CITT

    Scan results

    AT Mobile: Find your way

    Android

    AT Mobile makes it easy to move around Auckland with journey planning across AT Metro bus, train and ferry services. Features real-time departures, disruption alerts, and AT HOP card management. Over 250,000 users rely on this app for local transit.

    CITT SCORE
    38
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Auckland commuters comfortable with location tracking

    Not For: You prefer not sharing your location with third parties

    What It Means For You

    Precise location is tracked continuously in the background and shared with third-party services, including analytics and mapping providers. Usage patterns and survey responses may be collected by Firebase and Qualtrics. Users have limited control over how their data is used or deleted.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (26)

    Data Security

    3 total
    1 Critical
    2 High

    Network Security

    4 total
    1 Critical
    1 High
    2 Medium

    Code Security

    8 total
    1 Critical
    4 High
    3 Medium

    Privacy

    7 total
    1 Critical
    4 High
    1 Medium
    1 Low

    Third-Party Risk

    2 total
    1 Medium
    1 Low

    Permission Usage

    2 total
    2 Medium

    Third-Party Services

    Firebase Analytics, Firebase Messaging, Firebase Remote Config, Firebase Performance, Mapbox Maps, Mapbox Telemetry, TransistorSoft Background Geolocation, Qualtrics Surveys, Huawei Mobile Services

    Security Strengths

    • ✓No WebView attack surface (external browser only)
    • ✓OAuth via system browser (prevents phishing)
    • ✓Hermes JavaScript engine enabled
    • ✓Debuggable flag disabled in production
    • ✓HTTPS for 93.75% of URLs
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    government
    transit
    location
    background location
    financial
    payment cards
    analytics
    ads
    tracking
    sensitive data

    Package

    nz.govt.at.atmobile

    Version

    1.41.1

    Analysis Date

    Feb 7, 2026

    Classes Analyzed

    15,047

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (1 critical, 2 high)

    Network Security - 4 findings (1 critical, 1 high, 2 medium)

    Code Safety - 0 findings

    Privacy - 7 findings (1 critical, 4 high, 1 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    • Precise location (continuous background tracking)
    • App usage patterns and behavioral data
    • Survey responses and in-app feedback (via Qualtrics)
    • Device identifiers and app performance metrics

    Third-Party Data Sharing

    User location, usage, and device data are shared with the following third-party services:

    • Firebase Analytics - usage and behavioral data
    • Firebase Messaging - push notification delivery
    • Firebase Remote Config - app configuration data
    • Firebase Performance - app performance metrics
    • Mapbox Maps - location and mapping interactions
    • Mapbox Telemetry - location telemetry data
    • TransistorSoft Background Geolocation - continuous background location tracking
    • Qualtrics Surveys - survey responses and user feedback
    • Huawei Mobile Services - device services on Huawei devices

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy40/100
    Data Security25/100
    Network Security45/100
    Code Safety55/100
    Data Collection45/100
    Data Sharing60/100
    User Control30/100

    Positive Security Features

    The app integrates established third-party platforms, including Firebase and Mapbox, which maintain their own published security standards. No additional app-level security enhancements were identified in this version.

    Areas for Improvement

    • User location is tracked in the background at all times. The app should offer clear consent controls and the ability to limit background tracking without losing access to core journey-planning features.
    • User rights to access or delete personal data are not surfaced within the app. A clear, in-app path to request data removal would give users meaningful control over what is stored about them.
    • Data sent between the app and external services travels with less protection than expected, which may affect users on public or shared networks.

    About This Analysis

    Scores are generated by automated static analysis of the app's compiled code and configuration files. They reflect the state of the app at the time of the scan and may not capture server-side practices or runtime behavior.

    App Details

    • App: AT Mobile: Find your way
    • Package ID: nz.govt.at.atmobile
    • Version: 1.41.1
    • Scan Date: 2026-02-07

    Right of Reply

    Developer not yet contacted