CITT

    Scan results

    InfoCasas

    Android

    Real estate portal app for finding homes and apartments in Uruguay and Latin America. Browse thousands of properties, save favorites, receive notifications, and contact agents directly. Part of InfoCasas.com.uy, the largest real estate portal in Uruguay with 100,000+ properties and 700+ agents.

    CITT SCORE
    42
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: House hunters comfortable with standard analytics

    Not For: You share sensitive financial details in the app

    What It Means For You

    User activity is tracked by Firebase, Facebook, and Sentry, meaning browsing behavior and usage patterns are shared with multiple third parties. Users have limited control over what data is collected or how long it is retained. Data handling practices in this app mean personal information deserves extra caution before sharing it.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (22)

    Data Security

    11 total
    1 Critical
    1 High
    6 Medium
    3 Low

    Network Security

    2 total
    1 High
    1 Low

    Code Security

    5 total
    1 Critical
    2 High
    1 Medium
    1 Low

    Privacy

    4 total
    2 Critical
    2 Medium

    Third-Party Services

    Firebase Analytics, Firebase Crashlytics, Firebase Messaging, Firebase Remote Config, Sentry, OneSignal, Google Sign-In, Facebook SDK, Google Maps SDK, BugButtle

    Security Strengths

    • ✓SSL validation properly implemented without bypass
    • ✓File access disabled in WebView
    • ✓Parameterized SQL queries prevent SQL injection
    • ✓Proper use of private app directories with correct permissions
    • ✓Mixed content blocked by default in WebView
    • ✓Recent SDK versions (Sentry 8.21.1, Firebase Messaging 25.0.1, OkHttp 4.12.0)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    real estate
    location
    ads
    sensitive data
    financial

    Package

    uy.com.infocasas.infoapp

    Version

    5.8.5 (Build 400130)

    Analysis Date

    Feb 6, 2026

    Classes Analyzed

    23,762

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 11 findings (1 critical, 1 high, 6 medium, 3 low)

    Network Security - 2 findings (1 high, 1 low)

    Code Safety - 0 findings

    Privacy - 4 findings (2 critical, 2 medium)

    Privacy Concerns

    What Data is Collected

    The app collects device identifiers, usage patterns, crash reports, and behavioral data through multiple analytics and tracking services. Property search activity, including listings viewed and filters applied, may be recorded and associated with the device or account profile.

    Third-Party Data Sharing

    User data is shared with the following third parties:

    • Firebase (Analytics, Crashlytics, Messaging, Remote Config) - Google's analytics and infrastructure platform
    • Facebook SDK - behavioral and advertising data sharing with Meta
    • Sentry - error and performance monitoring
    • OneSignal - push notification delivery
    • Google Sign-In - authentication services
    • Google Maps SDK - location and mapping services
    • BugButtle - in-app feedback and session recording

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy40/100
    Data Security50/100
    Network Security85/100
    Code Safety65/100
    Data Collection35/100
    Data Sharing55/100
    User Control30/100

    Positive Security Features

    • No notable positive security practices were identified in this version.

    Areas for Improvement

    • The app collects a broad range of personal and behavioral data with little visibility into what is stored or how long it is retained.
    • Multiple third-party tracking and advertising services operate within the app, sharing behavioral profiles across platforms.
    • Data handling practices suggest user data may not be fully protected from unintended access.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect the security and privacy posture of the version analyzed and may change with future updates.

    App Details

    • App Name: InfoCasas
    • Package ID: uy.com.infocasas.infoapp
    • Version: 5.8.5 (Build 400130)
    • Scan Date: February 6, 2026

    Right of Reply

    Developer not yet contacted