Festival App Comparison — TT Festival vs Other Festival Apps

Scope: All other festival apps installed on the same physical Pixel 10a alongside com.appmiral.ttfestival v2.0.1 (versionCode 5), pulled via adb on 2026-06-23 and statically analyzed using the same methodology documented in reverse-engineering.md.

For each app: base.apk + split_config.arm64_v8a.apk were extracted with jadx --no-src (manifest + resources), and classes*.dex were scanned by raw byte search for known vendor package signatures (e.g. Lnet/crowdconnected/, Lcom/amazonaws/). Privacy policies were fetched from the URL each Play Store listing links to.

This is not a full re-decompile of every app; it is a manifest + SDK fingerprint + privacy-policy diff designed to answer the question: “Is TT Festival doing things that comparable festival apps don’t?”

0. TL;DR — what stands out

TT Festival is the only app in this 11-app cohort that bundles the CrowdConnected location-tracking SDK and declares a foregroundServiceType="location" CrowdConnectedService. No other Appmiral festival app in this lineup ships it — not Heroes, not Superbloom, not Splash, not Tinderbox, not Provinssi, not Lolla Berlin.
TT Festival is the only app in the cohort that asks for ACCESS_BACKGROUND_LOCATION, the full Bluetooth permission set (BLUETOOTH_SCAN/_CONNECT/BLUETOOTH/BLUETOOTH_ADMIN), FOREGROUND_SERVICE_LOCATION, CHANGE_WIFI_STATE, ACCESS_LOCATION_EXTRA_COMMANDS, and com.android.vending.CHECK_LICENSE. Every other Appmiral build from the same vendor uses only foreground ACCESS_FINE/COARSE_LOCATION — i.e. location while the app is open.
The Appmiral privacy policies are a shared white-label template. Heroes, Superbloom, Splash, Lolla Berlin and TT Festival all hit the exact same keyword counts (Braze ×2, Insider ×2, Salesforce ×4, CM.com ×2, Spotify ×3, Firebase ×2, Tealium ×2, AWS ×5, Crowd Connected ×2). The text only differs by the festival name. None of those other apps actually ship Braze / Insider / Salesforce / Tealium / Permutive — and only TT Festival actually ships Crowd Connected — so the disclosures are simultaneously over-claiming (named SDKs that aren’t bundled) and, for TT Festival, under-emphasizing the one named SDK that is active.
The four greencopper / FKP Scorpio Flutter apps (Hurricane, Highfield, Meraluna, Southside) are a different architecture entirely (Flutter + Mapbox + Firebase, no AWS, no Crowd Connected, no Cookie Information CMP) and only ask for foreground location. Their privacy policies, also a shared template, correctly name only Firebase / AWS / Mapbox.
All Appmiral builds (TT Festival, Heroes, Superbloom, Splash, Tinderbox, Provinssi, Lolla Berlin) ship the same hardcoded Google Maps API key AIzaSyDihJ3mKQX3_yaKB1lNceXM4jh4_aqUq2Q (see hardcoded-credentials-and-keys.md for the TT Festival audit — the key value is shared across the platform).

1. The cohort

Package	App / festival	Developer (Play Store)	versionName / Code	min/target SDK	Stack
`com.appmiral.ttfestival`	TT Festival (NL)	Stichting TT Week Assen	2.0.1 / 5	28 / 36	Appmiral (Compose)
`com.appmiral.heroesfestival`	Heroes Festival	Goodlive Festival GmbH	4.1.0 / 13	28 / 36	Appmiral (Compose)
`com.appmiral.superbloomfestival`	Superbloom	Goodlive Festival GmbH	4.0.0 / 6	28 / 36	Appmiral (Compose)
`com.appmiral.splashfestival`	Splash	Goodlive Festival GmbH	4.1.0 / 15	28 / 36	Appmiral (Compose)
`com.appmiral.tinderbox`	Tinderbox (BE)	DTD Holding	10.2.1 / 14	28 / 36	Appmiral (Compose)
`com.appmiral.provinssi`	Provinssi (FI)	FKP Scorpio Konzertproduktionen GmbH	12.0.0 / 13	28 / 36	Appmiral (Compose)
`com.greencopper.lollaberlin`	Lollapalooza Berlin	Goodlive Festival GmbH	5.0.2 / 12	28 / 36	Appmiral / November Five (older namespace)
`com.greencopper.android.hurricane`	Hurricane	FKP Scorpio Konzertproduktionen GmbH	2026.41.9 / 276	24 / 35	Flutter + Mapbox
`com.greencopper.android.southside`	Southside	FKP Scorpio Konzertproduktionen GmbH	2026.41.9 / 276	24 / 35	Flutter + Mapbox
`com.greencopper.android.highfield`	Highfield	FKP Scorpio Konzertproduktionen GmbH	2025.37.3 / 224	24 / 35	Flutter + Mapbox
`com.greencopper.android.meraluna`	M’era Luna	FKP Scorpio Konzertproduktionen GmbH	2026.41.1 / 262	24 / 35	Flutter + Mapbox

