# Security & Privacy Scorecard

## PRESTO

## What This Means for You

In-app behavior is tracked by Firebase and shared with Facebook, connecting transit and payment habits to advertising networks. Payment information is processed by a third-party gateway. Data sent between the app and its servers travels with less protection than expected, which could affect account or card details.

## Recommendation: Use With Caution

**Best For:** Daily commuters comfortable with analytics tracking
**Avoid If:** Users who prefer Facebook not linked to their transit use

## Key Findings

**Data Security** - 4 findings (2 critical, 2 medium)

**Network Security** - 2 findings (1 critical, 1 medium)

**Code Safety** - 0 findings

**Privacy** - 4 findings (2 high, 2 medium)

## Privacy Concerns

### What Data is Collected

PRESTO collects transit usage patterns, payment card details, and in-app behavioral data. Account activity, including travel history and payment records, is retained to support app functionality and analytics reporting.

### Third-Party Data Sharing

Behavioral and usage data is shared with the following third-party services:

- **Firebase Analytics** - behavioral tracking and usage analytics
- **Firebase Crashlytics** - crash and performance reporting
- **Facebook SDK** - advertising and behavioral profiling
- **Microsoft MSAL (Azure AD B2C)** - identity and authentication services
- **Moneris Payment Gateway** - payment processing
- **Azure Notification Hub** - push notification delivery

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 45/100 |
| Data Security | 40/100 |
| Network Security | 30/100 |
| Code Safety | 35/100 |
| Data Collection | 50/100 |
| Data Sharing | 45/100 |
| User Control | 40/100 |

## Positive Security Features

- No notable positive security features were identified in this version of the app.

## Areas for Improvement

- Data in transit is not adequately protected, meaning account details or payment card information may not be fully protected during use.
- The app shares behavioral data with Facebook, giving an advertising network access to transit and payment habits with limited controls available to users.
- The scope of data collected and retained goes beyond what is needed for a transit payment service, limiting users' ability to manage their personal information.

---

## About This Analysis

### App Details

| Field | Value |
|---|---|
| App | PRESTO |
| Package | com.metrolinx.presto.android.consumerapp |
| Version | 2.1.24 |
| Scan Date | 2026-01-31 |
| Platform | Android |