com.joom.joom Security & Privacy Scorecard

Joom

What This Means for You

Your browsing sessions, including text you type into forms before submitting, are recorded by a session replay tool and sent to Microsoft's servers, and the list of apps installed on your device is collected and linked to your advertising profile even when you decline ad tracking permission.

Recommendation: Use With Caution

A disabled HTTPS enforcement setting combined with a broadly exposed in-app browser bridge creates a path where a network attacker on the same Wi-Fi could trigger actions inside the app. Microsoft Clarity captures session activity including form input before masking takes effect. Use this app on trusted networks only.

Best For: Casual shoppers on trusted networks comfortable with behavioral analytics and multi-SDK tracking

Key Findings

Data Security - 1 finding (1 low)

Network Security - 4 findings (2 medium, 2 info)

Code Safety - 2 findings (2 info)

Privacy - 5 findings (1 medium, 1 low, 3 info)

Privacy Concerns

What Data is Collected

• Personal information: name, email address, account details
• Device information: device identifiers, advertising ID, list of installed apps
• Usage data: browsing behavior, session recordings including form input, click and scroll activity
• Location data: precise location (collected by the PayPal payment component during checkout)

Third-Party Data Sharing

The following third parties may receive your data:

• Microsoft Clarity - session replay including screen recordings and form input
• AppsFlyer - marketing attribution and analytics
• Adjust - marketing attribution with GDPR consent management
• PayPal (PPRiskMagnes) - device fingerprinting for payment fraud prevention
• Facebook - social login, sharing, and advertising measurement
• Klarna - payment processing and checkout analytics
• Google - sign-in and maps
• VKontakte - social login
• OK.ru (Odnoklassniki) - social login
• Yandex - maps

Understanding the Scores

Security: 89/100
Privacy: 87/100

Security Breakdown

• Data Security: 96/100 - Log files could use stronger protection on locked devices, but core data storage is handled responsibly.
• Network Security: 83/100 - HTTPS enforcement is globally disabled, reducing defense-in-depth, though the primary API uses secure connections.
• Code Safety: 100/100 - No unsafe code patterns identified in the app's core logic.

Privacy Breakdown

• Data Collection: 90/100 - Data collection is broad but mostly disclosed; Firebase Analytics is explicitly disabled.
• Data Sharing: 93/100 - Multiple attribution and analytics vendors receive data; dual attribution stack increases sharing surface.
• User Control: 91/100 - GDPR and ATT consent infrastructure is present, though installed-app enumeration bypasses ATT consent.

Positive Security Features

• Restricted certificate authority validation for core API connections using a curated CA bundle
• Firebase Analytics explicitly disabled, reducing behavioral data collection
• Facebook automatic event logging disabled
• Firebase App Check enabled to protect backend services from unauthorized access
• Adjust GDPR consent infrastructure with dedicated consent and withdrawal endpoints
• IAB Transparency and Consent Framework integrated

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Enable Session Recording Masking
   Microsoft Clarity is configured with no form fields masked, meaning typed input is captured before any masking can occur. Configuring field masking by default would reduce exposure of user-entered data.

2. Scope Installed App Tracking
   The list of apps installed on your device is collected and linked to advertising identifiers server-side. Limiting this to opt-in scenarios or removing the link to advertising IDs would better align with user expectations.

Security Enhancements

1. Re-enable HTTPS Enforcement
   Globally disabling Apple's secure transport requirements removes a layer of protection for all connections. Restricting exceptions to only the specific domains that genuinely require them would restore defense-in-depth.

2. Restrict In-App Browser Script Access
   The bridge that connects in-app browser content to native app actions is currently available regardless of which website is loaded. Restricting access to known trusted origins would contain the risk from pages loaded over unprotected connections.

Technical Context

App Type: Social marketplace with integrated payment processing (high sensitivity)
Classes Analyzed: iOS binary analysis
Third-Party Services: 14 identified
Context Tags: shopping, ads, location, payments, social, analytics, session_replay

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Joom
Version: 5.10.0 (Build 16426)
Analysis Date: 2026-04-17
Package: com.joom.joom

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 5.10.0 (Build 16426) analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors