Azamara
Released Dec 2018 — Pursuit only (shared RCI codebase)
Ocean Cruise Apps
Cruise Mobile Apps
Cruise Mobile Apps
2021 Annual Report
An independent analysis of 13 ocean cruise guest apps during the pandemic year — covering health integrations, technology stacks, security practices, and predictions for 2022 as the industry prepares to return to sea.
13Apps analyzed
2New this year
20+Tools catalogued
About OnDeck by Sourcetoad
Guest-experience software since 2010.
OnDeck by Sourcetoad has specialized in innovative guest-facing software for the cruise and ferry industry for 15+ years. Our mission is to increase the value of both the guest's and the crew's time by building automation, communication, and self-service systems.
We offer a number of custom and out-of-the-box solutions for cruise lines to increase operational efficiencies, improve guest experiences, and shorten technology ROI cycles.
Learn moreProducts & Services
- Cruise Director PlatformShipboard and shoreside middleware, ship-to-shore sync, IoT, analytics.
- Mobile App-in-a-BoxWhite-label guest app: digital check-in, boarding passes, dining, folio management.
- OnDeck iTVIn-cabin interactive TV with live TV, on-demand, and room-service booking.
- OnDeck Smart SignageFleet-wide digital signage, dynamically triggered by GPS, weather, or port.
- ECSSilent, workflow-based passenger notification system.
- Digital SurveyPre-, during-, and post-cruise guest feedback.
- Push NotificationsFull push module for mobile and iTV, including local push.
Introduction
Signs of encouragement everywhere.
Few sectors have been as broadly affected by the global COVID-19 pandemic as the cruise industry — and like all other aspects of the industry, mobile app development did not look anything like previous years. In the early days of the pandemic, few changes were made to release cycles, as many anticipated a rapid return to sailing. By around August, development teams across the industry had started taking divergent paths: some slowing significantly due to furloughs and budget cuts, others ramping up to add health and safety features.
While the last 15 months have been extremely trying, there are now signs of encouragement everywhere. Small test sailings have largely proved to be effective and safe, and lines are increasingly announcing limited returns to service. Mobile development teams are ramping back up throughout the industry, and there is an increased hunger for innovation and features that improve the guest experience.
This report uses many of the same methods and analytical tools as previous years, but suffers a lack of first-hand and reported experience with passenger-facing mobile apps due to the pause in sailing. While this report does contain many new findings, trends, and technologies, we look forward to releasing a 2022 report that can be informed by real guests.
This report focuses solely on each cruise line's primary passenger-facing app for ocean ships. The data and information were collected from app analyses, discussions with professionals in the cruise industry, first-hand experience, articles, online reviews, and demonstration videos.
◆ New in 2021
↑ Significantly updated section
Methodology
How we investigate each app.
Our process focuses on apps available both on and off the ship. Apps that are only accessible onboard fall outside the scope of this analysis. Data was collected from VirusTotal analyses, industry professional discussions, first-hand experience, articles, and demonstration videos.
- Collect — We start with our repository of Android APKs, then download the current versions for analysis.
- Sideload — If unavailable in the US region, we sideload via ADB and pull ARM64 English versions for a level playing field.
- Disassemble — Each APK is decompiled with Apktool using standard tooling.
- Security scan — We run MobSF for a static security report on each application.
- Code review — New apps are viewed in VS Code; returning apps are diffed against their previous version in Araxis Merge.
- Supplement — App store reviews, demonstration videos, and industry contacts fill gaps where onboard testing is unavailable.
Tools Used
Apktool
Android APK reverse engineering tool, maintained by Sourcetoad's Director of Engineering.
MobSF
Mobile Security Framework — static and dynamic security analysis for Android, iOS, and Windows Mobile.
VirusTotal
App analysis service used to supplement APK-level analysis where direct decompilation was limited.
Araxis Merge
File comparison tool for diffing app versions to identify added or removed features and code.
VS Code
Generic code viewer for investigating source code in new apps without a prior version baseline.
