3 ms·

And more importantly from https://apps.apple.com/us/app/ryanair/id504270602 https://apps.apple.com/us/app/ryanair/id504270602 which people now are required to d

And more importantly from https://apps.apple.com/us/app/ryanair/id504270602 https://apps.apple.com/us/app/ryanair/id504270602 which people now are required to download and install: > Data Linked to You - Location, Contact Info, Identifiers, Usage Data, Other Data

ezfe 1y ago
Any app that you log into "links" anything in your profile to your phone, so of course it links this information. I'm all for calling out bad privacy practice, like when a Weather app says it links your contact info. But an airline app inherently does this. Did you know that Ryanair knows your name when you fly! They even know what city you're flying from.
- subscribed 1y ago
  They didn't necessarily have to know my main email address though! Or a list of the installed apps.
  - ezfe 1y ago
    Installing as an app doesn’t share your main email address and they can only identify apps from a fixed list, so it’s not really useful to do that.
    - subscribed 1y ago
      Oh sorry, missed that one. > your main email address Right, it doesn't get my main email at the moment, true, turns out an app needs `android.permission.GET_ACCOUNTS` to do that. I do, however, expect them to do that later -- looking at their declared permissions, it's hard to assume a good will: - `BLUETOOTH_SCAN`, `ACCESS_FINE_LOCATION`, `ACCESS_ADSERVICES_AD_ID` -- all together. Yes, I see they use `android.ext.adservices` `READ_EXTERNAL_STORAGE`? `WRITE_EXTERNAL_STORAGE`? What for? Do they even offer saving a PDF into a Downloads folder? I think they can do it without asking for the separate permission. > and they can only identify apps from a fixed list While it's true they would require `QUERY_ALL_PACKAGES` to openly get a _complete_ list, see this: https://www.medianama.com/2025/04/223-android-apps-data-breach-google-policy-bypassing/ https://www.medianama.com/2025/04/223-android-apps-data-brea... And then check their admitted privacy practices/policy from their Google Play listing (com.ryanair.cheapflights) Notice, the first section is `DATA SHARED`, not just collected. It's shared with the undisclosed third parties (we know from the privacy policy[1], though, that at the very least it includes all the social networks >> App Activity: installed apps >> Purposes: Analytics, Personalisation >> Also: Email address, financial information, physical address, user payment info, phone info. `DATA COLLECTED`: >> Photos, User ids (plural, it's not just email used to login), Installed apps once again, Files and docs (?!) Generally; I have a very little trust for a vendor that is known for the deceptive practices and which lies from the outset about the reasons to force all passengers into using their app. If they lie in such a fundamental question, it should be assumed they're using deceptions and trickery. Like with disgraced Meta caught red-handed on deception and trickery: https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/ https://arstechnica.com/security/2025/06/meta-and-yandex-are... [1] https://www.ryanair.com/ie/en/lp/privacy-policy https://www.ryanair.com/ie/en/lp/privacy-policy
      - ezfe 1y ago
        I suppose if you’re on android the protections are a lot lower… At least based on your description
        subscribed 1y ago
        I agree. The fact AOSP doesn't offer blocking network by default is ridiculous. Of course, Google is the ad company, this is the reason. Thankfully I could contain and strangle it in its dedicated profile with the better AOSP variant. Works for the time being.
Fernicia 1y ago
You can reject all of these permission requests and the app still works.
- embedding-shape 1y ago
  "Other Data" and "Identifiers" too? Don't remember seeing requests for those in any application.
- fph 1y ago
  The app still works /for now/.

ezfe 1y ago

Any app that you log into "links" anything in your profile to your phone, so of course it links this information. I'm all for calling out bad privacy practice, like when a Weather app says it links your contact info. But an airline app inherently does this. Did you know that Ryanair knows your name when you fly! They even know what city you're flying from.

subscribed 1y ago
They didn't necessarily have to know my main email address though! Or a list of the installed apps.
- ezfe 1y ago
  Installing as an app doesn’t share your main email address and they can only identify apps from a fixed list, so it’s not really useful to do that.
  - subscribed 1y ago
    Oh sorry, missed that one. > your main email address Right, it doesn't get my main email at the moment, true, turns out an app needs `android.permission.GET_ACCOUNTS` to do that. I do, however, expect them to do that later -- looking at their declared permissions, it's hard to assume a good will: - `BLUETOOTH_SCAN`, `ACCESS_FINE_LOCATION`, `ACCESS_ADSERVICES_AD_ID` -- all together. Yes, I see they use `android.ext.adservices` `READ_EXTERNAL_STORAGE`? `WRITE_EXTERNAL_STORAGE`? What for? Do they even offer saving a PDF into a Downloads folder? I think they can do it without asking for the separate permission. > and they can only identify apps from a fixed list While it's true they would require `QUERY_ALL_PACKAGES` to openly get a _complete_ list, see this: https://www.medianama.com/2025/04/223-android-apps-data-breach-google-policy-bypassing/ https://www.medianama.com/2025/04/223-android-apps-data-brea... And then check their admitted privacy practices/policy from their Google Play listing (com.ryanair.cheapflights) Notice, the first section is `DATA SHARED`, not just collected. It's shared with the undisclosed third parties (we know from the privacy policy[1], though, that at the very least it includes all the social networks >> App Activity: installed apps >> Purposes: Analytics, Personalisation >> Also: Email address, financial information, physical address, user payment info, phone info. `DATA COLLECTED`: >> Photos, User ids (plural, it's not just email used to login), Installed apps once again, Files and docs (?!) Generally; I have a very little trust for a vendor that is known for the deceptive practices and which lies from the outset about the reasons to force all passengers into using their app. If they lie in such a fundamental question, it should be assumed they're using deceptions and trickery. Like with disgraced Meta caught red-handed on deception and trickery: https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/ https://arstechnica.com/security/2025/06/meta-and-yandex-are... [1] https://www.ryanair.com/ie/en/lp/privacy-policy https://www.ryanair.com/ie/en/lp/privacy-policy
    - ezfe 1y ago
      I suppose if you’re on android the protections are a lot lower… At least based on your description
      - subscribed 1y ago
        I agree. The fact AOSP doesn't offer blocking network by default is ridiculous. Of course, Google is the ad company, this is the reason. Thankfully I could contain and strangle it in its dedicated profile with the better AOSP variant. Works for the time being.

Fernicia 1y ago

You can reject all of these permission requests and the app still works.

embedding-shape 1y ago
"Other Data" and "Identifiers" too? Don't remember seeing requests for those in any application.
fph 1y ago
The app still works /for now/.