# River Cruise Mobile Apps — 2025 Annual Report **Publisher:** OnDeck by Sourcetoad **Published:** January 14, 2025 **URL:** https://ondecksoftware.com/cruise-mobile-app-report/2025/ **Contact:** info@ondecksoftware.com --- ## Overview This report is an independent analysis of the six primary guest-facing mobile apps used across major river cruise fleets as of early 2025. OnDeck by Sourcetoad pulled each app apart to document the tools used, features available, technology choices, security posture, and trends shaping the category. This builds on our 2023 report, when we described the river cruise app space as the Wild West. In 2025, things feel more settled. Overall quality, stability, and technical maturity have improved, and a more consistent baseline is taking shape. The gap between River and Ocean cruise apps is beginning to narrow — though River apps remain distinct in ways that matter. The companies behind them are structured differently, their operational needs are simpler, and their passengers have different expectations. ### What's new in 2025 - **More stable apps.** Fewer glaring security issues. More development teams are using crash reporting tools. - **Middleware adoption is up.** More cruise lines are adopting cloud-based middleware to bridge apps and shipboard systems. - **AI is under the hood.** Early signs of artificial intelligence and personalization in the code, even if features haven't surfaced to users yet. - **Accessibility still lacking.** Feature sets remain limited. Accessibility support is often nonexistent, and guest messaging is rare. --- ## Scope & Methodology ### App selection criteria Apps included in this report met all of the following criteria: 1. **Primary guest-facing app.** The main mobile app used by passengers while onboard — not supplemental entertainment apps. 2. **Multi-ship deployment.** Used on at least two ships within a river cruise fleet. 3. **Available on Android and iOS.** Available in both major app stores. Web-based Progressive Web Apps (PWAs) were excluded unless they met all other criteria. 4. **Released before January 14, 2025.** All apps were released and tested before the analysis cutoff date. ### Analysis process 1. **Download applications.** Apps downloaded onto a Samsung S13. Sideloading via Android Package Kit (APK) Tools for region-restricted apps. 2. **Extract APK files.** APKs pulled from device, ensuring correct architectural, density, and language splits for English. 3. **Merge split APKs.** APKEditor used to merge split components into a unified APK when required. 4. **Disassemble APKs.** Apktool disassembled APKs into constituent components for detailed inspection. 5. **Security analysis.** Mobile Security Framework (MobSF) generated comprehensive security and functionality reports. 6. **Version comparison.** Araxis Merge compared Apktool output across old and new versions to identify changes. 7. **Manual diffing.** VS Code used for manual review and diffing when previous versions were unavailable. **Note on split APKs:** One of the most significant challenges this year was the increasing prevalence of split APKs — applications broken into multiple files for specific devices. This requires recombination before analysis can begin, adding complexity and processing time. --- ## The Apps Six apps were analyzed in 2025. Two new entrants (Phoenix Reisen and Vodohod) replaced two apps excluded based on updated scope criteria. ### MyAmaCruise — AmaWaterways - **Released:** October 2017 - **Deployment:** Full fleet - **Technology:** Native (Kotlin/Swift) - **Updates in 2024:** 20 (most active of all reviewed apps) - **Standout feature:** Most frequently updated; strong signal of active development commitment. ### A-ROSA — A-ROSA River Cruises - **Released:** June 2022 - **Deployment:** Full fleet - **Technology:** Native - **Updates in 2024:** 2 - **Standout feature:** Mobile drink ordering — order beverages from anywhere on the ship. ### AvalonGO — Avalon Waterways - **Released:** 2018 (shared codebase with Globus brand apps) - **Deployment:** Full fleet - **Technology:** Native - **Updates in 2024:** 4 - **Standout feature:** Offline GPS navigation for ports of call without Wi-Fi or cellular. ### Phoenix Reisen — Phoenix Reisen - **Released:** 2020 - **Deployment:** Full fleet - **Technology:** Native - **Updates in 2024:** 1 (lowest activity of all reviewed apps) - **Status:** New to the 2025 report. ### Viking Voyager — Viking - **Released:** June 2017 - **Deployment:** Ocean and river fleet - **Technology:** React Native (with Hermes JavaScript engine) - **Updates in 2024:** 9 - **Standout feature:** Art guide — digital guide to onboard artwork with audio commentary. ### Vodohod — Vodohod - **Released:** July 2020 - **Deployment:** Full river fleet - **Technology:** Native - **Updates in 2024:** 3 - **Status:** New to the 2025 report. - **Standout feature:** Guest services chat — real-time messaging with ship administrators. --- ## Features River Cruise app functionality continues to expand, but compared to Ocean counterparts, most still offer a more limited range. Features were categorized into three tiers based on prevalence across the six apps reviewed. ### Common Features (found in most apps) - **Daily Schedule.