# Security & Privacy Scorecard

## eBike Flow

**Version:** 1.31.5 (1118)
**Scan Date:** March 5, 2026

**Overall Security Score: 99/100** | **Privacy Score: 100/100**

## What This Means for You

Ride data and app usage are shared with Firebase Analytics, Firebase Crashlytics, and Adjust for performance monitoring and install attribution. Mapbox powers the maps, and Google Play Billing handles any in-app purchases. User data flows to these services during normal use.

## Recommendation: Very Secure

**Best For:** eBike riders comfortable with standard analytics

## Key Findings

**Data Security** - 3 findings (1 low, 2 info)

**Network Security** - 0 findings

**Code Safety** - 0 findings

**Privacy** - 0 findings

## Privacy Concerns

### What Data is Collected

eBike Flow collects ride activity, app usage patterns, and device diagnostics. Performance data and crash reports are sent to Firebase, and Adjust receives install and attribution information to track how the app was discovered.

### Third-Party Data Sharing

User data is shared with the following third-party services:

- **Firebase Analytics** - App usage and behavioral tracking
- **Firebase Crashlytics** - Crash and stability reporting
- **Firebase Performance** - App performance monitoring
- **Adjust SDK** - Install attribution and marketing analytics
- **Mapbox** - Map rendering and navigation
- **Google Play Billing** - In-app purchase handling

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 99/100 |
| Privacy | 100/100 |
| Data Security | 100/100 |
| Network Security | 100/100 |
| Code Safety | 99/100 |
| Data Collection | 100/100 |
| Data Sharing | 100/100 |
| User Control | 100/100 |

## Positive Security Features

- Authentication is handled via AppAuth, an industry-standard OpenID Connect library
- Network communications use modern, well-maintained libraries (OkHttp and Retrofit)
- Local data is managed with Room, Android's recommended structured database layer
- Data collection is scoped to app functionality and standard crash reporting

## Areas for Improvement

- Some internal data storage configurations could be refined to further limit what is retained on the device.
- A small number of informational observations were noted around how app data is organized internally, with no direct impact to user privacy or security.
- One minor code safety item was identified that has no effect on everyday use.

---

## About This Analysis

This scorecard is produced by automated static analysis of the app's compiled code and configuration files. Scores reflect the security and privacy practices observed in this version of the app.

### App Details

- **App Name:** eBike Flow
- **Package ID:** com.bosch.ebike.onebikeapp
- **Version:** 1.31.5 (1118)
- **Scan Date:** March 5, 2026
- **Platform:** canITrustThat