CITT

    Scan results

    eMAG онлайн пазаруване

    Android

    eMAG.bg is Bulgaria's leading e-commerce platform offering electronics, appliances, gadgets, toys, books, music, movies, clothing and accessories. The app provides convenient shopping with fast delivery, extended warranties, cash on delivery options, 30-day returns, and access to order history and i

    CITT SCORE
    50
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Online shoppers comfortable with targeted advertising

    Not For: You want to limit ad tracking across platforms

    What It Means For You

    Browsing and purchase activity is shared with advertising networks including Facebook, TikTok, Criteo, and RTB House for ad targeting. AppsFlyer tracks app usage and links it to ad campaigns across platforms. Data reaches nine third-party services in total.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (17)

    Data Security

    3 total
    1 Critical
    1 High
    1 Medium

    Network Security

    7 total
    1 High
    5 Medium
    1 Low

    Code Security

    3 total
    1 High
    1 Medium
    1 Low

    Privacy

    4 total
    1 High
    1 Medium
    2 Low

    Third-Party Services

    Firebase Analytics, Facebook SDK, AppsFlyer, Criteo, TikTok Business SDK, RTB House, Google Mobile Ads, Salesforce Service Cloud, Parse SDK

    Security Strengths

    • ✓No SSL/TLS certificate validation bypass
    • ✓Android backup disabled
    • ✓Comprehensive data cleanup on logout
    • ✓No custom JavaScript interfaces in main WebViews
    • ✓Modern SDK versions with no known CVEs
    • ✓Granular consent management with 9 tracking toggles and remote killswitches
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    ads
    location

    Package

    bg.emag.android

    Version

    4.38.3 (Build 307)

    Analysis Date

    Jan 26, 2026

    Classes Analyzed

    5,418

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (1 critical, 1 high, 1 medium)

    Network Security - 7 findings (1 high, 5 medium, 1 low)

    Code Safety - 0 findings

    Privacy - 4 findings (1 high, 1 medium, 2 low)

    Privacy Concerns

    What Data is Collected

    The app collects device identifiers, in-app browsing behavior, purchase history, and interaction patterns to build a profile of user shopping activity and preferences.

    Third-Party Data Sharing

    User data is shared with nine third-party services:

    • Firebase Analytics - App usage and event tracking
    • Facebook SDK - Behavioral data for ad targeting on Facebook and partner networks
    • AppsFlyer - Attribution tracking that links in-app actions to ad campaigns across platforms
    • Criteo - Retargeting and personalized advertising
    • TikTok Business SDK - Behavioral data for ad targeting on TikTok
    • RTB House - Real-time bidding and ad personalization
    • Google Mobile Ads - Ad delivery and targeting
    • Salesforce Service Cloud - Customer service and support data
    • Parse SDK - Backend data processing

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy55/100
    Data Security35/100
    Network Security60/100
    Code Safety65/100
    Data Collection50/100
    Data Sharing45/100
    User Control75/100

    Positive Security Features

    • None identified in this version.

    Areas for Improvement

    • Data stored on the device by the app may not be fully protected if the device is accessed by someone else.
    • Some network communications use configurations that reduce the protection of data traveling between the device and the app's servers.
    • Behavioral data is shared with four separate advertising and retargeting services, giving multiple companies ongoing insight into user shopping habits.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. Results reflect the app as distributed at the time of the scan.

    App Details

    • App Name: eMAG.bg
    • Package ID: bg.emag.android
    • Version: 4.38.3 (Build 307)
    • Platform: Android
    • Scan Date: January 26, 2026

    Right of Reply

    Developer not yet contacted