** A digital version of the onboard daily schedule, including activities, excursions, and meal times. - **Personal Itinerary.** Personalized calendar showing reservations, bookings, and favorites marked by the guest. - **Ship Tracking.** Live ship tracking and route maps are now standard across the majority of reviewed apps. - **Reservations.** Make or manage reservations for dining, shore excursions, or spa services. ### Less Common Features (found in a few apps) - **Check-In.** Pre-boarding tools: document upload, manifest completion, and digital boarding pass. Slower to adopt in River than Ocean apps. - **Push Notifications.** A few apps keep guests informed of schedule changes, special events, or updates. - **Health Questionnaires.** Health screening available in a small number of apps, typically as part of the check-in flow. - **Surveys.** Built-in surveys to collect guest feedback following the voyage. - **Photo Album.** Guests upload photos during the cruise, often with travel notes and social sharing options. ### Stand-Out Features (unique to one or two apps) - **Art Guide (Viking Voyager).** Digital guide to onboard artwork with audio commentary, adding a cultural layer to the cruise experience. - **Mobile Drink Ordering (A-ROSA).** Order beverages from anywhere on the ship for delivery to your location. - **Guest Services Chat (Vodohod).** Built-in chat to communicate with ship administrators in real time. - **Offline GPS Navigation (AvalonGO).** Navigate ports of call without Wi-Fi or cellular — essential for international travelers. --- ## Technology ### Framework distribution (6 apps) | Framework | Apps | Notes | |---|---|---| | Native (Kotlin / Swift) | 4 | Dominant. One blends in Flutter components. | | React Native | 1 | Now includes Hermes JavaScript engine. | | Flutter (cross-platform) | 1 | Growing — 2 apps use Flutter in some form. | | PWA Wrapper | 1 | A shell that loads a website. No native code. | Despite the rise of cross-platform frameworks, many teams continue to favor native technologies for superior performance, offline capabilities, and hardware integration. ### Emerging technology trends in 2025 - **Split APKs.** Most apps now use Split APKs — breaking the application into multiple files optimized for specific devices. Reduces app size and install time, but complicates analysis. - **More feature flags.** One app showed expanded feature flags — toggling functionality without a full app update. Valuable for cruise lines operating multiple ship types from a single codebase. - **Hermes Engine.** The one React Native app now includes Hermes, a JavaScript engine that shifts work to build time. Faster load times, reduced memory, smaller downloads — especially on lower-end devices. - **Webviews still common.** Among native apps, heavy reliance on webviews — headless browsers loading external content inside the app. Common for dynamic content like dining menus and daily schedules. Their use is declining in more advanced apps. --- ## Security ### Summary findings | Finding | Count | |---|---| | Apps installable on vulnerable Android versions | 4 | | Apps with unrestricted activity sharing | 3 | | Apps requesting permission to install other apps | 2 | | Apps with testing artifacts in production releases | 2 | | Apps using SQLCipher AES-256 encrypted databases | 2 | | Apps implementing ProGuard obfuscation | 6 (all) | ### Vulnerabilities & risks - **Vulnerable Android versions.** Four apps can be installed on outdated Android versions lacking modern security protections. - **External storage access.** Multiple apps request permission to read/write external storage, which is accessible to any app on the device. - **Unrestricted activity sharing.** Three apps allow activities to be shared with other applications, potentially leading to data leaks. - **Weak cryptographic hashing.** MD5 — a known weak algorithm susceptible to collisions — raises concerns about data integrity. - **CI/CD concern.** Two apps contained testing artifacts in production releases, indicating manual compilation rather than a structured Continuous Integration/Continuous Deployment pipeline. This increases the risk of data leaks and exposure of backend infrastructure details. ### Positive security practices - **Encrypted local storage.** Some apps use libconceal.so and libconscrypt_jni.so to protect authentication tokens and user data. - **SQLCipher database encryption.** A subset implement SQLCipher — a secure SQLite extension with AES-256 encryption — preventing unauthorized access to stored guest data. - **ProGuard obfuscation.