TT Festival App — Public disclosure comparison
Scope: comparison between app reverse-engineering findings and the public pages:
- https://ttfestival.nl/veelgestelde-vragen/
- https://app.appmiral.com/ttfestival2026/privacy-policy
- https://ttfestival.nl/huisregels/
- https://ttfestival.nl/veiligheid/
Pages fetched/reviewed on 2026-06-08.
1. Summary
The public website pages explain festival logistics, house rules and safety measures, but they do not disclose the app’s concrete data flows. The privacy policy is the only page that discusses app data processing, but it remains high level and conflicts with several findings from the APK and live device captures.
Most important gaps:
- No public-page disclosure of pre-consent phone-home to Firebase Installations/Crashlytics, AWS Cognito, AWS SNS and Appmiral.
- No disclosure that Crowd Connected credentials and Spotify client secret are embedded in the APK.
- No disclosure of the 60 km Crowd Connected geo-zone or the operator
active=falsekill-switch behaviour. - EU-only storage claim conflicts with Crowd Connected traffic/settings that
use US AWS endpoints (
us-east-1) andmobile.crowdconnected.com. - Bierroute QR scans are identity-linked when
requires_validation=true, but the public pages do not explain that scanning a café QR can tie account identity to venue/time. - Location permission copy frames background location as needed for location-based push / safety info, but public safety pages do not explain this app mechanism.
2. What the public pages say
2.1 FAQ (/veelgestelde-vragen/)
The FAQ covers general festival questions: age, accessibility, camping, transport, plastic cups, sustainability, organisers, and points to the house rules.
Not found: app privacy, app permissions, location tracking, Crowd Connected, push-token linkage, QR/bierroute data, Firebase/AWS/Appmiral trackers.
2.2 Privacy policy (app.appmiral.com/ttfestival2026/privacy-policy)
Relevant statements:
- Profile form is optional and collects first name, last name, email and marketing consent.
- Location data may be used for navigation, event recommendations or crowd information.
- Location data are shared with Crowd Connected only in pseudonymized form: unique device identifier, coordinates and optionally a push token.
- App usage analytics via Firebase/GA4; additional analytics platforms may be connected depending on configuration.
- All data are stored securely in the EU, AWS
eu-west-1, with Cloudflare in the USA as the named exception. - Users can change location/push permissions in device settings.
2.3 House rules (/huisregels/)
The house rules cover event-site conduct: images/audio recordings, access control, searches, forbidden items, alcohol, liability, behaviour, cups, commercial activities, parking and staff instructions.
Not found: app data processing, app tracking, app permissions, location, Crowd Connected or QR/bierroute identity linkage.
2.4 Safety (/veiligheid/)
The safety page covers glass/cans, EHBO, NIX18, Celebrate Safe, sexual safety, BOB, TeamAlert and buying drinks at the bar. It says EHBO locations are available in the app.
Not found: background location, location-based push, Crowd Connected, geofencing, emergency-button data flow, or how app location relates to safety.
