CITT

    Scan results

    NS

    Android

    The NS app is the official planning application for the Dutch Railways. It offers realtime journey planning, station timetables, travel disruptions, station information, and delay notifications. Features include location-based nearby station discovery and integration with Google Maps for navigation.

    CITT SCORE
    72
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Daily train travelers comfortable with analytics

    What It Means For You

    Usage patterns and behavior are tracked by multiple analytics platforms, including Amplitude and Snowplow, and data flows into a customer data platform for personalization. A consent tool is present, giving users some control over what is collected. Crash and error data is shared with Firebase and Datadog.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (12)

    Data Security

    3 total
    1 High
    1 Medium
    1 Low

    Network Security

    2 total
    2 Low

    Code Security

    3 total
    2 Medium
    1 Low

    Privacy

    3 total
    2 Medium
    1 Low

    Third-Party Risk

    1 total
    1 Low

    Third-Party Services

    Datadog RUM, Snowplow Analytics, Amplitude Experiment, Amplitude Analytics, Avo Inspector, Qualtrics Digital, BlueConic CDP, OneTrust CMP, Firebase Crashlytics, Firebase Messaging, Firebase Remote Config, Google Maps, OkHttp, Retrofit, Picasso

    Security Strengths

    • ✓All API endpoints use HTTPS with cleartext traffic disabled
    • ✓Comprehensive OneTrust consent management with SDK-level controls
    • ✓User anonymization in Snowplow when consent not granted
    • ✓Hashed user identifiers (email, NSR ID) instead of plaintext
    • ✓Firebase Analytics explicitly disabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    transportation
    location
    financial
    sensitive data
    travel
    authentication

    Package

    nl.ns.android.activity

    Version

    8.39.2 (build 32607)

    Analysis Date

    Mar 4, 2026

    Classes Analyzed

    38,650

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Acceptable

    Key Findings

    Data Security - 8 findings (1 high, 1 medium, 1 low, 5 info)

    Network Security - 2 findings (2 low)

    Code Safety - 0 findings

    Privacy - 3 findings (2 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    The app collects data about how users interact with it, including which screens are visited, features tapped, and journey patterns. Device identifiers, crash reports, and performance metrics are also collected. Location and payment data may be gathered when journey planning or ticketing features are used.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Amplitude Analytics and Amplitude Experiment - behavioral analytics and feature testing
    • Snowplow Analytics - event tracking and behavioral data
    • BlueConic - customer data platform used to personalize the user experience
    • OneTrust - consent management, giving users control over some data sharing choices
    • Datadog - performance monitoring and error reporting
    • Firebase Crashlytics, Firebase Messaging, Firebase Remote Config (Google) - crash reporting, push notifications, and app configuration
    • Qualtrics Digital - in-app surveys and customer feedback
    • Google Maps - mapping and navigation
    • Avo Inspector - analytics data quality tracking

    Understanding the Scores

    CategoryScore
    Security71/100
    Privacy74/100
    Data Security52/100
    Network Security95/100
    Code Safety86/100
    Data Collection92/100
    Data Sharing97/100
    User Control92/100

    Positive Security Features

    No standout positive security practices were identified in this version of the app.

    Areas for Improvement

    • Stronger local data protection: Some data stored on the device could benefit from additional safeguards if the device is accessed without authorization.
    • Clearer analytics disclosure: The app works with a large number of analytics and tracking services. More transparent in-app explanations would help users understand what is collected and why.
    • Tighter network configurations: A small number of network connections use settings that could be made more restrictive to reduce potential exposure.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. It reflects practices observed in the version listed below.

    App Details

    • App Name: NS
    • Package ID: nl.ns.android.activity
    • Version: 8.39.2 (build 32607)
    • Developer: NS
    • Scan Date: 2026-03-04
    • Platform: Android

    Right of Reply

    Developer not yet contacted