TT Festival App Secretly Tracks Attendees Across a 60km Radius
An investigation into the TT Festival App reveals passive background location tracking covering the entire North-East of the Netherlands, contradicting its own privacy policy.
When you install the official TT Festival App, you are prompted to grant it “Always Allow” background location permissions under the guise of “safety” and “emergency services.” However, a deep dive into the application’s code and network activity reveals a completely different reality: your background location is used for continuous, passive tracking across a 60-kilometer radius around Assen, and the data is quietly shipped to servers in the United States.
This repository serves as a public evidence log documenting these findings through static analysis of the decompiled Android app (v2.0.1) and empirical network captures.
The Key Findings
1. The Tracking Radius is Ridiculous (60 kilometers)
The app integrates a third-party location intelligence SDK called Crowd Connected. While one might assume tracking only happens on the festival grounds during the event, there is no date restriction in the code. Instead, the tracking is active whenever the server enables it, and the data collection boundary is set to a staggering 60 km radius around Assen.
If you live, work, or commute anywhere in the North-East of the Netherlands (including Groningen or Emmen) with background location enabled, your coordinates are eligible for upload. 👉 Read the Evidence on Geo-Zones
2. Violations of Their Own Privacy Policy
The official privacy statement makes promises that the app’s code simply does not keep:
- Data is shipped to the USA: The policy claims all personal data is stored within the European Union (with Cloudflare as the only exception). False. The Crowd Connected SDK streams your GPS positions, Bluetooth observations, and steps directly to AWS Kinesis Firehose in
us-east-1(N. Virginia, USA). - Data is not anonymous: The policy claims location data is shared “only in pseudonymized form” (UUID and push token). False. The app actively calls a
sendAliasfunction that links your location stream directly to your logged-in profile (login_user_id). 👉 Read the Full Privacy Policy Analysis
3. “Safety-Washing” to Get Your Data
The app nudges you to choose “Always Allow” for location access, claiming it will “improve your safety” and help the emergency team.
In reality, the genuine SOS / Emergency Button feature only needs foreground location when you actively press it. The only feature that consumes the background “Always Allow” permission is the Crowd Connected 60km passive tracking module, which only sends data one-way to AWS and provides absolutely no emergency functionality for the user. 👉 Read the breakdown of the “Safety” framing
Explore the Evidence
We have fully documented the inner workings of the app. All findings are derived from static analysis of the decompiled APK (v2.0.1) and local data captures:
- 🕵️ Crowd Connected Deep Dive: Full technical analysis of the location intelligence SDK, including hardcoded AWS credentials found in the app.
- 📱 Whole-fleet APK audit (140 apps): We pulled every Appmiral app installed on the phone (140 apps, 375 APKs) and scanned what each really embeds vs. what Appmiral advertises. The Crowd Connected tracking capability (AWS Cognito + Kinesis Firehose + Fused Location) ships in ~139/140 apps; 19 advertised partners appear in none. The live km-range + remote kill-switch was read across the fleet — TT Festival was ON at 60 km while others sat armed (40–80 km) but switched OFF by the server. Reproduce it from scratch.
- 📊 Trackers & SDK Audit: Proof that the app connects to Google and AWS before you ever see a consent screen, even while your phone is locked.
- ⚖️ Privacy Policy Inconsistencies: A line-by-line comparison of what they say versus what the code does.
- ❓ FAQ: When & Where does it track?: Plain-language answers explaining the tracking mechanisms.
- 🌐 Web & Email Evidence: How the municipality funnels the public to the app, and the emails where the organisation admits in writing the US data transfer — with timestamped, checksummed captures and full reproduction steps.
- 🔬 Methodology & Reproduction: Exactly how every finding was produced — prerequisites, techniques, and step-by-step commands so anyone can re-run the investigation.
Visualise Your Own Data
The app does not provide a way for you to see the location data they have collected about you. You must submit a GDPR Data Subject Access Request (DSAR) to info@ttfestival.nl to get your data.
If you request your data export, you can use our open-source, local-only Location Data Visualiser to plot your GPS track and see exactly what was collected. The visualiser runs entirely in your browser—no data leaves your machine.
Browse the Programme
The app’s timetable is not unique app content — it is server-side data fetched from the Appmiral backend (app.appmiral.com/api/v7/) and merely visualised on your device, so the full programme also lives in the app’s local cache.
The read API is reachable from anywhere, but it is gated by a single static x-protect header that ships hardcoded in the APK — the same value for every install. With that header (replaying the app’s own request), the live programme can be pulled with curl, a script, or even a browser fetch(). 👉 Full method, reproduce steps & security assessment
We built two visualisers that show every performance by day, stage and time (clash-finder grid + list view), both running entirely in your browser:
- 🟢 Live timetable — pulls live API data, auto-refreshes hourly (GitHub Action), opens on today and jumps to the current hour. Published from the separate
GraafG/tt-timetablerepo. - 📦 Local snapshot tool — a frozen 2026-06-08 cache, fully offline. See the tool README.
This research is open source and available for public review. The goal is to enforce transparency and ensure that user consent is informed by reality, not by misleading marketing copy.