3. Findings vs disclosure
| Finding from APK/live capture | Public disclosure | Gap / inconsistency |
|---|---|---|
| Fresh launch contacts Firebase Installations, Crashlytics settings, GMS, AWS Cognito, AWS SNS and Appmiral before consent; locked-device run proved this happens before user interaction. | Privacy policy says app usage analytics and location are optional/consent-based; no mention of pre-consent identity/push infrastructure registration. | Users are not told that cloud identity and push endpoint setup happen before meaningful consent. |
| AWS Cognito/SNS register anonymous identity + push endpoint as “necessary”. | Privacy policy mentions push permissions generically in §9, not AWS Cognito/SNS mechanics. | Push infrastructure is materially more specific than “device settings”. |
Crowd Connected SDK has app key + token + secret in APK; app later contacts mobile.crowdconnected.com and aliases SNS endpoint as sns_user_id. |
Privacy policy says only UUID, coordinates and optionally a push token are shared pseudonymously. | The policy does not explain the backend aliasing path or embedded credentials. |
Crowd Connected config observed: appKey dd54d39d, active=false, 820 m inner ring and 60 km outer geo-zone around Assen. |
Privacy policy says location may support navigation/recommendations/crowd info; no radius/geofence details. | Users cannot understand the geographic scope; 60 km is far larger than the festival grounds/city centre. |
Crowd Connected pipeline uses US AWS/Cognito/Kinesis-style endpoints (us-east-1) in static/live analysis. |
Privacy policy claims all data stored/processed in EU, with Cloudflare USA as exception. | US Crowd Connected/AWS path is not disclosed and appears inconsistent with the EU-only claim. |
Bierroute “QR scan” is TT Bierroute game id 54; all link badges are requires_validation=true, so QR unlock goes through .../games/54/badges/unlock with identity headers (email/name/account/app-user ids). |
Public website pages do not describe bierroute QR data processing; privacy policy only generically mentions loyalty/rewards. | Scanning a venue QR can create a server-side record of identity + venue/time, but this is not explained. |
| App copy says: “Deel je locatie gegevens zodat we je push notificaties kunnen sturen gebaseerd op jouw locatie.” | Safety page discusses safety/EHBO but not app-powered location push; privacy policy says location can support recommendations/crowd information. | Location-based push/safety framing appears only inside app copy/settings, not on public safety/FAQ pages. |
| Background-location copy says it can improve “uw veiligheid” and send location-based safety/events info. | Public safety page explains human/EHBO measures; no app background tracking mechanism. | The safety rationale for background location is not made transparent in public safety material. |
| Spotify client secret is embedded in the APK. | Privacy policy says Spotify token may be used for recommendations. | Does not disclose implementation risk: a client secret in a public mobile binary. |
| App has many consent-registry placeholders (Braze, Salesforce, Tealium, Permutive, Facebook) that are not bundled/active in this build. | Privacy policy says additional analytics platforms may be connected according to configuration. | The policy is broad but not concrete; current build appears narrower than the registry suggests. |
4. Specific notes per topic
4.1 Location-based push notifications
There is evidence for the capability and intended use, not evidence that a location-triggered push has already been delivered during this pre-event test.
Evidence:
- App strings explicitly say location can be used for location-related push:
permission_location_body_android,settings_crowdconnected_login_body,settings_permissions_background_location_body. - Code sends the SNS endpoint into Crowd Connected as alias
sns_user_id. - Live logcat showed
Setting alias sns_user_id,...and traffic tomobile.crowdconnected.com.
Not proven:
- A concrete location-triggered push was received.
- The operator has enabled the Crowd Connected active flag right now
(
active=falsewas observed).
4.2 Bierroute deeplinks
The live TT Bierroute game is documented in
bierroute-gamification.md.
Full QR unlock codes are intentionally not published in git because they could
be used to bypass the physical route.
4.3 Safety/emergency framing
The public safety page is operational (EHBO, rules, safe behaviour). The app’s
background-location copy uses safety wording, but the genuine emergency-button
flow only needs foreground/on-demand location. That mismatch is documented in
crowd-connected-faq.md.
5. Suggested disclosure improvements
- Add an app/privacy FAQ entry that names Firebase, AWS Cognito/SNS, Appmiral, CM.com and Crowd Connected and distinguishes pre-consent infrastructure from consent-gated analytics/location.
- Explain the Crowd Connected geo-zone and current event activation model:
radius, frequencies,
activeflag and whether collection happens before the event. - Explain location-based push explicitly: what location signal is used, who receives it, what is sent to Crowd Connected, and whether this is required for emergency/safety messages.
- Update the EU-only statement or document the Crowd Connected/US AWS transfer path and legal basis.
- Explain bierroute QR scans as identity-linked server validation, not just a local game mechanic.
- Publish a clear data-access/deletion path for app profile, push endpoint, Crowd Connected identifiers and gamification scan history.