myAmaCruise
Released 2019 — full fleet
2023 Annual Report — Inaugural River Edition
River Cruise Mobile Apps
River Cruise Mobile Apps
2023 Annual Report
For the first time, we turned our lens on the river cruise segment. Six guest-facing apps, pulled apart to document the features, technology choices, and security practices shaping a category just finding its footing.
0
Apps analyzed
0
Tools catalogued
0
Edition
Introduction
The Wild West has arrived.
Sourcetoad has been producing the Cruise Mobile Apps Annual Report since 2019. In previous years we focused on the ocean segment — there are more apps, more features, and more of our clients operate in that space. But that changes now.
River cruise mobile apps are all over the board. Apps range drastically in terms of features, quality, security, design, and philosophy. This diversity stems from the unique ownership structures, operational realities, and passenger demographics that define river cruising.
The result: an industry still in its Wild West days, with enormous room for improvement — and enormous opportunity for whoever moves first.
Why rivers? Why now?
A category finding its footing
Only a handful of river apps exist, but they're wildly different — making this the most interesting new space to watch.
Diverse ownership structures
River lines are owned privately, as hotel chain subsidiaries, as tour-group offshoots — each with different technology mandates.
Connectivity challenges
River ships face unique Wi-Fi issues. Some could use web apps where ocean ships can't; many have aging network infrastructure.
Ocean apps are maturing
Ocean apps have become more homogeneous. Rivers is where things are still interesting and unpredictable.
Scope
How we chose the apps.
We focused on mobile apps designed for river cruise passengers that met all of the following criteria:
Primary guest-facing app
The main app passengers use while onboard — not crew apps, entertainment apps, or marketing brochures.
Multi-ship deployment
Used on at least two ships within a river cruise fleet.
Downloadable on Android and iOS
Available in both major app stores. Web-only apps were excluded.
Released before December 10, 2022
All apps were available and tested before the analysis cutoff date.
Have an app or feature you'd like included in a future report? Contact us at appreport@sourcetoad.com
Methodology
Where the data comes from.
Data and information were collected from a number of sources:
1
VirusTotal / MobSF Analysis
Static security reports generated for each application using industry-standard mobile analysis tooling.
2
App Decompilation
APKs decompiled with Apktool to inspect embedded libraries, SDKs, and configuration files.
3
First-Hand Use
Apps installed and used on physical devices where access was available.
4
Industry Discussions
Conversations with cruise industry professionals, app store reviews, articles, and demonstration videos.
About OnDeck
Who made this report.
OnDeck by Sourcetoad specializes in innovative guest-facing software for the cruise and ferry industry. Our teams based in Tampa, Florida and Perth, Australia have been building software for cruise ships and hotels for over a decade.
Our technology solves complex functionality issues both onboard and on shore, making operations easier for staff and delighting passengers.
Products & Services
- Cruise Director PlatformShoreside and shipboard middleware, ship-to-shore sync, IoT, analytics.
- Mobile App-in-a-BoxWhite-label guest app: digital check-in, boarding passes, dining, folio management.
- OnDeck iTVIn-cabin interactive TV with live TV, on-demand, and room-service booking.
- OnDeck Smart SignageFleet-wide digital signage, dynamically triggered by GPS, weather, or port.
- ECSSilent, workflow-based passenger notification system.
- Digital SurveyPre-, during-, and post-cruise guest feedback.
- Push NotificationsFull push module for mobile and iTV.
Mobile App
Check-in, boarding passes, dining & spa booking.
OnDeck iTV
In-cabin interactive TV, folio access, room service.
Smart Signage
Fleet-wide digital signage, GPS & weather triggered.
ECS
Silent, workflow-based passenger messaging.
Cruise Director
Shoreside sync, IoT, ship-to-shore middleware.
Integrations
MXP, Otalio, Adobe AEM, OneSpaWorld, Twilio.
Mobile Applications
Six apps. One very new category.
