[bugmenot3]

"Last but not least, all communications are transmitted in clear text; no encryption is involved across the whole app."

It's pretty common to send and receive API requests in clear text, since the encryption for this part should be handled by HTTPS. But you're right, this app only uses HTTP

[tomsmeding]

Correct, but https is often called encryption too, in these contexts