Hello fellow socially responsible beer drinkers. I've using the Untappd app for a long time now (3.7k check-ins and counting) but just more recently had the chance to extract my own device for some fun testing. I was curious what the app was tracking on the device side since I already knew it didn't function in airplane mode and required network connectivity to function. What I found wasn't all too surprising but could be helpful for investigations.
There were a few files of interest that I keyed in on:
User Profile
Starting with the profile, there was a SQLite database call clevertap found in the databases folder at path:
data/data/com.untappdllc.app/databases/clevertap*
I will caveat that this file may or may not exist based on some analysis on a secondary test device. The table of interest is "userProfiles" and the column "data" is JSON, which makes parsing easy. Keys of interesting include:
- Name - name of the user, can be just a first name or full first and last
- Username - username set by the user
- Email - email address of the account
- Gender - M for Male, F for Female, for "Prefer not to say"
- dob - the user's selected date of birth, Unix in seconds from 1 January 1970
- last_checkin_beer - name of the last checked in beer
- last_checkin_category - category of the beer last checked in
There a bunch of boolean key/values for push notifications but I will exclude them from this for now.
App Events & Device Analytics
Another database file that may or may not exist is the superwall_database, another SQLite database found at:
data/data/com.untappdllc.app/databases/superwall_database*
It's intended purpose is for monetization analytics but it also servers a purpose of having device specific information. The table of interest is "ManagedEventData". We get 3 columns of useful information:
- createdAt - Unix epoch timestamp in milliseconds
- name - category of event types including, app_install, app_launch, app_close, app_open, device_attributes and more
- parameters - JSON formatted information related to the name categories
Figure 1: app events info from superwall_database
For the device attributes one is where it gets interested. Here we see approximate device locations by IP included information about the device such as the OS type and version, app version, what type of network the device was on at the time.
Figure 2: device_attributes info from superwall_database
You can see I was traveling up the East coast last summer.
Cache, Cache, and more Cache
From what I could see, Untappd does a good job of not storing too much on the local device but there is one cache location that has a bunch of API call type records. The folder is found at path:data/data/com.untappdllc.app/cache/http-cache
The files with the ".1" extension seem to the important files. They are gunzip compressed JSON files that mostly match the API documentation Untappd provides.
Discover Locations
When you load the app, if you've allowed the app to use location permissions, then the default "home" screen is the Discover page.
Figure 3: Discover page in Untappd
What this provides you from a user perspective is a location map of places you can visit near you. It also provides Upcoming Events nearby as well as Nearby Places.
From a forensic side of the house, we can see these queries in the cache. Under the "discover_items" key we see two different item types, "home_screen_title" and "local_badges" (this is another category below the Nearby Places). From what I could tell, the latitude and longitude coordinates were the same for each time the page was loaded.
While it doesn't contain timestamps of when those coordinates were loaded in the JSON itself, we can pull in the metadata information from the correlated metadata file with the same name as the source just a .0 extension
Figure 4: Discover page location coordinates in cache
These coordinates align with Front Street Brewing when I was at TechnoSec conference in 2025 in Wilmington, North Carolina. I most likely was loading the app to checkin a beer.
Cached Checkins
Some of the JSON entries were related to checkins that occurred. Under the "response" key was "checkin", which included the timestamp of when the event occurred, the user's name and info of who checked it in, the information about the beer, and any venue information if it was included in the checkin. If the user uploaded a photo there are URL paths to those as well.
Figure 5: Cached beer checkin
This not only can give location of a user but also some insights into surroundings if a picture was captured.
Checkin Location Suggestions
When checking in a beer you can select a location for the checkin. If you had previously tagged a location these could popup as an option as well as the app utilizes your location information to query Foursquare for nearby locations (businesses/restaurants/etc.). Foursquare entries don't have timestamps but we can pull the cached metadata timestamp to correlate when these suggestions were queried. Recent checkin locations will have the cached metadata timestamp as well as a timestamp associated with when the checkin occurred (these seem to be hit or miss as some had the same timestamp as the cached record itself so verification is necessary to rely on these).
response > recent > items
response > foursquare > items
Figure 6: sampling of Foursquare suggested locations parsed in LAVA
This just shows more current location information and timestamps to add to the timeline of usage.
Based off the API documentation from Untappd, there is potential for more events to be found such as items related to friends and comments but I haven't gotten enough test data to generate those at this time. I will update if I can generate some.
Push Notifications
Push notifications can be turned on for a bunch of different alerting in the app. You can turn on specific notifications for a venue's menu updates, in stock notifications for certain beers, and then all the normal notifications such as someone commented or toasting one of your checkins. From what I saw on my own device these items lived in an XML file at the following path:
data/data/com.untappdllc.app/shared_prefs/io.invertase.firebase.xml
The XML file contains JSON formatted entries that include:
- title - category of the notification
- body - content of the notification
- pushType - type of push the notification is
I'm not quite sure what some of the fields indicate but we can see the messageId (also shown the main key) contains a Unix epoch timestamp.
Figure 7: io.invertase.firebase.xml entries
Closing Time
This is just a sampler (a taster if you will) of items that I've found so far. As I consume a few more beers hopefully I can generate more test data for analysis.
Figure 8: LAVA report
As always, the parsers are now part of ALEAPP, cheers!