Of the six apps analyzed, all but one contain a very limited selection of features compared to ocean cruise apps or other travel and hospitality applications — and each one is remarkably different from the others.
American Queen Voyages
Released 2020 — full fleet
A-Rosa
Released May 2022 — full fleet — newest
AvalonGO
Released 2018 — Globus shared codebase
Belmond
Belmond Ltd.
Released 2020 — fleet + hotels
Viking Voyager
Released June 2017 — shared with ocean fleet
Update Frequency
App store updates in 2022.
Regular updates signal active development teams fixing bugs and responding to user feedback. A-Rosa launched mid-2022, explaining zero updates. Viking's count is elevated because the app is shared with its ocean fleet — a much broader product.
myAmaCruise
3
American Queen Voyages
2
A-Rosa (launched mid-2022)
0
AvalonGO
5
Belmond
2
Viking Voyager (shared with ocean)
18
Availability note. Not all river cruise lines offer a dedicated guest-facing mobile app. Several major operators — including Aqua Expeditions, Grand Circle, Tauck, Uniworld, and Vantage — had no qualifying app at the time of this analysis. We predict this will change in the next 12–24 months.
Feature Analysis
What these apps can (and can't) do.
Of the six apps analyzed, all but one contain a very limited selection of features compared to ocean cruise apps. We grouped features into three tiers: Common (most apps have it), Less Common (two to three apps), and Stand-out (unique to one app).
Common Features
5 of 6 apps or more
Digital Travel Guide
Photos and information about ports of call and excursions. Some include audio tours of individual locations.
Dining Information
Hours, menus, images, locations, and attire. Reservation booking is less common.
Itinerary
The guest's personal calendar. Favorited or booked activities appear here throughout the voyage.
Photo Album
Upload photos with social media integrations. Some apps allow pinning to a map or adding notes.
Daily Schedule
The daily newsletter or activity schedule — the main stop for planning each day. Events can usually be added, booked, or marked.
Less Common Features
2–3 of 6 apps
Health Questionnaires
Two apps facilitate passenger health questionnaires and allow uploading COVID-19 vaccination records to streamline check-in.
2 apps
Live Tracking Maps
Real-time tracking of the ship's position and/or bus tracking at destinations for shore excursion groups.
2 apps
Shore Excursion Booking
Research and book shore excursions directly in the app, not just view available options.
2 apps
Stand-Out Features
Unique to 1 app
Art Guide
Viking Voyager includes the Viking Art Guide — audio clips about historical pieces, works of art, and different areas of the ship.
Viking Voyager only
Mobile Ordering
A-Rosa's app allows guests to order beverages to their current location onboard — a first for the river cruise category.
A-Rosa only
Offline Navigation
AvalonGO features GPS navigation that works without Wi-Fi or cell data, so guests can navigate ports of call without connectivity.
AvalonGO only
Feature Matrix
At a glance.
| Feature | myAmaCruise | Am. Queen | A-Rosa | AvalonGO | Belmond | Viking |
|---|---|---|---|---|---|---|
| Travel Guide | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Dining Info | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Itinerary | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Photo Album | ✓ | ✓ | ✓ | ✓ | — | ✓ |
| Daily Schedule | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Health Questionnaire | ✓ | ✓ | — | — | — | — |
| Live Tracking Map | — | — | ✓ | ✓ | — | — |
| Shore Excursion Booking | — | — | — | ✓ | — | ✓ |
| Art Guide | — | — | — | — | — | ✓ |
| Mobile Ordering | — | — | ✓ | — | — | — |
| Offline GPS Navigation | — | — | — | ✓ | — | — |
Technology Stacks
Native dominates, but cross-platform is creeping in.
One of the more surprising uniformities we found: five of the six apps are native, using Kotlin or Java for Android and Swift or Objective-C for iOS. Given that developers now have many more cost-effective cross-platform options, this was unexpected — especially for smaller development groups.
6Apps
Native (Kotlin/Java, Swift/Obj-C)5
React Native1
Native (Android + iOS)
5 of 6 apps
Kotlin or Java for Android; Swift or Objective-C for iOS. The dominant approach across the river cruise category, despite the availability of cheaper cross-platform alternatives.
