CITT

    Scan results

    Cooklist: Pantry & Cooking App

    Android

    The best all-in-one system for pantry inventory, recipes, shopping lists and grocery price comparison. Connects to grocery loyalty cards, automatically imports purchases into a digital pantry, and matches recipes to ingredients you have on hand.

    CITT SCORE
    32
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Home cooks comfortable with broad data sharing

    Not For: You keep grocery and meal habits private

    What It Means For You

    Cooking habits, pantry contents, and in-app activity are shared with Facebook, Mixpanel, and Google Analytics for advertising and behavioral tracking. Purchase history is processed by multiple billing and attribution services. Users have limited control over what is collected or how long it is retained.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (16)

    Data Security

    3 total
    2 Critical
    1 High

    Network Security

    3 total
    1 Critical
    1 High
    1 Medium

    Code Security

    5 total
    1 Critical
    1 High
    1 Medium
    2 Info

    Privacy

    5 total
    2 Critical
    2 High
    1 Medium

    Third-Party Services

    Mixpanel, Firebase Analytics, Facebook SDK, Sentry, Google Analytics, RevenueCat, Google Play Billing, Amazon IAP, Google Sign-In

    Security Strengths

    • ✓WebView file access disabled
    • ✓WebView SSL errors properly rejected
    • ✓WebView mixed content blocked
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    food
    recipes
    shopping
    subscriptions
    social
    ads
    sensitive data

    Package

    com.cooklist.android

    Version

    1.105.3 (Build 256)

    Analysis Date

    Jan 21, 2026

    Classes Analyzed

    15,472

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (2 critical, 1 high)

    Network Security - 3 findings (1 critical, 1 high, 1 medium)

    Code Safety - 0 findings

    Privacy - 5 findings (2 critical, 2 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    Pantry inventory, meal plans, and shopping lists are stored remotely. In-app behavior, including which recipes are viewed, how frequently the app is opened, and how long is spent on each screen, is captured by multiple analytics services. Subscription and purchase history is processed by three separate billing services. Account identity is handled through Google Sign-In.

    Third-Party Data Sharing

    Activity and account data is shared with nine third-party services:

    • Facebook SDK - behavioral data used for ad targeting across the Facebook network
    • Mixpanel - detailed event-level behavioral analytics
    • Google Analytics - usage and engagement tracking
    • Firebase Analytics - session and event tracking
    • Sentry - crash and error diagnostics
    • RevenueCat - subscription lifecycle and purchase management
    • Google Play Billing - payment processing
    • Amazon IAP - payment processing
    • Google Sign-In - account authentication

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy30/100
    Data Security25/100
    Network Security35/100
    Code Safety45/100
    Data Collection35/100
    Data Sharing40/100
    User Control25/100

    Positive Security Features

    No notable positive security practices were identified in this version of the app.

    Areas for Improvement

    • User data is shared with nine third parties, and the app provides no clear mechanism to limit, pause, or opt out of that sharing.
    • Data sent between the device and the app's servers does not consistently apply strong protections, meaning user data travels with less protection than expected under certain network conditions.
    • There is no visible way for users to request deletion of account data or review what has been collected.

    About This Analysis

    This scorecard reflects the security and privacy posture of the version analyzed. Scores may not reflect changes introduced in updates released after the scan date.

    App Details

    FieldValue
    App NameCooklist: Pantry & Cooking App
    Package IDcom.cooklist.android
    Version1.105.3 (Build 256)
    Scan Date2026-01-21

    Right of Reply

    Developer not yet contacted