising, crash reporting, attribution, payments and login. Then compare it with the privacy policy and with the privacy disclosures the app has given each store. A kit that collects data the policy never mentions can undercut the consent the app relies on, since PIPEDA makes consent only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure. For Quebec users, the Commission d’accès à l’information says an organization collecting personal information from a person through technology that can identify, locate or profile them must inform the person beforehand that such technology is used and of the means offered to activate those functions, which cannot be activated by default, and that a technological product or service offered to the public must default to the highest level of confidentiality, a rule that does not apply to the settings of a connection cookie. Each store’s own privacy requirements for apps should also be checked against the kits in the build.

Match the code to the signed paper

Compare everyone who has committed code or uploaded assets, as the repository history records them, with the signed employment and contractor agreements. Under the Copyright Act an employer is first owner of a work made by an author employed under a contract of service or apprenticeship, in the course of that employment, unless there is an agreement to the contrary, while an assignment of copyright is valid only if it is in writing signed by the owner or the owner’s duly authorized agent. Moral rights may not be assigned but may be waived in whole or in part, so an assignment agreement can include a waiver. A contractor or other non-employee author with no signed assignment means the company may not own that part of the app. Confirm that the company, not an individual, holds the repository, the signing keys and the backend credentials, and list the open-source components with their licence terms. The answer on who owns the intellectual property after a sale is a useful companion.

Search the registries and the accounts

Registry work tests what the seller says about encumbrances and ownership. Ontario’s Personal Property Security Act defines a security interest as an interest in personal property that secures payment or performance of an obligation, and an intangible as all personal property, including choses in action, that is not goods, chattel paper, documents of title, instruments, money or investment property. A lender’s registered interest against the seller or its company can therefore sit over the app’s intellectual property as well as its equipment. Other provinces run their own registers, and Ontario’s Act governs a security interest in an intangible by the law of the jurisdiction where the debtor is located when the interest attaches, so the search follows where the seller is located. The Canadian Intellectual Property Office’s copyright register accepts assignments, licences and other documents, so check what is on record there. Finally, ask to see the store accounts, ad-network accounts and domain registrations on screen, with the account holder visible.

Privacy record, breaches and children’s apps

Ask for the privacy policy history, the consent records and the breach record. The Office of the Privacy Commissioner’s guidance says PIPEDA requires an organization to keep a record of every breach of security safeguards involving personal information under its control, whether or not it presents a real risk of significant harm, and to keep those records for two years. The OPC can ask to see them. A busy app whose record has no entries prompts a question about how incidents are detected. Where the app is directed at children, the question of whether the intended audience would understand what they are consenting to is harder to answer. In Quebec, the Commission d’accès à l’information says personal information about a minor under 14 may no longer be collected from that minor without the consent of the person with parental authority or the tutor, except where the collection is manifestly for the minor’s benefit. Ask how the app obtains that consent.

Findings that end deals, and what they mean

• An account that cannot move under the store’s terms: the app would have to be republished as a new listing, and reviews, ranking history and subscribers may not come with it. A buyer can then reprice, or turn to buying the company that holds the account, with the liabilities that brings.
• A third-party kit collecting data the policy never mentions: possible fixes are a rebuilt release and a corrected policy before closing, with a specific indemnity for what was collected in the meantime.
• Revenue concentrated in one moment: a buyer can work from the baseline after it, and the price can move accordingly.
• A contributor with no signed assignment: a confirmatory assignment can become a condition of closing, or that part of the app can be rewritten.
• Store payouts that do not reconcile to reported revenue: a buyer can use the lower figure until the seller explains the gap.