Notes:

“Stack” was identified by DEX top-level package frequencies. The four Greencopper apps have ~1500× hits on com/mapbox/maps and the marker Lio/flutter/ — they are Flutter apps. The seven Appmiral apps have thousands of androidx/compose/* (TT Festival) or co/novemberfive/android (the older Appmiral codename) classes plus com/appmiral/*.
FKP Scorpio publishes apps in both stacks: their German camping festivals use the Flutter/Greencopper stack; Provinssi (Finland) uses the Appmiral stack. They are not parallel architectures of the same codebase — they are two completely separate vendors.

2. Permission diff (vs TT Festival)

Permissions extracted from each AndroidManifest.xml (manifest summary CSV is in the session artifacts as _manifest_summary.csv).

Permission	TT	Heroes	Superbloom	Splash	Tinderbox	Provinssi	Lolla	Hurricane	Highfield	Meraluna	Southside
`INTERNET`	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
`ACCESS_NETWORK_STATE`	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
`ACCESS_COARSE_LOCATION`	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
`ACCESS_FINE_LOCATION`	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
`ACCESS_BACKGROUND_LOCATION`	✅	❌	❌	❌	❌	❌	❌	❌	❌	❌	❌
`ACCESS_LOCATION_EXTRA_COMMANDS`	✅	❌	❌	❌	❌	❌	❌	❌	❌	❌	❌
`FOREGROUND_SERVICE_LOCATION`	✅	❌	❌	❌	❌	❌	❌	❌	❌	❌	❌
`FOREGROUND_SERVICE`	✅	✅	✅	✅	✅	✅	✅	❌	❌	❌	❌
`BLUETOOTH`	✅	❌	❌	❌	❌	❌	❌	❌	❌	❌	❌
`BLUETOOTH_ADMIN`	✅	❌	❌	❌	❌	❌	❌	❌	❌	❌	❌
`BLUETOOTH_SCAN`	✅	❌	❌	❌	❌	❌	❌	❌	❌	❌	❌
`BLUETOOTH_CONNECT`	✅	❌	❌	❌	❌	❌	❌	❌	❌	❌	❌
`ACCESS_WIFI_STATE`	✅	✅	❌	✅	✅	❌	❌	✅	✅	✅	✅
`CHANGE_WIFI_STATE`	✅	❌	❌	❌	❌	❌	❌	❌	❌	❌	❌
`com.android.vending.CHECK_LICENSE`	✅	❌	❌	❌	❌	❌	❌	❌	❌	❌	❌
`CAMERA`	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
`NFC`	✅	✅	✅	✅	✅	✅	✅	❌	❌	❌	❌
`POST_NOTIFICATIONS`	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
`RECEIVE_BOOT_COMPLETED`	✅	✅	✅	✅	✅	✅	✅	❌	❌	❌	❌
`WAKE_LOCK`	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
`SCHEDULE_EXACT_ALARM`	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
`USE_EXACT_ALARM`	❌	❌	❌	❌	❌	❌	❌	✅	❌	✅	✅
`VIBRATE`	✅	✅	❌	✅	✅	✅	✅	✅	❌	✅	✅
`READ_EXTERNAL_STORAGE`	✅	✅	✅	✅	✅	✅	✅	❌	❌	❌	❌
`WRITE_EXTERNAL_STORAGE`	✅	✅	✅	✅	✅	✅	✅	❌	❌	❌	❌
`ACCESS_ADSERVICES_AD_ID`	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
`ACCESS_ADSERVICES_ATTRIBUTION`	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
`SYSTEM_ALERT_WINDOW`	❌	❌	❌	❌	❌	❌	❌	❌	✅	❌	❌
`REORDER_TASKS`	❌	❌	❌	❌	❌	❌	❌	❌	✅	❌	❌

Eight permissions are exclusive to TT Festival: ACCESS_BACKGROUND_LOCATION, ACCESS_LOCATION_EXTRA_COMMANDS, FOREGROUND_SERVICE_LOCATION, BLUETOOTH, BLUETOOTH_ADMIN, BLUETOOTH_SCAN, BLUETOOTH_CONNECT, CHANGE_WIFI_STATE, com.android.vending.CHECK_LICENSE.

