CITT

    Scan results

    onTracker

    Android

    onTracker is a vehicle tracking and fleet management app that enables real-time GPS monitoring, remote vehicle control, geofencing, and alerts. Also supports tracking pets and bicycles.

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Package tracking with Google analytics in the mix

    Not For: You prefer not sharing location data with ad networks

    What It Means For You

    Location and usage activity is collected and shared with Google Ads and Firebase Analytics. Data control options are limited, with few settings to restrict what gets shared. Ad targeting based on user behavior is enabled by default.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (13)

    Data Security

    3 total
    1 Critical
    1 High
    1 Medium

    Network Security

    1 total
    1 Critical

    Code Security

    4 total
    1 High
    3 Medium

    Privacy

    3 total
    2 Critical
    1 High

    Third-Party Risk

    2 total
    1 High
    1 Medium

    Third-Party Services

    Firebase Analytics, Firebase Cloud Messaging, Google Ads, Google Maps, Google Play Services Location, Google App Set ID, Embarcadero FireMonkey Framework

    Security Strengths

    • ✓Debuggable flag disabled in release build
    • ✓Target SDK set to Android 15 (latest)
    • ✓Firebase API key properly scoped (security via Firebase Rules)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    location
    vehicle tracking
    sensitive data
    ads
    maps
    remote control
    oauth

    Package

    co.ontracker.app.manager

    Version

    3.2

    Analysis Date

    Feb 4, 2026

    Classes Analyzed

    9,367

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (1 critical, 1 high, 1 medium)

    Network Security - 1 finding (1 critical)

    Code Safety - 0 findings

    Privacy - 3 findings (2 critical, 1 high)

    Privacy Concerns

    What Data is Collected

    The app collects precise location through Google Play Services Location. Firebase Analytics records how the app is used, and Google App Set ID assigns a cross-app identifier to the device that connects activity across multiple applications.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Firebase Analytics - Usage and behavioral analytics
    • Firebase Cloud Messaging - Push notification delivery
    • Google Ads - Behavioral advertising targeting
    • Google Maps - Location and mapping features
    • Google Play Services Location - Precise location tracking
    • Google App Set ID - Cross-app device identifier
    • Embarcadero FireMonkey Framework - App development framework

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy35/100
    Data Security40/100
    Network Security30/100
    Code Safety55/100
    Data Collection25/100
    Data Sharing30/100
    User Control20/100

    Positive Security Features

    • None identified in this version of the app.

    Areas for Improvement

    • Location data is shared with advertising networks, with no clear way to opt out while keeping core app features working.
    • Data sent between the app and remote servers travels with less protection than expected, meaning user data may not be fully protected on public Wi-Fi.
    • Controls for managing what is collected and shared are minimal, giving users little practical say over their personal information.

    About This Analysis

    This scorecard is generated from automated static analysis of the app binary. Scores reflect the security and privacy practices observed in the code at the time of the scan.

    App Details

    FieldValue
    App NameonTracker
    Package IDco.ontracker.app.manager
    Version3.2
    Developer-
    Scan Date2026-02-04

    Right of Reply

    Developer not yet contacted