Mobile Applications
Thirteen apps. Two new entries.
This year's report covers 13 ocean cruise apps. Azamara — which shares much of the same codebase as Royal Caribbean International and Celebrity Cruises — joins the roster as a new entry, along with Seabourn Source, released in April 2020 and analyzed for the first time this year.
Carnival HUB
Released Jan 2015 — full fleet
Celebrity Cruises
Released Nov 2017 — 8 ships (shared RCI codebase)
Costa Cruises
Released Jan 2018 — full fleet
Crystal Cruises
Released Nov 2019 — Serenity & Symphony
Disney Navigator
Released Aug 2013, redesigned Feb 2018 — all 4 ships
HAL Navigator
Released Feb 2019 — full fleet (shared Seabourn codebase)
MSC for Me
Released Jun 2017 — 6 ships
Cruise Norwegian
Released Oct 2017 — full NCL fleet
MedallionClass
Released Aug 2019 — full Princess fleet
Royal Caribbean
Released Nov 2017 — 20 ships (shared Celebrity codebase)
Seabourn Source
Released Apr 2020 — full fleet (shared HAL codebase)
Viking Voyager
Released Jun 2017 — full ocean fleet
Update Frequency
App updates in 2020.
Despite the pandemic, no major cruise brand stood still with their app updates. Most updates in 2020 were bug fixes, performance improvements, and new features aimed at health and safety. HAL Navigator and Seabourn Source led with 24 updates each — remarkable given the circumstances.
Features
Health takes center stage.
Each app we analyzed contained a broad selection of features. The most significant change in 2021 is the near-universal adoption of health questionnaires — the defining feature of the pandemic year. We break features into Common (almost standard), Less Common (appearing in at least two apps), and Stand-out (differentiating or found in only one app).
Common Features
Features shared by the majority of apps reviewed.
Chat
Adopted by the majority of apps. Although a couple of cruise lines still charge small fees, it is increasingly becoming a free feature. A major focus year for adoption and stability.
Check-in
Pre-board digital check-in — rolled out for most apps during COVID-19 to help get guests onboard more quickly and reduce physical contact at embarkation.
Deck Map
Deck plans are a ubiquitous feature and a critical guide for guests navigating around the ships.
Dining
Every app has at least some information on dining options — hours, menus, images, locations, dress attire, reservations, and reservation cancellation.
Folio
An itemized billing statement that updates when guests make purchases — important for avoiding bill shock at the end of a cruise.
Itinerary
The guest's customized schedule. Once an activity has been chosen or selected, it appears on this calendar.
Health Questionnaires
The most common feature added in 2021. Cruise lines handled these in a number of ways — from integrating with onboard EMR systems to simple forms that trigger alerts when certain conditions are met.
Shore Excursions
The vast majority of apps allow guests to both research and book an excursion directly from their device.
Spa Services
Most cruise lines have some kind of spa service feature, allowing guests to view offerings and make reservations.
Daily Schedule
The main stop when planning activities for each day. An event can usually be added, booked, or marked, then moves to the itinerary.
Less Common Features
Available in at least two of the apps we researched.
Countdown Clock
A pre-cruise countdown being introduced to more apps, building anticipation for guests' upcoming cruise.
Digital Muster
Cruise lines are beginning to offer guests an option to access safety drill information via their mobile devices or stateroom TVs, eliminating traditional large-group assemblies.
Purchase Merchandise
Apps are beginning to offer guests more options for purchases, including shopping before boarding the ship.
Video on Demand
A few guest-facing apps feature the cruise line's own channels and shows that do not require a supplemental app to watch.
Wayfinding & Locator
A couple of apps use a BLE beacon system to help guests find their way around the ship. Wearables also make it possible to keep track of family and friends.
Stand-out Features
Differentiating features found in only one or two apps.
Art Guide (Viking)
Viking Voyager includes an audio art guide where guests can listen to clips about historical pieces, works of art, and different areas of the ships.
