Scan results

Recommendation: Trustworthy

Tripsy earns strong marks for keeping itineraries, reservations, and travel documents away from advertising networks and data brokers, with no ad SDKs or cross-app tracking present. AI features for email parsing and itinerary suggestions run entirely on the device through Apple on-device models, so that content is never transmitted to an external AI service. A few areas could be strengthened, particularly around local data protection and network configuration.

Key Findings

Data Security: 1 finding (1 medium)

Network Security: 0 findings

Code Safety: 2 findings (2 low)

Privacy: 0 findings

Privacy Concerns

What Leaves the Device

• Usage analytics: sent to Mixpanel to measure feature interactions
• Session performance and crash data: sent to Sentry, which includes a session replay component that may capture in-app screen content during a session
• App Store install attribution: sent to ASATools

What Stays on the Device

• Trip itineraries, reservations, and travel documents are kept on the device and are not shared with advertising networks or data brokers
• AI-assisted features, including email parsing and itinerary suggestions, are processed on the device via Apple FoundationModels and do not transmit content to external AI services

Third-Party Data Sharing

Third parties that may receive data from the app:

• Sentry - crash reporting and session performance monitoring, including a session replay component
• Mixpanel - usage analytics and feature measurement
• ASATools - App Store install attribution
• Cloudinary - media content delivery

Understanding the Scores

Security: 86/100
Privacy: 91/100

Security Breakdown

• Data Security: 83/100. Trip content and booking data are kept off advertising networks, with one limited-scope concern around the configuration of a third-party travel import integration.
• Network Security: 81/100. Traffic to active API endpoints uses HTTPS. Network configuration could be tightened to ensure consistent HTTPS enforcement across all connections.
• Code Safety: 93/100. The app's code structure is clean and well-organized, with secure third-party authorization flows and no JavaScript-to-native bridges that could expand the web-based attack surface.

Privacy Breakdown

• Data Collection: 91/100. Data collection is focused on app functionality and performance monitoring, with no advertising or behavioral profiling SDKs present.
• Data Sharing: 94/100. Trip content, itineraries, and travel documents are not shared with external advertising networks, data brokers, or cross-app tracking systems.
• User Control: 93/100. Users retain full control over their core travel data, with trip content remaining on the device and entirely outside advertising systems.

Positive Security Features

• Trip content, itineraries, and booking data are not shared with advertisers, data brokers, or cross-app tracking systems
• No advertising networks or cross-app tracking SDKs are included in the app
• AI-assisted features (email parsing, itinerary suggestions) run entirely on the device via Apple FoundationModels, with no content sent to external AI services
• Third-party authorization flows use system-provided secure browser sessions, providing strong protection against interception during the handoff
• No JavaScript-to-native bridge is present in web views, minimizing the web-based attack surface

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Analytics Opt-Out Transparency
   Providing clearer in-app documentation about how analytics data is used and how users can adjust or opt out of Mixpanel analytics would improve user control.

2. App Store Privacy Manifest
   Adding an app privacy manifest could make the App Store privacy label more complete and ensure all system API usage reasons are formally declared.

Security Enhancements

1. Local Travel Database Protection
   Enabling encryption for the local database that stores reservation codes and booking details would protect this information if a device were lost or compromised.

2. Third-Party Integration Configuration Management
   Storing third-party integration configuration server-side rather than embedding it in the app would reduce the risk of that configuration being accessed by others.

3. Network Configuration Hardening
   Tightening network configuration to require HTTPS for all connections, including API subdomains, would ensure data in transit is consistently protected.

Technical Context

App Type: Travel planning app handling itineraries, flights, accommodations, and travel documents
Classes Analyzed: 0
Third-Party Services: 11 services identified
Context Tags: travel, sensitive_data, location, financial, documents

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Tripsy
Version: 3.8.15 (Build 4187)
Analysis Date: 2026-08-05
Package: app.tripsy.ios

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS app version 3.8.15 analyzed on 2026-08-05
• May not reflect server-side security controls
• Cannot detect all runtime behaviors