# Security & Privacy Scorecard

## onTracker

**co.ontracker.app.manager** | Version 3.2 | Scanned 2026-02-04

## What This Means for You

Location and usage activity is collected and shared with Google Ads and Firebase Analytics. Data control options are limited, with few settings to restrict what gets shared. Ad targeting based on user behavior is enabled by default.

## Recommendation: Use With Caution

**Best For:** Package tracking with Google analytics in the mix
**Avoid If:** You prefer not sharing location data with ad networks

## Key Findings

**Data Security** - 3 findings (1 critical, 1 high, 1 medium)

**Network Security** - 1 finding (1 critical)

**Code Safety** - 0 findings

**Privacy** - 3 findings (2 critical, 1 high)

## Privacy Concerns

### What Data is Collected

The app collects precise location through Google Play Services Location. Firebase Analytics records how the app is used, and Google App Set ID assigns a cross-app identifier to the device that connects activity across multiple applications.

### Third-Party Data Sharing

User data is shared with the following third-party services:

- **Firebase Analytics** - Usage and behavioral analytics
- **Firebase Cloud Messaging** - Push notification delivery
- **Google Ads** - Behavioral advertising targeting
- **Google Maps** - Location and mapping features
- **Google Play Services Location** - Precise location tracking
- **Google App Set ID** - Cross-app device identifier
- **Embarcadero FireMonkey Framework** - App development framework

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 35/100 |
| Data Security | 40/100 |
| Network Security | 30/100 |
| Code Safety | 55/100 |
| Data Collection | 25/100 |
| Data Sharing | 30/100 |
| User Control | 20/100 |

## Positive Security Features

- None identified in this version of the app.

## Areas for Improvement

- Location data is shared with advertising networks, with no clear way to opt out while keeping core app features working.
- Data sent between the app and remote servers travels with less protection than expected, meaning user data may not be fully protected on public Wi-Fi.
- Controls for managing what is collected and shared are minimal, giving users little practical say over their personal information.

---

## About This Analysis

This scorecard is generated from automated static analysis of the app binary. Scores reflect the security and privacy practices observed in the code at the time of the scan.

### App Details

| Field | Value |
|---|---|
| App Name | onTracker |
| Package ID | co.ontracker.app.manager |
| Version | 3.2 |
| Developer | - |
| Scan Date | 2026-02-04 |