Audio on Demand (Crystal)
Crystal's app allows guests to listen to a range of music directly from the app.
Fleet Map (HAL)
Holland America's Navigator Cruise Map feature lets guests see where all Holland America ships currently are — including their own.
Geolocated Orders (Princess)
MedallionClass allows guests to order drinks or merchandise from anywhere on the ship. The order is sent to the closest bar or store location, and delivered directly to the guest.
Guest Calling (Norwegian)
Along with a chat system, Cruise Norwegian allows unlimited calls to other passengers for a one-time fee of $9.95 USD, plus calls home for $0.79/min.
Live Television (Viking)
Viking Voyager includes live television that works anywhere on the ship, allowing guests to sit by the pool and watch the news on their phones or tablets.
Room Control (RCI testing)
On select ships, Royal Caribbean Group is testing a stateroom control feature. The app functions as the room key and controls the TV, lighting, temperature, and shades.
Technology
A slowly diversifying stack.
In 2019, almost all apps analyzed were predominantly native — written in Java or Kotlin for Android and Objective-C or Swift for iOS. In 2020, two alternative technologies joined the industry. In 2021, the picture continues to slowly evolve.
13Apps
Native (Java/Kotlin, Obj-C/Swift)10
React Native1
Cordova1
Unity1
Carried forward from 2020 — per-app framework choice wasn't re-audited for every title in 2021.
Cross-platform frameworks
There was one exception to the native norm in 2019 — React Native. In 2020, two alternative technologies joined the industry. Cordova allows developers to write code using standard web development tools (HTML5 and JavaScript) and run it in an app wrapper — similar to how interactive TV apps work. Unity, primarily developed as a hybrid 3D gaming engine, allows for more radical interface designs and a single codebase across iOS and Android.
These cross-platform technologies significantly lower development time and complexity, with the trade-off coming in terms of speed and functionality compared to fully native approaches.
SIP and push notifications
At least one cruise app uses a VoIP phone system for onboard calls. Some applications have a SIP client library inside them but no phone feature — likely to enable real-time background push notifications. Because a VoIP app needs to get messages instantly for incoming call alerts, including a SIP library can enable real-time background push without a consistent internet connection.
This is risky: Apple has caught apps doing this before and banned them from the App Store. Apple now requires all VoIP apps to use PushKit (which requires connectivity to Apple's servers). With Apple and Google both releasing new local push systems, this workaround should become unnecessary.
External Settings Files
Cruise applications have an uncommon constraint: they act differently based on the network the guest has joined — onboard versus standard internet. An external settings file works by requesting a file from a specific domain containing different configuration flags when the ship's network is detected. This can be expanded greatly to include more than simple configuration flags, and we noticed this pattern of development in many of the applications.
Accessibility
New accessibility features are starting to appear in two of the most technologically forward apps in the industry. These features allow passengers with disabilities to use the apps more easily — including screen reader support, text-to-speech, and compatibility with assistive technologies. This is a welcome addition to the cruise industry and has often been a distant afterthought for most development teams.
Tools & Key Players
Third-party SDKs and integrations.
Our decompilation process surfaces the third-party libraries bundled into each app. Below are the most significant tools found in 2021 — a year defined by health-driven additions and the continued maturation of the Firebase ecosystem.
Artificial Intelligence
Found in 3+ apps. Virtual AI assistant platform now bundled in applications — at least three cruise lines experimenting with virtual chat assistants. Bespoke bot development remains complex without a strong onboard data infrastructure.
New in 2021
Alipay & WeChat Pay
Found in select apps. Libraries supporting both Alipay (Alibaba) and WeChat Pay (Tencent) confirm the importance the industry places on the Chinese market, where these wallets account for 92% of mobile payment market share.
Image & Animation Libraries
New in several apps. Libraries like Glide Transformations, React Native Animatable, and ViewAnimator create a more fun, lighthearted experience for users, adding another layer of management complexity but improving the overall feel of the app.
