onTracker Security & Privacy Scorecard
Android
Location and usage activity is collected and shared with Google Ads and Firebase Analytics. Data control options are limited, with few settings to restrict what gets shared. Ad targeting based on user behavior is enabled by default.
Best for
Package tracking with Google analytics in the mix
Avoid if
You prefer not sharing location data with ad networks
Findings
- 6 critical
- 1 high
- 3 medium
- 1 low
- 1 info
0 issues identified across security and privacy analysis.
Top security issues
- Google OAuth Tokens Stored in Plaintext
- Cleartext Traffic Enabled (Potential HTTP Backend)
- Android Auto Backup Enabled for Sensitive Data
Top privacy issues
- Extensive Analytics Tracking Without Consent
- False Privacy Claims in Play Store Data Safety Declaration
- Analytics Events Stored in Plaintext Database
Full analysis
onTracker
co.ontracker.app.manager | Version 3.2 | Scanned 2026-02-04
What This Means for You
Location and usage activity is collected and shared with Google Ads and Firebase Analytics. Data control options are limited, with few settings to restrict what gets shared. Ad targeting based on user behavior is enabled by default.
Recommendation: Use With Caution
Best For: Package tracking with Google analytics in the mix
Avoid If: You prefer not sharing location data with ad networks
Key Findings
Data Security - 3 findings (1 critical, 1 high, 1 medium)
Network Security - 1 finding (1 critical)
Code Safety - 0 findings
Privacy - 3 findings (2 critical, 1 high)
Privacy Concerns
What Data is Collected
The app collects precise location through Google Play Services Location. Firebase Analytics records how the app is used, and Google App Set ID assigns a cross-app identifier to the device that connects activity across multiple applications.
Third-Party Data Sharing
User data is shared with the following third-party services:
- Firebase Analytics - Usage and behavioral analytics
- Firebase Cloud Messaging - Push notification delivery
- Google Ads - Behavioral advertising targeting
- Google Maps - Location and mapping features
- Google Play Services Location - Precise location tracking
- Google App Set ID - Cross-app device identifier
- Embarcadero FireMonkey Framework - App development framework
Understanding the Scores
| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 35/100 |
| Data Security | 40/100 |
| Network Security | 30/100 |
| Code Safety | 55/100 |
| Data Collection | 25/100 |
| Data Sharing | 30/100 |
| User Control | 20/100 |
Positive Security Features
- None identified in this version of the app.
Areas for Improvement
- Location data is shared with advertising networks, with no clear way to opt out while keeping core app features working.
- Data sent between the app and remote servers travels with less protection than expected, meaning user data may not be fully protected on public Wi-Fi.
- Controls for managing what is collected and shared are minimal, giving users little practical say over their personal information.
About This Analysis
This scorecard is generated from automated static analysis of the app binary. Scores reflect the security and privacy practices observed in the code at the time of the scan.
App Details
| Field | Value |
|---|---|
| App Name | onTracker |
| Package ID | co.ontracker.app.manager |
| Version | 3.2 |
| Developer | - |
| Scan Date | 2026-02-04 |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 40/100 |