CITT

    Scan results

    Chick-fil-A®

    Android

    Chick-fil-A is a mobile ordering and rewards app for the restaurant chain. The app enables users to place orders, manage rewards, make payments, and locate nearby restaurants. It collects extensive personal and behavioral data and shares it with at least 10 third-party companies.

    CITT SCORE
    30
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Loyal customers comfortable with broad data sharing

    Not For: You limit apps that share data with ad and marketing firms

    What It Means For You

    Order history, location, and behavior are shared with analytics, advertising, attribution, and marketing automation companies. User activity is used to target ads and personalize promotions across multiple third-party platforms. Fraud detection and performance monitoring services also receive data about how the app is used.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (6)

    Privacy

    5 total
    3 High
    2 Medium

    Third-Party Risk

    1 total
    1 High

    Third-Party Services

    Analytics companies, Advertising and attribution companies, Crash reporting companies, Performance monitoring companies, Fraud detection companies, Marketing automation companies

    Security Strengths

    • ✓Data encrypted during transmission to servers
    • ✓Supports biometric authentication for security
    • ✓Provides data deletion option according to store listing
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    location
    financial
    ads
    sensitive data
    camera

    Package

    com.chickfila.cfaflagship

    Version

    2025.21.5

    Analysis Date

    Nov 26, 2025

    Classes Analyzed

    42,303

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 0 findings

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 5 findings (3 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    The app collects order history, precise location, and behavioral data including browsing activity, taps, and purchase patterns across sessions.

    Third-Party Data Sharing

    Data is shared with the following categories of companies:

    • Analytics companies
    • Advertising and attribution companies
    • Crash reporting companies
    • Performance monitoring companies
    • Fraud detection companies
    • Marketing automation companies

    Understanding the Scores

    CategoryScore
    Security50/100
    Privacy30/100
    Data Security50/100
    Network Security50/100
    Code Safety50/100
    Data Collection30/100
    Data Sharing30/100
    User Control50/100

    Positive Security Features

    • Fraud detection services are integrated to help protect user accounts and payment transactions.

    Areas for Improvement

    • Reduce the number of advertising and marketing companies that receive personal and behavioral data.
    • Provide clearer controls so users can limit what data is collected and shared with third-party marketing platforms.
    • Restrict location data sharing to only what is needed to show nearby restaurant locations.

    About This Analysis

    This scorecard is based on static analysis of the app binary. Results reflect the version analyzed and may not represent all app behaviors or future updates.

    App Details

    • App Name: Chick-fil-A®
    • Package ID: com.chickfila.cfaflagship
    • Version: 2025.21.5
    • Scan Date: 2025-11-26
    • Platform: Android

    Right of Reply

    Developer not yet contacted