CITT

    Scan results

    TrackWay - Outdoor Navigation

    Android

    TrackWay is an outdoor navigation app for following GPX tracks and recording new ones with live sharing to Strava. Supports Bluetooth and ANT+ sensors for speed, cadence, power, and heartrate metrics with optimized battery usage.

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Casual hiking and trail tracking outdoors

    Not For: Storing sensitive personal location history

    What It Means For You

    Saved routes and location history may not be adequately protected on the device, as the app has a critical issue in how it stores data locally. Ads are served through Google, meaning in-app activity contributes to ad targeting. Data is not forwarded to outside parties beyond Firebase and Google services.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (11)

    Data Security

    4 total
    1 Critical
    2 Medium
    1 Info

    Network Security

    1 total
    1 High

    Code Security

    2 total
    1 High
    1 Low

    Privacy

    4 total
    3 Medium
    1 Low

    Third-Party Services

    Firebase Core, Firebase Auth, Firebase Firestore, Firebase Functions, Firebase Analytics, Google Maps SDK, Google Mobile Ads, Strava API, OkHttp, ANT+ Plugin Library, PairIP License Check

    Security Strengths

    • ✓All network traffic uses HTTPS
    • ✓Firebase Cloud Functions used for secure API proxying
    • ✓No SQL injection risk (no SQLite database)
    • ✓Exported components serve legitimate purposes with proper validation
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    fitness
    location
    sensitive data
    health
    social

    Package

    nl.dibarto.trackway

    Version

    1.3 (build 95)

    Analysis Date

    Mar 25, 2026

    Classes Analyzed

    12,184

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (1 critical, 2 medium, 1 info)

    Network Security - 1 finding (1 high)

    Code Safety - 0 findings

    Privacy - 4 findings (3 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    The app collects GPS location and route data as part of its navigation features. Firebase Analytics captures in-app usage patterns. Connecting a Strava account allows activity data to flow between the two services.

    Third-Party Data Sharing

    Usage data is processed by Google and Firebase services, covering analytics and advertising. Google Mobile Ads uses in-app behavior to serve targeted advertisements. No data is shared with outside parties beyond Firebase and Google services.

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy52/100
    Data Security30/100
    Network Security78/100
    Code Safety88/100
    Data Collection82/100
    Data Sharing100/100
    User Control87/100

    Positive Security Features

    • This version of the app did not demonstrate notable security hardening practices in the areas reviewed.

    Areas for Improvement

    • Local storage of route data and location history needs stronger protections to prevent other apps or unauthorized parties from reading it off the device.
    • Advertising through Google means in-app behavior contributes to ad targeting. Removing or limiting ad services would reduce the data collected about user activity.
    • The Strava integration should offer clearer controls so users can decide exactly which activity data is shared between the two services.

    About This Analysis

    This scorecard is generated from automated analysis of the app and reflects security and privacy practices observed in the code. It does not require installing the app on a device.

    App Details

    • App: TrackWay - Outdoor Navigation
    • Package: nl.dibarto.trackway
    • Version: 1.3 (build 95)
    • Scan Date: 2026-03-25
    • Platform: Android

    Right of Reply

    Developer not yet contacted