CITT

    Scan results

    Wallapop - Sell & Buy

    Android

    Wallapop is a free peer-to-peer marketplace app for buying and selling secondhand products. Join 15+ million users trading items locally or shipping nationwide. Promotes sustainable consumption through a circular economy model with secure encrypted payments and buyer/seller protection guarantees.

    CITT SCORE
    48
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Casual buyers and sellers comfortable with ad tracking

    Not For: You avoid Facebook and ad-network data sharing

    What It Means For You

    Activity, browsing, and purchase behavior is shared with multiple ad and analytics companies including Facebook, Adjust, and LiveRamp to build profiles and target ads. Data flows through at least six tracking services spanning behavioral analytics, advertising, and data brokering.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (18)

    Data Security

    8 total
    1 Critical
    3 High
    4 Medium

    Network Security

    1 total
    1 High

    Code Security

    4 total
    1 High
    1 Medium
    2 Low

    Privacy

    4 total
    1 Critical
    1 High
    2 Medium

    Third-Party Risk

    1 total
    1 Medium

    Third-Party Services

    Adjust, mParticle, Braze, Amplitude, Rudderstack, Firebase Analytics, LiveRamp ATS, Facebook Ads, Stripe, Klarna, Google Pay, Facebook SDK, Google Sign-In, Google Maps, SQLCipher

    Security Strengths

    • ✓Strong cryptography (AES-256, SecureRandom, no weak algorithms)
    • ✓Heavy code obfuscation (Pairip VM + ProGuard/R8)
    • ✓Play Integrity API for app integrity verification
    • ✓Room ORM prevents SQL injection
    • ✓No session recording SDKs detected
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    e-commerce
    sensitive data
    location
    camera
    ads
    social
    payments

    Package

    com.wallapop

    Version

    Not specified in header

    Analysis Date

    Jan 21, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 8 findings (1 critical, 3 high, 4 medium)

    Network Security - 1 finding (1 high)

    Code Safety - 0 findings

    Privacy - 4 findings (1 critical, 1 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    Wallapop collects in-app browsing and search activity, items viewed and saved, purchase and listing history, device identifiers, and behavioral patterns that build a persistent profile tied to the account across sessions.

    Third-Party Data Sharing

    Data is routed to multiple external companies across several categories:

    • Advertising: Facebook Ads, LiveRamp ATS (data brokering)
    • Behavioral analytics: Adjust, Amplitude, mParticle, Rudderstack
    • Engagement and messaging: Braze
    • App analytics: Firebase Analytics

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy50/100
    Data Security40/100
    Network Security65/100
    Code Safety70/100
    Data Collection60/100
    Data Sharing65/100
    User Control55/100

    Positive Security Features

    • Payment processing is delegated to established providers (Stripe, Klarna, Google Pay) rather than handled in-app directly, meaning payment details are managed by dedicated financial services with their own security standards.
    • Google Sign-In is offered as an authentication option, removing the need to create and store a separate password with the app.

    Areas for Improvement

    • Behavioral data is shared with a large number of advertising and analytics companies, including data brokers. Reducing the number of third-party integrations would give users more control over where that information goes.
    • Personal data storage and protection within the app scores lowest of any category, with the highest concentration of severe findings.
    • The app offers limited privacy controls, leaving users with little ability to restrict behavioral tracking or opt out of data sharing from within the app itself.

    About This Analysis

    This scorecard is based on static analysis of the published app at the time of scanning. Results reflect findings from that version and may not represent subsequent updates.

    App Details

    • App: Wallapop - Sell & Buy
    • Package: com.wallapop
    • Scan Date: 2026-01-21

    Right of Reply

    Developer not yet contacted