# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Fly Delta ## What This Means for You The build stores a biometric password without encryption in its local database, and the app manifest contains no backup exclusion rules, leaving this database available through Android's standard backup feature; the code also initializes Quantum Metric session replay capability before a confirmed user consent record is established, though runtime behavior was not observed. ## Recommendation: Solid CITT rates Fly Delta 72/100 (Solid). The build earns strong marks for network security and applies hardware-protected encryption to authentication session keys and login passwords. Passport and barcode scanning are handled entirely on-device. Two areas weigh on the score: the database storing biometric passwords and user data does not apply encryption, and the build initializes Quantum Metric session replay without a confirmed consent gate, though capture at runtime was not verified. **Best For:** Frequent Delta flyers who book trips, manage SkyMiles upgrades, and check in through the app. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 1 finding (1 high) **Network Security:** 0 findings **Code Safety:** 4 findings (3 medium, 1 low) **Privacy:** 2 findings (2 medium) ## Privacy Concerns ### What Leaves the Device - SkyMiles loyalty number: the binary includes code for routing this to Adobe Experience Platform as a persistent cross-device identity anchor in AUTHENTICATED state, used by Adobe Analytics, Target, and Optimize - Quantum Metric session identifier: the binary includes code that places this identifier in payment API request headers, linking session replay records to specific financial transactions on Delta's booking servers - Usage and behavioral data: may be sent to Firebase Analytics and Adobe Analytics for measurement and optimization, based on linked SDK code - Location data: may be sent to Radar SDK for location-based features, based on linked SDK code ### What Stays on the Device - Passport images and barcode data: read and processed on-device by Google ML Kit; no off-device flow for this data was identified in this analysis - Trip itinerary and calendar data: stored on the device; no off-device flow for this data was identified in this analysis ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Adobe Analytics / Adobe Experience Platform - behavioral analytics and cross-device personalization using the SkyMiles loyalty number as a persistent identity - Firebase Analytics - usage analytics and measurement - Firebase Crashlytics - crash and stability reporting - Quantum Metric - session replay and user experience analytics; the session identifier is linked to payment transaction records in API request headers - Dynatrace - application performance monitoring - Radar SDK - location services - OneTrust - consent management - Google AdServices (Privacy Sandbox) - advertising attribution - Qualtrics - in-app surveys and user feedback ## Understanding the Scores **Security:** 75/100 **Privacy:** 70/100 ### Security Breakdown - **Data Security:** 62/100. The build applies hardware-protected encryption to authentication session keys and login passwords. The local database storing biometric passwords and user data does not apply full database encryption, and the manifest configuration leaves this data included in Android's backup feature. - **Network Security:** 100/100. Network connections are configured to use HTTPS, and invalid server certificates are rejected across in-app browser sessions. - **Code Safety:** 81/100. The build handles most sensitive operations securely. Test payment card data is compiled into the release binary, a deprecated JavaScript bridge contains code that could make session data available to JavaScript in specific scenarios, and a developer tooling component is present in the production manifest. ### Privacy Breakdown - **Data Collection:** 64/100. The build links multiple analytics and personalization SDKs. The SkyMiles loyalty number is used as a persistent cross-device identity anchor in Adobe's platform, and usage analytics appear to initialize at app startup. - **Data Sharing:** 66/100. Data may reach Adobe Analytics, Firebase Analytics, Quantum Metric, and other analytics, session replay, and advertising services. The Quantum Metric session identifier appears in payment API request headers, linking session records to financial transactions. - **User Control:** 74/100. The build integrates OneTrust for consent management. The Play Store Data Safety section discloses that data deletion can be requested. ## Positive Security Features - Authentication session keys and login permissions are protected by Android's hardware security module; the underlying key material does not leave the secure hardware - Login passwords are encrypted before being written to the database - Network traffic is configured to use HTTPS, and invalid server certificates are rejected across in-app browser sessions - Passport scanning and barcode reading are handled on-device; no off-device flow for scanned image data was identified in this analysis - Trip itinerary and calendar data was not observed being sent to analytics platforms ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **SkyMiles number as behavioral analytics identity anchor** The Google Play Data Safety label (retrieved 2026-08-11) states the app "may share" personal info and financial info with third parties. The binary contains code for routing the SkyMiles loyalty number to Adobe Experience Platform in AUTHENTICATED state as the primary persistent cross-device identity anchor for Adobe Analytics, Target, and Optimize. The specific use of the loyalty account number as a persistent behavioral profiling identifier is not separately disclosed in the published label. Readers can compare against Delta's privacy policy linked from the Play Store listing. 2. **Session replay capability** The binary links the Quantum Metric SDK, which provides session replay capability. The Play Store Data Safety label does not specifically identify session replay as a data type or collection mechanism. Whether session replay captures data at runtime, or is gated by user consent, was not determined in this static analysis. ### Security Enhancements 1. **Encrypt sensitive database fields** The database that stores biometric passwords and user data could be strengthened by applying encryption to sensitive fields or enabling full database encryption, so stored data is not retained without protection. 2. **Add Android backup exclusion rules** Adding backup exclusion rules to the app manifest would prevent the sensitive database and preferences files from being included in Android backup operations. Industry guidance recommends explicitly excluding sensitive data from backup where possible. 3. **Remove deprecated session data bridge** The build contains a deprecated JavaScript bridge capable of making session data available to the JavaScript engine. Completing its removal would eliminate this residual code path. 4. **Remove test payment data from production build** Test payment card data compiled into the release binary reveals payment form field names and processing paths. Removing these fixtures before production release is standard practice. ## Technical Context **App Type:** Travel and loyalty (financial, identity, and location data) **Classes Analyzed:** 2,400 **Third-Party Services:** 29 **Context Tags:** financial, travel, sensitive_data, location, camera --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Delta Air Lines, Inc. **Version:** 7.14 (versionCode 24428) **Analysis Date:** 2026-08-12 **Package:** com.delta.mobile.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 7.14 analyzed on 2026-08-12 - May not reflect server-side security controls - Cannot detect all runtime behaviors