All eight line up exactly with what the CrowdConnected SDK needs to do its hybrid GPS-/Wi-Fi-/Bluetooth-beacon positioning in the background.

3. Declared services (foreground service types)

Only the entries with a foregroundServiceType (or matching location/ background in the class name) are shown.

App	Foreground services
`com.appmiral.ttfestival`	`MusicPlayerService` (mediaPlayback), `ReminderService` (shortService), `net.crowdconnected.android.background.CrowdConnectedService` (location)
`com.appmiral.heroesfestival`	`MusicPlayerService` (mediaPlayback), `ReminderService` (shortService)
`com.appmiral.superbloomfestival`	`MusicPlayerService` (mediaPlayback), `ReminderService` (shortService)
`com.appmiral.splashfestival`	`MusicPlayerService` (mediaPlayback), `ReminderService` (shortService)
`com.appmiral.tinderbox`	`MusicPlayerService` (mediaPlayback), `ReminderService` (shortService)
`com.appmiral.provinssi`	`MusicPlayerService` (mediaPlayback), `ReminderService` (shortService)
`com.greencopper.lollaberlin`	`MusicPlayerService` (mediaPlayback), `ReminderService` (shortService)
`com.greencopper.android.hurricane`	`com.baseflow.geolocator.GeolocatorLocationService` (location) — Flutter geolocator plugin
`com.greencopper.android.southside`	`com.baseflow.geolocator.GeolocatorLocationService` (location)
`com.greencopper.android.highfield`	`com.baseflow.geolocator.GeolocatorLocationService` (location)
`com.greencopper.android.meraluna`	`com.baseflow.geolocator.GeolocatorLocationService` (location)

The Greencopper apps do have a foreground location service, but that is the standard Flutter geolocator plugin which only runs while the app requests it (no ACCESS_BACKGROUND_LOCATION), used for the on-screen “where am I on the festival map” feature. The TT Festival CrowdConnectedService is a different beast: it is a persistent background tracker that combines GPS + Wi-Fi + Bluetooth beacons and uploads to AWS — see crowd-connected.md.

4. Bundled SDK matrix (DEX fingerprint)

Y = vendor package classes are physically present in the APK’s DEX files. . = not bundled.

SDK	TT	Heroes	Superbloom	Splash	Tinderbox	Provinssi	Lolla	Hurricane	Highfield	Meraluna	Southside
CrowdConnected (`net.crowdconnected`)	Y	.	.	.	.	.	.	.	.	.	.
AWS SDK (`com.amazonaws`)	Y	Y	Y	Y	Y	Y	Y	.	.	.	.
Firebase Analytics	Y	Y	Y	Y	Y	Y	Y	Y	Y	Y	Y
Firebase Crashlytics	Y	Y	Y	Y	Y	Y	Y	Y	Y	Y	Y
Firebase Messaging	Y	Y	Y	Y	Y	Y	Y	Y	Y	Y	Y
Google Maps SDK	Y	Y	Y	Y	Y	Y	Y	.	.	.	.
Google Play Services Location	Y	Y	Y	Y	Y	Y	Y	Y	Y	Y	Y
Mapbox	.	Y	.	Y	Y	.	.	Y	Y	Y	Y
Cookie Information CMP	Y	Y	Y	Y	Y	Y	Y	.	.	.	.
OneTrust CMP	.	.	Y	Y	.	.	Y	.	.	.	.
CM.com Push	Y	Y	Y	Y	Y	Y	Y	.	.	.	.
Permutive	.	.	Y	Y	.	.	Y	.	.	.	.
Appmiral platform (`com.appmiral.*`)	Y	Y	Y	Y	Y	Y	Y	.	.	.	.
Braze / Salesforce MC / Insider / Tealium / Facebook / Spotify SDK / AppsFlyer / Branch / Adjust / Mixpanel / Segment / Intercom / Sentry / Datadog / Bugsnag / Ticketmaster	.	.	.	.	.	.	.	.	.	.	.