React Native
1 of 6 apps
Facebook's cross-platform framework. The only cross-platform representative in this year's river segment — though it's becoming more common in ocean apps.
Flutter Components
1 app (partial)
One native app contained embedded Flutter components — suggesting the development team is experimenting with, or gradually migrating toward, Google's cross-platform framework.
WebViews
Common pattern
Among the native apps, the most common architectural pattern is a heavy reliance on WebViews — headless browsers embedded inside the app to display dynamic content like menus and newsletters.
WebView trade-offs. WebViews save development time and cost for highly dynamic content, but they tend to break up the feel of the app and can produce errors that are difficult to track. This pattern is seen less and less in larger, more mature ocean applications.
Noteworthy Detail
Hermes: React Native's speed boost.
The one React Native application in our analysis is using Hermes, Meta's JavaScript engine optimized for React Native. Hermes moves more of the work done by an app to build time rather than runtime, meaning more of the app is pre-compiled.
The result: faster startup, faster execution, and smaller download sizes. Depending on app complexity, adopting Hermes can represent a fair amount of development work — but the performance gains are meaningful for passengers on slow ship networks.
Why this matters
Faster cold launch
Pre-compiled bytecode loads faster than interpreting JavaScript at runtime.
Smaller download
Bytecode is more compact than raw JS source, reducing APK size.
Lower memory use
Less work at runtime means less RAM pressure on older devices guests bring onboard.
Security Analysis
Security is where investment is needed most.
A disturbing number of the applications examined had little to no authentication on API requests, and several leaked test and debug artifacts into their production builds. The river cruise category has meaningful security debt to pay down.
High Risk
Unauthenticated API requests
At least two applications showed little to no authentication on API requests. This could allow malicious actors to submit false requests or intercept guest requests — exposing passenger data and enabling system manipulation.
Test artifacts in production builds
Two cruise lines shipped production builds that contained artifacts from development and testing — test documentation with sensitive data, API endpoints, debug configuration, or backend system information. This strongly suggests teams are building production releases directly from a developer's local machine rather than through a CI/CD pipeline, opening the door to human error and accidental data leaks.
Medium Risk
AssaAbloy SDK bundled with full API documentation
One application contained the full AssaAbloy Global Solutions Marine SDK — including the complete API documentation. The SDK would theoretically allow a passenger to use their phone as a gangway access card or cabin door key. It's unclear whether this feature actually works onboard, or whether it was inherited from another codebase, but the full API documentation should never ship in a production app.
Absence of crash detection and bug tracking
The majority of apps showed no crash detection or bug reporting tooling. Without tools like Sentry or Instabug, development teams have no visibility into production crashes or performance regressions. Only one app used a proper crash monitoring tool. Given the challenging onboard environment — variable connectivity, diverse device models — this is a significant blind spot.
Positive Practices
Cryptography at the OS level
Two apps were found to be using OS-level cryptography via the libconceal.so and libconscrypt_jni.so libraries — storing secrets in the device keychain/enclave. This is best practice for persisting small sensitive values like authentication tokens or usernames between sessions.
Sentry crash monitoring
One application is using Sentry for crash monitoring with full stack-trace reporting. This allows developers to be alerted to the specific module — or even the line of code — that caused a crash, and to track performance bottlenecks with real production data. A clear outlier in this year's analysis.
CI/CD gap. The presence of test artifacts in production builds is a strong signal that modern CI/CD pipelines are not in use. Teams building from a local machine risk accidentally including uncommitted files, debug configs, or test data in production releases. Automating the build and release pipeline would eliminate this entire class of error.
Tools & Key Players
The SDKs and services embedded in these apps.
Beyond the app code itself, we identified a range of third-party SDKs, libraries, and services embedded in the six applications — from image handling to door locks to live chat.
Found in 2 apps. Android image loading library — handles smoother transitions, scrolling, and video playback, and efficiently fetches, resizes, and displays remotely-hosted images.
