CITT

    Scan results

    eBike Flow

    Android

    eBike Flow is the official app for Bosch smart eBike systems, offering theft protection with eBike Lock/Alarm, GPS-enabled navigation, route planning with Komoot/Strava integration, activity tracking, and customizable riding modes. Requires compatible Bosch eBike hardware.

    CITT SCORE
    100
    out of 100
    TRUSTED

    Quick Verdict

    Best for: eBike riders comfortable with standard analytics

    What It Means For You

    Ride data and app usage are shared with Firebase Analytics, Firebase Crashlytics, and Adjust for performance monitoring and install attribution. Mapbox powers the maps, and Google Play Billing handles any in-app purchases. User data flows to these services during normal use.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (4)

    Data Security

    1 total
    1 Low

    Code Security

    3 total
    1 Medium
    1 Low
    1 Info

    Third-Party Services

    Mapbox Maps SDK, Firebase Performance, Firebase Core, Firebase Messaging, Firebase Crashlytics, Firebase Analytics, Firebase Remote Config, Adjust SDK, Google Play Billing, OkHttp, Retrofit, Room, WorkManager, Koin, AppAuth (OpenID), Gson

    Security Strengths

    • ✓Certificate Transparency verification for Bosch domains
    • ✓Encrypted authentication token storage with AES-256-GCM and Android KeyStore
    • ✓Encrypted bike lock credentials with Android KeyStore
    • ✓Consent-gated analytics with explicit user control
    • ✓Pseudonymized user identifiers (pseudoUserId, pseudoBikeId)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    location
    fitness
    navigation
    iot
    bluetooth
    payment

    Package

    com.bosch.ebike.onebikeapp

    Version

    1.31.5 (1118)

    Analysis Date

    Mar 5, 2026

    Classes Analyzed

    26,157

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Very Secure

    Key Findings

    Data Security - 3 findings (1 low, 2 info)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 0 findings

    Privacy Concerns

    What Data is Collected

    eBike Flow collects ride activity, app usage patterns, and device diagnostics. Performance data and crash reports are sent to Firebase, and Adjust receives install and attribution information to track how the app was discovered.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Firebase Analytics - App usage and behavioral tracking
    • Firebase Crashlytics - Crash and stability reporting
    • Firebase Performance - App performance monitoring
    • Adjust SDK - Install attribution and marketing analytics
    • Mapbox - Map rendering and navigation
    • Google Play Billing - In-app purchase handling

    Understanding the Scores

    CategoryScore
    Security99/100
    Privacy100/100
    Data Security100/100
    Network Security100/100
    Code Safety99/100
    Data Collection100/100
    Data Sharing100/100
    User Control100/100

    Positive Security Features

    • Authentication is handled via AppAuth, an industry-standard OpenID Connect library
    • Network communications use modern, well-maintained libraries (OkHttp and Retrofit)
    • Local data is managed with Room, Android's recommended structured database layer
    • Data collection is scoped to app functionality and standard crash reporting

    Areas for Improvement

    • Some internal data storage configurations could be refined to further limit what is retained on the device.
    • A small number of informational observations were noted around how app data is organized internally, with no direct impact to user privacy or security.
    • One minor code safety item was identified that has no effect on everyday use.

    About This Analysis

    This scorecard is produced by automated static analysis of the app's compiled code and configuration files. Scores reflect the security and privacy practices observed in this version of the app.

    App Details

    • App Name: eBike Flow
    • Package ID: com.bosch.ebike.onebikeapp
    • Version: 1.31.5 (1118)
    • Scan Date: March 5, 2026
    • Platform: canITrustThat

    Right of Reply

    Developer not yet contacted