CITT

    Scan results

    Etsy: Shop Home, Style & More

    Android

    Etsy is a global marketplace for original handmade items, vintage treasures, personalized jewelry, and custom home decor. Shop from millions of unique products from small sellers worldwide, track orders, and chat with merchants.

    CITT SCORE
    82
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Shoppers comfortable with ad and analytics tracking

    What It Means For You

    Browsing, search, and purchase activity is shared with over a dozen third parties including Facebook, AppsFlyer, Braze, and FullStory, which record in-app behavior and use it for ad targeting. Shopping habits and engagement patterns feed into marketing and attribution networks. Payment processing runs through Stripe.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (19)

    Data Security

    2 total
    2 Critical

    Network Security

    2 total
    1 High
    1 Medium

    Code Security

    8 total
    1 Critical
    3 High
    3 Medium
    1 Info

    Privacy

    6 total
    1 Critical
    3 High
    1 Medium
    1 Info

    Third-Party Risk

    1 total
    1 High

    Third-Party Services

    FullStory, AppsFlyer, Branch.io, Button Merchant SDK, Facebook SDK, Braze, Rokt, Firebase, Google Play Services, Zendesk, Qualtrics, Stripe, Bugsnag, DataDome, Transcend

    Security Strengths

    • ✓OAuth tokens encrypted with AES256-GCM + Android Keystore
    • ✓Code obfuscation applied (ProGuard/R8)
    • ✓Room database prevents SQL injection
    • ✓HTTPS enforced, cleartext traffic disabled
    • ✓Certificate pinning implemented
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    e-commerce
    shopping
    financial
    social
    sensitive data
    location
    camera
    contacts
    ads
    analytics
    tracking

    Package

    com.etsy.android

    Version

    7.51.1

    Analysis Date

    Jan 21, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Acceptable

    Key Findings

    Data Security - 2 findings (2 critical)

    Network Security - 2 findings (1 high, 1 medium)

    Code Safety - 0 findings

    Privacy - 6 findings (1 critical, 3 high, 1 medium, 1 info)

    Privacy Concerns

    What Data is Collected

    Etsy collects browsing history within the app, search queries, items viewed and saved, and purchase history. Device identifiers and usage patterns are gathered to personalize the user experience and support advertising and analytics.

    Third-Party Data Sharing

    User activity is shared with more than a dozen third-party services:

    • FullStory - records in-app sessions and interactions for behavioral analysis
    • AppsFlyer - tracks installs and in-app events for advertising attribution
    • Facebook SDK - connects shopping behavior to Facebook's ad targeting network
    • Braze - delivers personalized push notifications and in-app messaging
    • Branch.io - handles cross-channel linking and install attribution
    • Button Merchant SDK - tracks affiliate commerce activity
    • Rokt - serves targeted offers based on transaction context
    • Firebase / Google Play Services - analytics and app infrastructure
    • Zendesk - customer support interactions
    • Qualtrics - collects feedback through in-app surveys
    • Stripe - handles payment processing
    • Bugsnag - captures error and crash reports
    • DataDome - bot detection and fraud prevention
    • Transcend - supports privacy compliance and data rights management

    Understanding the Scores

    CategoryScore
    Security85/100
    Privacy80/100
    Data Security80/100
    Network Security90/100
    Code Safety85/100
    Data Collection85/100
    Data Sharing85/100
    User Control90/100

    Positive Security Features

    • Payment processing is delegated to Stripe, a dedicated payment service, rather than handled directly inside the app
    • DataDome provides bot detection and fraud prevention, helping protect user accounts from automated abuse
    • Transcend facilitates privacy compliance, supporting user rights to access or delete personal data

    Areas for Improvement

    • Sensitive data stored on the device, such as saved addresses and shopping preferences, could be better protected against unauthorized access.
    • Some network connections do not apply the strictest available protections, which means data travels with less protection than expected in certain conditions.
    • The number of third parties receiving user behavioral data is large. Tighter controls over what is shared and with whom would improve user privacy.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect observed security and privacy practices at the time of the scan.

    App Details

    FieldValue
    App NameEtsy: Shop Home, Style & More
    Package IDcom.etsy.android
    Version7.51.1
    Scan DateJanuary 21, 2026
    PlatformAndroid

    Right of Reply

    Developer not yet contacted