Notes:

CrowdConnected is unique to TT Festival in this cohort, matching the manifest service finding.
Lolla Berlin is built on Appmiral — it ships com.appmiral.*, AWS, Firebase, CM Push and Cookie Information just like the com.appmiral.* builds, but is published under the com.greencopper.lollaberlin package id (a leftover branding choice).
Three apps (Splash, Superbloom, Lolla Berlin) bundle both Cookie Information and OneTrust and Permutive — likely a configuration drift inside the Appmiral platform; the others ship Cookie Information only.
Greencopper Flutter apps bundle only Firebase + Mapbox + GMS Location. No AWS, no AppMiral, no CrowdConnected, no CMP SDK at all — they appear to handle consent inside the Flutter layer instead of via a third-party CMP.
Not a single app in this lineup actually bundles Braze, Salesforce Marketing Cloud, Tealium, Insider, AppsFlyer, Branch, Adjust, Mixpanel, Segment, Intercom, Facebook, Sentry, Datadog, Bugsnag, or the Ticketmaster SDK — even though several privacy policies name them.

5. AWS region embedded in the SDK constants

The AWS Android SDK enumerates every region as constants, so counting them is noisy — but the dominant region (i.e. the one referenced from configuration objects, Cognito identity-pool URLs, etc.) shows up first:

App	Top AWS regions referenced (rough rank by string-table hits)
`com.appmiral.ttfestival`	us-east-1 (34) > eu-west-1 (32) > us-west-2 > eu-central-1 > ap-northeast-1
`com.appmiral.heroesfestival`	eu-west-1 (31) > us-east-1 (25) > us-west-2 > eu-central-1
`com.appmiral.superbloomfestival`	eu-west-1 (31) > us-east-1 (25) > us-west-2 > eu-central-1
`com.appmiral.splashfestival`	eu-west-1 (32) > us-east-1 (28) > us-west-2 > eu-central-1
`com.appmiral.tinderbox`	eu-west-1 (31) > us-east-1 (25) > us-west-2 > eu-central-1
`com.appmiral.provinssi`	eu-west-1 (31) > us-east-1 (25) > us-west-2 > eu-central-1
`com.greencopper.lollaberlin`	eu-west-1 (31) > us-east-1 (25) > us-west-2 > eu-central-1
Greencopper Flutter apps	no AWS SDK bundled

Counts are string-table references, not network traffic. They are useful as a relative comparison: TT Festival is the only Appmiral build where us-east-1 outranks eu-west-1 in DEX hits, which is consistent with the empirical capture in crowd-connected.md showing the CrowdConnected backend pushing location to AWS endpoints in us-east-1 while the rest of the Appmiral stack talks to eu-west-1.

6. Privacy-policy text vs bundled reality

Each Play Store listing links to a privacy policy. The Appmiral builds link to https://app.appmiral.com/<festival-id><year>/privacy-policy; the Greencopper apps link to the festival’s own domain.

Package	Privacy policy URL	Stack
`com.appmiral.ttfestival`	`https://app.appmiral.com/ttfestival2026/privacy-policy`	Appmiral
`com.appmiral.heroesfestival`	`https://app.appmiral.com/heroesfestival2026/privacy-policy`	Appmiral
`com.appmiral.superbloomfestival`	`https://app.appmiral.com/superbloomfestival2026/privacy-policy`	Appmiral
`com.appmiral.splashfestival`	`https://app.appmiral.com/splashfestival2026/privacy-policy`	Appmiral
`com.appmiral.tinderbox`	`https://app.appmiral.com/tinderbox2026/privacy-policy`	Appmiral (DTD Holding-branded body)
`com.appmiral.provinssi`	`https://app.appmiral.com/provinssi2026/privacy-policy`	Appmiral (FI, minimal text)
`com.greencopper.lollaberlin`	`https://app.appmiral.com/lollapaloozaberlin2026/privacy-policy`	Appmiral
`com.greencopper.android.hurricane`	`https://hurricane.de/de/datenschutz-app/`	Greencopper (FKP shared template)
`com.greencopper.android.highfield`	`https://highfield.de/de/datenschutz-app`	Greencopper
`com.greencopper.android.meraluna`	`https://meraluna.de/de/datenschutz-app`	Greencopper
`com.greencopper.android.southside`	`https://southside.de/de/datenschutz-app`	Greencopper

6.1 The “white-label template” effect

Counting mentions of named third-party SDKs in each fetched policy:

