CITT

    Scan results

    Carrefour & sa carte Club

    Android

    Carrefour's official shopping app for France offering online and in-store shopping, Drive delivery, home delivery, shopping lists, and integrated loyalty program with personalized offers and deals.

    CITT SCORE
    38
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Carrefour shoppers comfortable with extensive tracking

    Not For: You want to limit your data shared with advertisers

    What It Means For You

    Shopping habits, loyalty activity, and in-app behavior are shared with multiple advertising and analytics companies including AppsFlyer, mParticle, and others. The device can be fingerprinted to track users across apps and services. Network communications are sent with less protection than expected, meaning user data may not be fully protected on public Wi-Fi.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (12)

    Data Security

    2 total
    1 High
    1 Medium

    Network Security

    1 total
    1 Critical

    Code Security

    3 total
    1 Critical
    2 High

    Privacy

    6 total
    1 Critical
    2 High
    3 Medium

    Third-Party Services

    AppsFlyer, Firebase Analytics, ContentSquare, mParticle, OneTrack, Firebase Cloud Messaging, Urban Airship, Rokt, OneTrust, FingerprintJS, AppAuth, Google Maps, Apigee

    Security Strengths

    • ✓Backup disabled (allowBackup=false)
    • ✓Refresh token conditional encryption with AES-256-CBC
    • ✓OneTrust consent management integrated for some SDKs
    • ✓Clean Architecture with MVVM and Hilt dependency injection
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    location
    ads
    social

    Package

    com.carrefour.fid.android

    Version

    22.5.0 (Build 1765465299)

    Analysis Date

    Feb 11, 2025

    Classes Analyzed

    1,000

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 2 findings (1 high, 1 medium)

    Network Security - 1 finding (1 critical)

    Code Safety - 0 findings

    Privacy - 6 findings (1 critical, 2 high, 3 medium)

    Privacy Concerns

    What Data is Collected

    The app collects shopping behavior, loyalty card activity, device identifiers, location data, and in-app interactions. The device is fingerprinted to recognize users across sessions and services.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • AppsFlyer - mobile attribution and advertising analytics
    • Firebase Analytics - behavioral analytics and event tracking
    • ContentSquare - session recording and user experience analytics
    • mParticle - cross-channel customer data aggregation
    • OneTrack - marketing attribution
    • Firebase Cloud Messaging - push notification delivery
    • Urban Airship - push notifications and customer engagement
    • Rokt - advertising and offer targeting
    • OneTrust - consent and privacy management
    • FingerprintJS - device fingerprinting
    • AppAuth - authentication flows
    • Google Maps - mapping and location services
    • Apigee - API management

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy40/100
    Data Security45/100
    Network Security25/100
    Code Safety30/100
    Data Collection50/100
    Data Sharing45/100
    User Control55/100

    Positive Security Features

    • No notable positive security practices were identified in this version.

    Areas for Improvement

    • Network communications are sent with less protection than expected, meaning user data may not be fully protected on public or unsecured networks.
    • Data is shared with a large number of advertising and analytics companies, giving users limited control over how it is used once collected.
    • Device fingerprinting allows user activity to be tracked beyond this app, across other services and platforms.

    About This Analysis

    This scorecard is generated from automated static analysis of the app package. Scores reflect the security and privacy practices observed in the analyzed version.

    App Details

    • App Name: Carrefour & sa carte Club
    • Package ID: com.carrefour.fid.android
    • Version: 22.5.0 (Build 1765465299)
    • Platform: Android
    • Scan Date: 2026-02-11

    Right of Reply

    Developer not yet contacted