Full SDK + API documentation in 1 app. The leading cruise cabin door lock provider (formerly VingCard). Would allow guests to access the gangway and unlock their cabin via phone — it's unclear if the feature actually works onboard.
Found in 1 app. Advanced crash monitoring with full stack-trace reporting. Alerts developers to the specific module or line of code that caused a crash, and monitors function performance with real production data.
Found in 1 app. White-label journey sharing — passengers add photos and journal entries to itinerary items, stored or shared with friends and family via social media.
Found in 2 apps. libconceal.so and libconscrypt_jni.so for OS keychain/enclave storage — securely persisting small secrets like auth tokens or usernames between sessions.
Found in 1 app. Meta's JavaScript engine for React Native — pre-compiles JS at build time rather than runtime, resulting in faster startup, smaller download sizes, and lower memory usage.
Found in 2 apps. Google's open-source PDF rendering toolkit, used for displaying daily newsletters, compasses, and restaurant menus directly inside the app.
Found in 1 app. Google's ML toolkit for mobile — used not for machine learning, but for its QR code and barcode scanner. Likely scanning excursion tickets or digital menus onboard.
Found in 1 app (OnDeck's survey module in another). Online and offline survey platform for collecting guest feedback on dining, spa, shore excursions, or health questionnaires.
Found in 1 app. OnDeck by Sourcetoad's own survey module — online and offline surveys for pre-cruise, onboard, and post-cruise guest feedback. One of the few OnDeck products found in a third-party app.
Found in 1 app. Chatbot SDK that can be handed off to a live operator via the Zendesk platform. Requires stable internet — most likely monitored by shoreside staff rather than onboard crew.
Looking Ahead
What we expect to see next.
Predicting what the river cruise app category will look like in the next 12–24 months is bold. We're doing it anyway.
01
New entrants will arrive
American, Aqua, Grand Circle, Tauck, Uniworld, and Vantage are among the river lines without a qualifying mobile app. The barriers are getting smaller every day. We predict one or two new river cruise apps will launch in the next year.
02
Shoreside functionality will emerge
Almost none of the apps allow digital check-in or shoreside booking. Pre-cruise functionality was one of the most-requested features in user reviews. Digital check-in will be the first to market — shoreside booking is a year or more out given integration complexity.
03
Crash detection will become standard
We predict wide adoption of crash detection tools like Sentry or Instabug in next year's applications. Their absence was one of the biggest surprises in our research. They're easy to integrate and take little time to monitor — there's no good reason not to have them.
04
The category will follow the ocean path
Ocean apps took radically different paths before converging on a more homogeneous baseline. River apps will do the same — but probably faster, using the ocean space as a roadmap. Less exciting, more predictable, and ultimately better for guests.
Conclusion
The Wild West — for now.
The River Cruise Mobile App space is clearly still in its early stages. Unlike the ocean cruise apps, river apps are all over the board in terms of features, security, and quality. As a result, it is almost impossible to identify any large trends in the market.
Security is the first area requiring serious investment. A disturbing number of applications had little to no authentication on API requests, and test artifacts shipped into production are a solvable problem with basic CI/CD discipline.
Operationally, the issues are different. Reviews point to a lack of crew engagement with the systems that support the app — daily schedules not updated, itinerary changes not reflected. These are often manual processes, not app problems. But guests don't care about the distinction.
Managing guest expectations would also go a long way. Reviews are littered with complaints that certain apps only work onboard, or that reservations can't be changed via the app. A clear message about what the app does — and doesn't do — would improve perceived value significantly.
Most river lines don't yet prioritize their mobile apps the way ocean lines do. But passenger expectations are evolving, and demographics are shifting. The river cruise mobile app space is still very much in the Wild West days of its existence — which means challenges ahead, but also enormous opportunity for whoever moves first.
Stay tuned. This is going to be a more interesting space to watch over the next two years than the ocean cruise segment. We'll see you in 2025.