** All six apps implement some level of ProGuard code obfuscation. --- ## Tools & Third-Party SDKs Sixteen third-party Software Development Kits (SDKs), platforms, and services were found embedded across the six apps. | Tool | Found in | Purpose | |---|---|---| | Firebase | 2 apps | Analytics, Firebase Cloud Messaging (FCM) push notifications, performance monitoring (Google) | | Sentry | 2 apps | Real-time crash monitoring with detailed stack traces | | Glide | 2 apps | Image loading library — optimizes scrolling, video playback, and transitions | | TensorFlow | 1 app | Machine learning — possible uses: recommendations, image recognition, document scanning | | SendBird | 1 app | Real-time messaging platform, expanding into AI-powered communication | | Lottie | 1 app | Renders After Effects animations as JSON for smooth, lightweight UI transitions | | Branch | 1 app | Deep linking and attribution — web-to-app navigation | | CleverPush | 1 app | Unified push notifications for web and mobile | | Assa Abloy | 1 app | Full SDK + API documentation present. Would allow guests to unlock cabin doors via phone | | OneTrust | 1 app | Privacy and data governance — cookie consent and GDPR compliance | | PressReader | 1 app | Digital access to global newspapers and magazines | | Zendesk Sunshine | 1 app | Chatbot SDK overridable by a live operator | | WhatsApp API | 1 app | Direct guest messaging through a familiar platform | | Tealium | 1 app | Data orchestration for tag management, customer analytics, and personalization | | Huawei Push Kit | 1 app | Alternative to FCM for Huawei devices where Google services are restricted | | SurveyMonkey | 1 app | Structured guest feedback on dining, spa, and excursions | --- ## Predictions ### Scoring our 2023 predictions | Prediction | Score | |---|---| | New entries (more apps launched) | 10 / 10 — Two new apps (Phoenix Reisen, Vodohod) joined. | | A more predictable maturity | 9 / 10 — River apps share a common baseline. Space is maturing as predicted. | | Shoreside functionality | 8 / 10 — At least half of apps include meaningful pre-cruise check-in functionality. | | Bug tracking & crash detection | 6 / 10 — Progress slower than hoped. Most lines still reactive. | ### Looking ahead: what we expect next 1. **Chatbots will start to appear.** Tools like SendBird and Sunshine Conversations make passenger-facing chat far easier to implement. Well-suited for low-effort questions like "What time is dinner?" 2. **Personalization & recommendations.** Modern cloud platforms offer embedded recommendation engines and real-time segmentation, making suggested excursions and targeted promotions feasible. 3. **Ocean features will trickle down.** Wishlisting events, guest-to-guest and guest-to-crew messaging, and accessibility tools like font scaling and screen reader support are low-effort additions that will become standard. 4. **Smarter shore excursions & dining.** Shore excursion and dining modules are prime AI candidates: surfacing relevant excursions, notifying guests of last-minute availability, and customizing menus by dietary preference. 5. **Middleware will matter more.** With Starlink improving connectivity, the real limiting factor isn't bandwidth — it's data architecture. Cloud middleware will become the critical enabler of always-available functionality. 6. **Security & privacy will advance.** As apps store more sensitive data, expect broader adoption of OneTrust, SQLCipher, and modern CI/CD pipelines to reduce accidental leaks. --- ## Conclusion The 2025 River Cruises App Report shows an industry that is steadily maturing. The inconsistency and experimentation we saw in earlier reports is starting to fade, replaced by more predictable improvements and a clearer sense of direction. The basics are largely in place. Every app offers a digital daily program and personal schedule. Most support reservations. Push notifications are becoming more common. Crash reporting and performance monitoring are showing up in more apps. Security has improved, with more thoughtful use of ProGuard, some encrypted local storage, and a handful of apps implementing SQLCipher. But progress is still cautious. None of the apps made a major leap forward this year. Most improvements optimize what already exists. What's more interesting is what's starting to appear under the hood. AI libraries like TensorFlow and messaging platforms like SendBird are now embedded in some apps. Chatbots, basic recommendations, and smarter workflows for dining and shore excursions aren't science fiction anymore — they're on deck, waiting for teams to use them. Two years ago, we said this space was still in its Wild West phase. That's no longer true. Things are settling. The question is who's going to make the next bold move. We'll be watching. --- ## About OnDeck by Sourcetoad OnDeck has specialized in innovative guest-facing software for the cruise and ferry industry since 2010. Our mission is to increase the value of both the guest's and the crew's time by building automation, communication, and self-service systems. **Products:** - OnDeck Mobile App — check-in, boarding passes, dining & spa booking - OnDeck iTV — in-cabin interactive TV, folio access, room service - OnDeck Smart Signage — fleet-wide digital signage, GPS & weather triggered - ECS (Electronic Communication System) — silent, workflow-based passenger messaging - Cruise Director Platform — shoreside sync, IoT, ship-to-shore middleware **Contact:** info@ondecksoftware.com **Website:** https://ondecksoftware.com **Address:** 2901 W Busch Blvd #1018, Tampa FL 33618 **Phone:** +1-888-801-TOAD