'%3e%3cpath%20d='M138%2095.6436V147H0V0H138V51.3564H59.3526V95.6436H138Z'%20fill='white'/%3e%3cpath%20d='M208%200V147H150V0H208Z'%20fill='white'/%3e%3cpath%20d='M361%200V51.4292H321.377V147H261.731V51.4292H220V0H361Z'%20fill='white'/%3e%3cpath%20d='M512%200V51.4292H472.939V147H414.139V51.4292H373V0H512Z'%20fill='white'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_1_12'%3e%3crect%20width='512'%20height='147'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Scan results
Lidl Plus
AndroidLidl Plus is a rewards app designed to give customers discounts on products they love. Activate coupons in the app, scan your digital Lidl Plus Card at checkout to redeem offers and save money, browse digital weekly leaflets, and receive personalized offers based on shopping behavior.
Quick Verdict
Best for: Regular Lidl shoppers who want coupons and receipts
What It Means For You
In-store purchases, location, and shopping habits are linked to the user profile and shared with marketing and analytics partners including Salesforce and Adjust. Users may be tracked across sessions to personalize offers and target ads. OneTrust is present for consent management, giving users some control over data preferences.
Quick Verdict
Best for: Regular Lidl shoppers who want coupons and receipts
What It Means For You
In-store purchases, location, and shopping habits are linked to the user profile and shared with marketing and analytics partners including Salesforce and Adjust. Users may be tracked across sessions to personalize offers and target ads. OneTrust is present for consent management, giving users some control over data preferences.
Method and Limitations
Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.
Findings (15)
Data Security
5 totalNetwork Security
2 totalCode Security
4 totalPrivacy
4 totalThird-Party Services
Security Strengths
- ✓Certificate pinning enforced on all critical endpoints (payments, auth, tickets)
- ✓Backup disabled (allowBackup="false")
- ✓Android KeyStore integration for cryptographic keys
- ✓EncryptedSharedPreferences used by Salesforce SDK
- ✓OneTrust consent management SDK integrated
Version diff is on the Developer plan. See developer plans.
Context Tags
Package
com.lidl.eci.lidlplus
Version
16.46.4 (versionCode: 1470409272)
Analysis Date
Mar 25, 2026
Classes Analyzed
16,821
Was this analysis helpful?
Feedback helps us improve our analysis
Recommendation: Trustworthy
Key Findings
Data Security - 5 findings (1 high, 1 medium, 3 info)
Network Security - 2 findings (2 info)
Code Safety - 0 findings
Privacy - 4 findings (2 high, 1 medium, 1 low)
Privacy Concerns
What Data is Collected
The app collects location data, purchase history, shopping behavior, and device identifiers. This data is linked to the user account profile and used to personalize offers and in-store experiences.
Third-Party Data Sharing
User data is shared with multiple third-party services:
- Salesforce Marketing Cloud - Marketing engagement and customer messaging
- Adjust - Advertising attribution and mobile analytics
- Firebase - App analytics and performance monitoring
- ThreatMetrix - Device risk and fraud assessment
- Huawei Mobile Services - Platform services for Huawei devices
- AltBeacon - In-store proximity detection
- Google Maps - Store location and mapping features
- Google ARCore - Augmented reality features
- OneTrust - Consent and privacy preference management
Understanding the Scores
| Category | Score |
|---|---|
| Security | 88/100 |
| Privacy | 78/100 |
| Data Security | 85/100 |
| Network Security | 100/100 |
| Code Safety | 97/100 |
| Data Collection | 80/100 |
| Data Sharing | 100/100 |
| User Control | 78/100 |
Positive Security Features
- All network communications are secured, with no insecure traffic configurations detected
- The app code meets high safety standards, with minimal risk from code-level attacks
- Secure, standard authentication flows are used via AppAuth
- Consent management through OneTrust gives users options to review their data preferences
Areas for Improvement
- Some data stored locally on the device has limited protection, which could allow other apps to access it on a compromised device.
- Behavioral and location data is shared with advertising partners, but the app provides limited visibility into how that data is used after it is shared.
- Options for reviewing, exporting, or deleting personal data could be more accessible and clearly communicated within the app.
About This Analysis
This scorecard reflects analysis of the app's code and configuration. It covers practices observable in the app package and does not account for server-side behavior.
App Details
- App Name: Lidl Plus
- Package ID: com.lidl.eci.lidlplus
- Version: 16.46.4 (build 1470409272)
- Scan Date: 2026-03-25
- Platform: Android
Right of Reply
Developer not yet contacted