Vay - rent a car nearby Security & Privacy Scorecard

by Vay Technology · iOS

76
Overall trust score
Acceptable
84
Security
72
Privacy

Usage and event data is shared with AppsFlyer and Amplitude for analytics and attribution. Identity verification is handled by Onfido, a third-party service. Payment processing goes through Stripe and Afterpay. Location mapping uses Mapbox.

Best for

Drivers comfortable with analytics and ID verification

Findings

  • 0 critical
  • 1 high
  • 9 medium
  • 5 low
  • 4 info

1 issue identified across security and privacy analysis.

Top security issues

  • Deprecated kSecAttrAccessibleAlways allows Keychain items to be read from locked or never-unlocked devices, exposing session tokens to forensic extraction
  • Staging Auth0 credentials, backend URLs, and Stripe test key embedded in production binary expose staging infrastructure to targeted attacks
  • App state including location data and vehicle identifiers persisted unencrypted in MMKV, extractable from jailbroken devices or backup extractions

Top privacy issues

  • App privacy manifest falsely declares zero data collection despite collecting biometrics, precise location, payment info, and device identifiers via first-party code and 30+ SDKs
  • AppsFlyer transmits device identifiers to attribution servers before ATT consent timer expires, potentially collecting data from users who subsequently deny tracking
  • Mapbox SDK transmits user precise location to Mapbox infrastructure for Mapbox's own analytics purposes — highly sensitive in a ride-hailing context

Full analysis

Vay

What This Means for You

Your precise location, biometric identity scans, and payment details are shared with multiple third-party companies, while the app's App Store privacy label falsely declares it collects no data at all.

Recommendation: Use With Caution

The app's App Store privacy disclosure incorrectly states it collects no data, despite gathering precise location, biometric identity information, and payment details through first-party code and more than ten embedded third-party services. Additional concerns include ride history and location data stored without encryption on the device, and internal staging configuration left inside the production app. Riders comfortable with standard ride-hailing data practices can use the app, but should be aware the App Store privacy label does not accurately reflect what is collected.

Best For: Vay riders comfortable with location sharing and standard ride-hailing data practices who prioritize convenience over strict privacy controls

Key Findings

Data Security - 7 findings (5 medium, 1 low, 1 info)

Network Security - 2 findings (2 low)

Code Safety - 3 findings (1 medium, 2 info)

Privacy - 7 findings (1 high, 3 medium, 2 low, 1 info)

Privacy Concerns

What Data is Collected

  • Personal information: name, government-issued ID, biometric identity data
  • Location data: precise and coarse location
  • Payment information: linked payment methods processed via Stripe and Afterpay/Clearpay
  • Device information: device identifiers, operating system version, language, timezone, carrier
  • Usage data: app interactions, ride history, behavioral events, feature usage

Third-Party Data Sharing

The following third parties may receive your data:

  • Mapbox - map rendering and Mapbox's own location analytics (including your precise location)
  • Onfido - biometric identity verification and government ID scanning
  • AppsFlyer - install attribution and conversion tracking
  • Amplitude - behavioral analytics and feature experimentation
  • Firebase - push notifications only (analytics explicitly disabled)
  • Sentry - crash and error reporting
  • Stripe - payment processing
  • Auth0 - user authentication
  • hCaptcha - bot and fraud protection
  • Afterpay/Clearpay - buy now pay later payment processing

Understanding the Scores

Security: 84/100
Privacy: 72/100

Security Breakdown

  • Data Security: 76/100 - Sensitive app state stored without encryption on the device; internal staging configuration embedded in the production release
  • Network Security: 94/100 - Strong authentication protocols in place with minor link-handling gaps
  • Code Safety: 94/100 - Strong isolation of sensitive native bridges; development tooling left in production bundle

Privacy Breakdown

  • Data Collection: 73/100 - Collects sensitive location, biometric, and payment data; App Store privacy disclosure does not reflect actual collection
  • Data Sharing: 82/100 - Data shared with multiple third parties; some sharing extends beyond core app functionality to third-party analytics
  • User Control: 78/100 - Tracking consent prompt is present, but a timer mechanism may allow device-level data to be sent before you respond to the prompt

Positive Security Features

  • Firebase Analytics comprehensively disabled across multiple configuration keys, with Firebase retained only for push notifications, reflecting deliberate privacy engineering
  • Sensitive native code bridges for authentication and payments are isolated from web content displayed within the app and cannot be accessed by that content
  • The sign-in flow uses strong modern authentication protections that guard your account against interception during login

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. Accurate App Store Privacy Disclosure
    Update the app's privacy manifest to accurately reflect all data types collected on behalf of first-party code and embedded third-party frameworks, so users see correct information before installing.

  2. Consent-First Data Transmission
    Ensure no device identifiers or behavioral data are transmitted to third-party analytics or attribution services before the user has actively responded to the tracking consent prompt, rather than relying on a timer that fires regardless of user choice.

  3. Clearer Permission Descriptions
    Provide specific, plain-language descriptions for location and tracking permission prompts that explain exactly what data is used for, why the more permissive background access level is needed, and which companies receive the data.

Security Enhancements

  1. Remove Internal Configuration from Production Builds
    Build processes should exclude internal staging environment settings and test payment configuration from App Store releases to prevent exposure of internal infrastructure details.

  2. Encrypt Local App Storage
    Sensitive app state stored on the device, including ride context, vehicle identifiers, and cached location data, should use iOS data protection so it cannot be read from a locked or compromised device.

  3. Remove Development Tooling from Production Bundle
    UI development frameworks included in the production app should be excluded from App Store builds, reducing the app's surface area on modified devices.

Technical Context

App Type: Ride-hailing transportation service handling sensitive location, biometric, and payment data
Classes Analyzed: iOS binary and JavaScript bundle (Hermes bytecode)
Third-Party Services: 10 third-party services identified
Context Tags: financial, location, sensitive_data, transportation

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Vay
Version: 1.20.1 (build 235)
Analysis Date: 2026-04-14
Package: io.vay.rider

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on IPA version 1.20.1 (build 235) analyzed on 2026-04-14
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors

Versions & scan history

ScanDateOverall score
#3 (current) 76/100