Policy	“Braze”	“Insider”	“Salesforce”	“Tealium”	“Spotify”	“CM.com”	“Crowd Connected”	“AWS”	“Firebase”
`ttfestival`	2	2	4	2	3	2	2	5	2
`heroesfestival`	2	2	4	2	3	2	2	5	2
`superbloomfestival`	2	2	4	2	3	2	2	5	2
`splashfestival`	2	2	4	2	3	2	2	5	2
`lollaberlin`	2	2	4	2	3	2	2	5	2
`tinderbox`	2	0	0	0	0	0	0	0	0
`provinssi`	0	0	0	0	0	0	0	0	0 (Finnish, stub)
`hurricane`	0	0	0	0	0	0	0	17	25
`highfield`	0	0	0	0	0	0	0	17	25
`meraluna`	0	0	0	0	0	0	0	17	25
`southside`	0	0	0	0	0	0	0	17	25

Five Appmiral policies (TT Festival, Heroes, Superbloom, Splash, Lolla Berlin) match to the exact keyword count. They are the same body of text with the festival name swapped in. The Greencopper/FKP Scorpio four similarly share one template.

6.2 Claimed vs bundled

Comparing what each policy names against what the APK bundles:

App	Policy names…	…but APK actually bundles
TT Festival	Braze, Insider, Salesforce, Tealium, CM.com, Spotify, Firebase, AWS, Crowd Connected	Crowd Connected ✅, CM Push ✅, Firebase ✅, AWS ✅; Braze ❌, Insider ❌, Salesforce ❌, Tealium ❌, Spotify SDK ❌ (Spotify is OAuth account-linking only)
Heroes / Superbloom / Splash / Lolla Berlin	Braze, Insider, Salesforce, Tealium, CM.com, Spotify, Firebase, AWS, Crowd Connected	CM Push ✅, Firebase ✅, AWS ✅; Crowd Connected ❌ NOT BUNDLED, Braze ❌, Insider ❌, Salesforce ❌, Tealium ❌
Tinderbox	mentions Braze only	CM Push, Firebase, AWS bundled; Braze ❌ not bundled
Provinssi	stub page, nothing concrete	CM Push, Firebase, AWS bundled
Hurricane / Highfield / Meraluna / Southside	Firebase, AWS, Mapbox	Firebase ✅, Mapbox ✅; no AWS SDK actually bundled — AWS mentions are likely about hosting their CMS, not in-app

So the Appmiral policies are simultaneously over-claiming (listing SDKs that aren’t in the build) and failing to differentiate TT Festival, which is the only app actually running the named “Crowd Connected” SDK.

The Greencopper/FKP policies are honest about the SDK list but inaccurate about AWS in the app (the policy mentions AWS as a service used by them, which is true for hosting the CMS, but the app itself doesn’t talk directly to AWS — there’s no com.amazonaws.* in the APK).

6.3 Background location

TT Festival privacy policy describes location collection and frames it as safety/emergency-related — but, as documented in privacy-policy-analysis.md, the only feature that needs foreground location is the Emergency Button. The ACCESS_BACKGROUND_LOCATION permission and CrowdConnectedService foregroundServiceType="location" exist for the analytical crowd-flow product, not the user-facing safety feature.
No other app in this cohort declares ACCESS_BACKGROUND_LOCATION — not even the other Appmiral apps from the same vendor that share TT Festival’s templated privacy text. So those apps are not doing what TT Festival is doing, even though their privacy policies imply otherwise.

7. Bottom line

The technical comparison invalidates a few defenses that might be raised in TT Festival’s favour:

“The Appmiral platform requires these permissions.” No — six other Appmiral builds from the same vendor do not request background location, bluetooth, foreground-service-location, change-wifi-state, or check-license. TT Festival’s AndroidManifest.xml is the outlier in the platform.
“CrowdConnected is a generic festival-app SDK; everyone uses it.” In this 11-app, 4-publisher cohort, only TT Festival has the net.crowdconnected.* classes and CrowdConnectedService.
“The privacy policy disclosure is generic boilerplate that happens to list everything.” That boilerplate is identical across all the Appmiral apps, but only TT Festival’s APK actually contains the location-tracking SDK that the policy hand-waves about — so the policy is the least informative for the festival that needs the most disclosure.

The full data backing this document — per-app manifests, DEX fingerprint matrix (_sdk_matrix.json), config-grep dump (_config_grep.txt), permission-summary CSV (_manifest_summary.csv), cached Play Store and privacy-policy HTML — lives in the session artifacts under festival-compare/ (not committed to the repo because it contains copyrighted third-party APK content).