Appearing in more than one app for the first time in 2021. Provides telephony, device tracking, and health-related SDKs. The COVID-19 crisis saw netTALK expand with innovative health and safety offerings beyond their traditional telephony services.
PDFium
New in 2021. Google-supported open-source library for viewing, printing, searching, and filling PDF forms — a surprising discovery inside a mobile app. Likely used to handle PDF documents (tickets, medical forms) in an offline shipboard environment.
Existing & Updated
Found in 2 apps (full SDK). The leading provider of cabin door lock and gangway systems in the cruise industry. The reemergence of their SDKs in Android binaries strongly hints that mobile room key rollout is imminent.
One of the biggest changes in 2021. Google acquired Crashlytics in 2019 and moved error reporting into Firebase Crashlytics. Most developers who were using the old Crashlytics console have migrated to Firebase to unify crash data and usage analytics in one place.
Found in select apps. Analytics and application performance monitoring with an on-premises solution — unusual for mobile analytics, and ideal for cruise ships operating in low-connectivity environments.
Found in select apps. The primary card scanning library in the industry. BlinkID and BlinkCard allow developers to capture ID documents and credit card information from device camera scans.
Found in multiple apps. An HTTP proxy that allows developers to proxy onto the ship to debug issues on real devices. Finding Charles SSL certificates in production builds is a security concern — see Security tab.
Found in select apps. Sourcetoad's suite of onboard and shoreside software modules covering iTV, signage, captive portal, mobile app management, IoT, device management, cabin access, and notifications.
Found in 2 apps. Open-source enterprise CMS used to deliver marketing content and images to the app, and likely as an EFSS tool to coordinate shoreside digital assets for synchronization to onboard systems.
Found in 1 app. Platform technology that analyzes feedback from social media and review sites. Their mobile feedback tools are embedded in the app to collect in-cruise guest sentiment.
Found in many apps. Java bytecode obfuscation and optimization tool that makes it significantly harder to reverse-engineer the source code from a compiled APK.
Security
Security remains an open concern.
Security is still an issue across many of the applications tested. Combined with some of the outdated security measures seen on shipboard guest networks, it is only a matter of time before a large security or privacy issue makes the news. The findings below were consistent across multiple apps in 2021.
High Concern
Test Data / Shim in Production APKs
Many of the apps we researched included test — or "shim" — data inside of them. This is essentially a text file containing a fake passenger's details, calendar, folio, restaurant menus, available spa treatments, and shore excursion offerings. The reason this data is included is so Apple (or other testers) can test the app without connecting to a PMS or shoreside test database. The risk: this data could expose vectors of attack for hackers by providing insight into internal operations and API structures.
Clear-Text Test Logins in Production Builds
About half of the apps we investigated contained clear-text usernames and easily visible passwords embedded in the APK. These credentials are for Apple's testers to log in with "onboard mode" activated, since most cruise apps are designed to only work shipboard. The risk: someone other than approved testers could log into the apps without having to pay for a ticket to board the ship.
Medium Concern
Charles SSL Proxy Certificates in Production
We discovered a number of applications that contain a Charles SSL certificate, suggesting multiple cruise lines use this type of live debugging on production ships. Leaving debugging proxy certificates in production builds means traffic on those ships could potentially be intercepted by anyone with a copy of the certificate. This is a development convenience that becomes a security liability when not removed before release.
A note on scope. Our analysis is based on static reverse engineering of Android APKs. We do not perform dynamic testing, network-level attacks, or any access beyond the publicly available binary. The findings above represent configuration and bundling choices, not active exploits. Cruise lines should seriously consider a number of measures to plug some of the more easily exploitable gaps in their defenses.
2020 Predictions — Scorecard
How did our 2020 predictions hold up?
Last year's report made six predictions about where cruise app development would go. Here's how each one played out — in an extraordinary year shaped entirely by COVID-19.
8/10
Health & Safety (Communication)
We predicted health reminders and educational tools would be pushed to devices. We're already seeing mobile check-in, health questionnaires, and the ability to watch muster drills via the app — even before most ships have returned to sailing.
