CITT

    Scan results

    Etos

    Android

    Etos is a loyalty card and shopping app for the Dutch pharmacy and home care retailer. Features include loyalty card scanning, personalized offers, Air Miles rewards, store locator, and online shopping for care products.

    CITT SCORE
    68
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Etos shoppers comfortable with marketing analytics

    What It Means For You

    User activity and contact details are shared with Salesforce for marketing purposes, enabling personalized promotions based on shopping behavior. Firebase tracks crashes and delivers push notifications, while payment data is handled by Adyen and Cash App Pay. Users have limited control over how their data is used once shared with these third parties.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (10)

    Data Security

    4 total
    1 High
    2 Medium
    1 Low

    Code Security

    1 total
    1 Low

    Privacy

    5 total
    3 High
    2 Medium

    Third-Party Services

    Salesforce Marketing Cloud, Firebase (Crashlytics, Cloud Messaging), Adyen Payment Processing, Cash App Pay, Google Maps, Mopinion, AppAuth

    Security Strengths

    • ✓Strong encrypted storage implementation (AES-256-GCM with Android Keystore)
    • ✓HTTPS enforcement across all communications
    • ✓Comprehensive backup protection (allowBackup=false)
    • ✓Firebase Analytics disabled by default
    • ✓Exported components with appropriate permission protection
    • ✓WebView secure file access defaults
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    ads
    location
    financial
    sensitive data

    Package

    nl.etos.mijnetos

    Version

    3.67.0 (Build 1040244)

    Analysis Date

    Mar 4, 2026

    Classes Analyzed

    24,739

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (1 high, 2 medium, 1 low)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 5 findings (3 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    The app collects contact information, shopping activity, browsing behavior, and device identifiers. This data supports the loyalty program, personalized offers, and app performance monitoring.

    Third-Party Data Sharing

    User data is shared with the following services:

    • Salesforce Marketing Cloud - receives contact and behavioral data for personalized marketing campaigns
    • Firebase (Crashlytics, Cloud Messaging) - collects device and performance data, delivers push notifications
    • Adyen Payment Processing - processes payment transactions
    • Cash App Pay - processes payments made via Cash App
    • Google Maps - provides location and mapping features
    • Mopinion - collects in-app feedback and usage information
    • AppAuth - manages authentication

    Understanding the Scores

    CategoryScore
    Security78/100
    Privacy58/100
    Data Security70/100
    Network Security100/100
    Code Safety100/100
    Data Collection62/100
    Data Sharing68/100
    User Control55/100

    Positive Security Features

    • Network connections are secured, protecting user data while it travels between the device and the app's servers.
    • The app's code structure shows no safety concerns, reducing the risk of unexpected behavior.

    Areas for Improvement

    • Contact and behavioral data is shared with marketing platforms, with limited options for users to restrict how it is used for advertising purposes.
    • Data collection extends to behavioral profiling that goes beyond what is needed for core shopping features.
    • User controls for managing data preferences are limited, leaving users with little ability to adjust how their information is handled once it is shared with third parties.

    About This Analysis

    This scorecard reflects the security and privacy practices found in the app version listed below.

    App Details

    • App Name: Etos
    • Package ID: nl.etos.mijnetos
    • Version: 3.67.0 (Build 1040244)
    • Scan Date: 2026-03-04

    Right of Reply

    Developer not yet contacted