CITT

    Scan results

    Thumbtack: Hire Service Pros

    Android

    When you need to hire a pro for your home project – whether a house cleaner, plumber, roofer, or handyman – Thumbtack helps you find them for free. Hire local pros near you for any project from lawn mowing to home cleaning and design. Search contractors, compare prices and reviews, and chat with pro

    CITT SCORE
    42
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Homeowners comfortable sharing data to book local pros

    What It Means For You

    User activity is monitored by a fraud-detection service that profiles device and behavior. Payment processing runs through Stripe, and the app delivers marketing via Iterable. Data storage practices may leave personal and payment details with less protection than expected.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (10)

    Data Security

    2 total
    1 Critical
    1 High

    Network Security

    1 total
    1 Medium

    Code Security

    4 total
    1 Critical
    1 High
    1 Medium
    1 Low

    Privacy

    2 total
    1 High
    1 Medium

    Third-Party Risk

    1 total
    1 High

    Third-Party Services

    ThreatMetrix, Stripe, Iterable, AWS WAF
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    third party risk
    location
    device fingerprinting

    Package

    com.thumbtack.consumer

    Version

    404.0 (Build 639)

    Analysis Date

    Dec 18, 2025

    Classes Analyzed

    32,728

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 2 findings (1 critical, 1 high)

    Network Security - 1 finding (1 medium)

    Code Safety - 0 findings

    Privacy - 2 findings (1 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    Thumbtack collects information about user device hardware, location, in-app behavior, and booking history. The fraud-detection service ThreatMetrix builds a profile of the device and how users interact with the app. Payment information is handled through Stripe.

    Third-Party Data Sharing

    User data is shared with the following third parties:

    • ThreatMetrix - Device fingerprinting and behavioral profiling for fraud detection
    • Stripe - Payment processing
    • Iterable - Marketing communications and push notifications
    • AWS WAF - Network traffic filtering

    Understanding the Scores

    CategoryScore
    Security38/100
    Privacy52/100
    Data Security25/100
    Network Security75/100
    Code Safety40/100
    Data Collection55/100
    Data Sharing45/100
    User Control60/100

    Positive Security Features

    • No notable positive security practices were identified in this version of the app.

    Areas for Improvement

    • Improve data storage protections - Personal and payment-related information stored on the device lacks adequate safeguards, increasing the risk that this data could be accessed if the device is lost or stolen.
    • Narrow the scope of device profiling - A third-party service collects detailed information about the device and how the app is used; limiting what gets shared would better protect user privacy.
    • Strengthen in-app transparency - User data flows to multiple outside services, and clearer disclosure within the app would give users a better understanding of what they are agreeing to share.

    About This Analysis

    App Details

    • App: Thumbtack: Hire Service Pros
    • Package ID: com.thumbtack.consumer
    • Version: 404.0 (Build 639)
    • Scan Date: 2025-12-18
    • Powered by: canITrustThat

    Right of Reply

    Developer not yet contacted