calimoto — Motorcycle GPS Security & Privacy Scorecard
Android
Location, usage habits, and in-app activity are shared with multiple analytics and marketing platforms including Facebook, AppsFlyer, CleverTap, and Mixpanel. Ride data helps target ads and personalize campaigns across services. Data sharing is broad but typical for navigation apps in this category.
Best for
Motorcycle riders comfortable with standard analytics
Findings
- 0 critical
- 6 high
- 7 medium
- 4 low
- 4 info
1 issue identified across security and privacy analysis.
Top security issues
- Unencrypted Facebook OAuth Access Tokens
- Unencrypted Firebase Authentication Tokens
- Hardcoded Backend API Credential
Top privacy issues
- Pre-Consent Analytics Initialization (GDPR Violation)
- Firebase Analytics Consent Defaults to TRUE
- Room Database Without Encryption
Full analysis
calimoto - Motorcycle GPS
What This Means for You
Location, usage habits, and in-app activity are shared with multiple analytics and marketing platforms including Facebook, AppsFlyer, CleverTap, and Mixpanel. Ride data helps target ads and personalize campaigns across services. Data sharing is broad but typical for navigation apps in this category.
Recommendation: Acceptable
Best For: Motorcycle riders comfortable with standard analytics
Key Findings
Data Security - 7 findings (2 high, 3 medium, 2 info)
Network Security - 3 findings (1 high, 1 medium, 1 low)
Code Safety - 0 findings
Privacy - 2 findings (2 high)
Privacy Concerns
What Data is Collected
calimoto collects precise GPS location to power route planning and ride tracking. Usage patterns, in-app behavior, and device identifiers are gathered to personalize the user experience and measure feature engagement. Ride history and preferences are stored to support the core navigation service.
Third-Party Data Sharing
User data is shared with the following third-party platforms:
- Facebook SDK - behavioral and advertising data for ad targeting
- AppsFlyer - marketing attribution and install tracking
- CleverTap - behavioral analytics and marketing automation
- Mixpanel - in-app event tracking and analytics
- Firebase Suite - analytics, messaging, and crash reporting
- Branch.io - app linking and marketing attribution
- Mapbox Maps SDK - map rendering with location data processing
- Sentry/Crashlytics - crash and error reporting
Understanding the Scores
| Category | Score |
|---|---|
| Security | 73/100 |
| Privacy | 85/100 |
| Data Security | 76/100 |
| Network Security | 89/100 |
| Code Safety | 85/100 |
| Data Collection | 85/100 |
| Data Sharing | 92/100 |
| User Control | 86/100 |
Positive Security Features
- Crash reporting integration allows the developer to identify and respond to stability issues promptly
- Google Play Billing handles payment processing through Google's infrastructure, limiting direct handling of financial data
- Established, regularly maintained third-party SDKs from known providers are used throughout the app
Areas for Improvement
- Reduce the number of analytics and advertising platforms that receive location and behavioral data
- Strengthen local data protection so that ride history and personal information is better secured on the device
- Limit the scope of behavioral data shared with marketing platforms to what is needed for core functionality
About This Analysis
This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect observed security and privacy practices at the time of analysis.
App Details
- App: calimoto - Motorcycle GPS
- Package: com.calimoto.calimoto
- Version: 2026.02.5
- Platform: Android
- Scan Date: 2026-03-05
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 79/100 |