6/10
Operational Safety
We predicted physical distancing would be enabled by technology — expedited boarding and e-mustering have appeared as a clear effort to reduce crowd sizes, though device-based contact tracing has largely happened outside the app environment via separate wristbands or fobs.
3/10
Behavioral Changes
We predicted gamification and incentives to drive health survey compliance. That's not how it played out: change is being driven by policy rather than incentives. Passengers must take a health survey or prove vaccination, otherwise they won't be allowed to board.
6/10
Sustainability
We predicted an increase in touchless and digital delivery systems. Digital tickets did not become the norm overnight, but there is a clear indication that several lines will be moving to digital boarding passes and tickets when sailing resumes. Paper's future remains uncertain.
2/10
AI & Virtual Reception
We predicted a large increase in virtual and AI assistants. While AI-powered crash analytics and feedback systems have been added, only one cruise line added any new virtual assistant features. The focus on COVID-related enhancements overshadowed almost all new feature work.
5/10
Cabin Automation
We predicted cabin automation would be back on the table. While cruise lines are experimenting with this technology, the costs involved in physical automation systems (specialized doors, motorized drapes, etc.) are difficult to justify. However, digital vendors are offering fairly easy access to app-based TV remotes and climate controls.
Looking Ahead — 2022
Our predictions for next year.
Despite all of the setbacks over the last year, none of the major cruise brands have stood still with their app updates and improvements. Mobile cruise apps are only going to get better. Here's where we think the next year will take the industry.
01
Increased Digital Delivery
We are doubling down on our prediction that more printed materials will go digital. Shore excursion tickets, daily newsletters, receipt slips, and even breakfast ordering menus cost money to print and take time to distribute. These items are ripe for innovation — and the pandemic has only accelerated their digital replacement.
02
Shoreside & Shipboard Convergence
As basic functionality becomes more commoditized across lines, development opportunities remain in two largely unexplored regions: pre-cruise and post-cruise. Most apps focus on operational efficiency and the onboard guest experience. We expect to see more features that engage guests before and after they sail.
03
Digital Mustering for All
Mustering and drills have long been passengers' least favorite activities. The pandemic has allowed some cruise lines and regulators to move to digital versions of safety drills. What was once a pain point for both crews and passengers can now be removed — and we doubt the previous style of muster drill will ever return.
04
A New Era for Push Notifications
Both Apple and Android have released new local push systems. For years, workarounds and hacks enabled onboard chat systems and dining reservation reminders — but little else. Local push means a cruise director could theoretically write a message inside a web console and notify anyone who has opted in, in real time. We expect ship-wide notification features to expand significantly.
05
More Health-Related Changes
There will be continued focus on pandemic-related health measures. Vaccine proof will be required by some lines, and that process will almost certainly be managed through pre-board check-in systems. Expect apps to add functionality for taking photos of vaccine cards and signing updated terms of service agreements. Digital health surveys will also become more sophisticated and integrate directly with onboard EMRs.
Conclusion
Ready for what comes next.
Despite all of the setbacks over the last year, none of the major cruise brands have stood still with their updates and improvements. Almost every application we researched will include health questionnaires and contactless check-in. Contactless check-in has long been a wish-list feature for many cruise lines, and during the pandemic, development teams prioritized these digital check-in systems.
Security is still an issue across many of the applications tested. Combined with some of the outdated security measures seen on shipboard guest networks, it is only a matter of time before a large security or privacy issue makes the news. Cruise lines should seriously consider measures to plug some of the more easily exploitable gaps in their defenses.
The large swings in update frequency between cruise lines are difficult to accurately account for — reduced frequencies may be due to furloughed development teams, budget cuts, or internal release policies. Our conclusion is that while all cruise lines are taking their mobile app strategies seriously, the amount of investment in development varies greatly.
Much of the pandemic-related development has been difficult to predict. The next year of mobile app releases will be exciting to watch, and mobile cruise apps are only going to get better.
Get in touch