What the Craigslist app leaves on an iPhone

Summary

• Craigslist is a long-running classifieds service and its iPhone app is the company's own, first released in December 2019. Public records of fraud and robbery in online classifieds are about third parties misusing a legitimate service. We found no record about the iPhone app itself, so its place in our ranking rests on category context.
• On three research images the app left seven readable kinds of record: recent searches, opened postings, favorites, app state, a short startup log, and two views of its network cache (search requests and posting pages).
• All three images were signed out. No account email and no messages were stored, so the app's data alone does not say who used it or whom they contacted.
• A missing record is not a missing event: the searches list is capped, the cache is a sample, and the account, any messages and the person's own postings are not in the container.

What the app does and who uses it

According to its App Store listing, the app is the mobile version of Craigslist, a classifieds service founded in 1995. It covers jobs, housing, items for sale, vehicles, local services and gigs. People can save favorites, filter results, set search alerts and view listings on a map [S3]. Craigslist released its first official iPhone app on 3 December 2019. Until then only third-party apps existed, according to a report of 4 December 2019 [S4].

Its users are ordinary: someone looking for a flat, selling a used bicycle, or hunting for a part-time job or a local tradesperson. When we read the listing it showed a 4.8 rating from 562 thousand ratings and a current version of 1.30.0 [S3].

The listing's privacy details are written by the developer and are not verified by Apple. They list search history, device ID, location, email address, name, phone number and payment information among the data linked to the user [S3]. Craigslist's privacy policy says it applies to its mobile applications, and it names device information and IP address as collected through the app, and saved searches, account preferences and favorite or hidden postings as entered by the user [S8]. These are statements about what the service collects. They do not say what the phone keeps. The device section does.

Why this app matters to an examiner

A classifieds app is where a private sale, a rental or a job lead begins, so the questions that reach an examiner are small and concrete: what did this person look for, which listings did they open, and when. The same features that serve ordinary users are used by people who set out to defraud them.

Craigslist's own help pages warn about this. In summary, it advises dealing locally and in person, not sending or accepting payment before meeting, and treating requests to wire money, pay with gift cards or deposit a cashier's check as scams. It says a request for a code or verification is always a scam [S5]. Its phishing page says fraudulent messages can appear to come from Craigslist or from other users [S6], and its in-person guide suggests a public meeting place such as a bank or police station [S7].

Regulators describe the same patterns. A Federal Trade Commission consumer alert of 27 July 2022 names Craigslist among the sites that attract both buyers and scammers, and describes fake payment notices, check overpayment and requests for a verification code [S9]. A Federal Bureau of Investigation (FBI) public service announcement of 15 November 2023 lists similar buyer and seller warning signs without naming any service [S10].

The scale is only visible at category level. In its 2025 annual report the FBI's Internet Crime Complaint Center (IC3) counted 1,008,597 complaints and $20.877 billion in reported losses. Non-payment and non-delivery, the category for goods that are paid for and never arrive or are shipped and never paid for, accounted for 56,478 complaints and $503,373,587 [S11]. By our arithmetic that is about 5.6 percent of complaints and 2.4 percent of reported losses. The report does not name Craigslist or any other app. The FTC reported about $16 billion in fraud losses reported to it for 2025 [S12]. These are complaints, not counted incidents, and none of them is about this app.

Police statements are older and local. In August 2011, according to a CBS Philadelphia report, police said three people who had listed expensive watches for sale on Craigslist were robbed by men posing as buyers, and advised meeting in public, if possible at a police station [S13]. In January 2013, Baltimore City police warned that robbers had found sellers through Craigslist listings [S14]. Some police departments now offer a camera-monitored safe exchange zone for online sales, for example San Mateo, whose page names no platform [S15].

No app-specific record. In the pages we read, we found no regulator, law-enforcement or news record about the Craigslist iPhone app as distinct from the service, and none that treats the app as an instrument of misuse. Everything above is category context. The people who misuse classifieds are third parties, and Craigslist warns its users about them.

Why the Lab chose it

We compared the apps found in the Lab's research images with what the open-source parser reads. The images held 731 distinct non-stock apps. The parser, checked against its main branch on 6 November 2026, read 51 of them, 4 in part, and not the remaining 676. We ranked the unparsed apps by public-record relevance [S2].

Craigslist was seventh of ten. Its rank rests on category context: it is a marketplace, and the public record above describes marketplace fraud and meeting-place robbery. It does not rest on an app-specific misuse source, because we found none. The app was present in 3 of the 9 images, in versions 1.27.0 and 1.29.1 [S2]. There was also a practical reason. The state is plain JSON and a standard cache database, so a parser could be built and tested without a vendor-specific decoder.

Method

We worked in four read-only steps. First, container inspection: for each image we listed the app's container and recorded file, table, column and key names, not values. Second, a synthetic fixture: a script builds one invented container with the same layout, using fixed phrases for queries, a made-up town on a reserved domain, round coordinates and placeholder tokens. The parser can be tested and shared with no case data.

Third, tests: 15 unit tests, including that token values are never exported and that odd value types, missing tables and non-JSON bodies do not stop a run, and 7 of 7 test cases against stored baselines. A full run on the fixture loaded all seven artifacts [S1]. Fourth, a read-only run on the three real containers, recording row counts only, with no error from the module. The temporary extracts were deleted, and no case data left the Lab.

The counts matter because a parser can return an empty table instead of an error, and an empty table looks like an unused feature (LAB-TR-0006 [S16]). We did not sign in or out, use the app under controlled conditions, or test a backup input.

What is on the device and what is not

The app is built with React Native and has no database of its own. Its state sits in AsyncStorage, which stores named values: a small value inside a manifest.json file, and a larger value in a separate file named after a hash of its key. Figure 2 shows the three places the app writes and what each becomes in the parser [S1].

Table 1 lists the seven artifacts the parser produces, with what each is worth and where it stops. Times are Unix milliseconds in some fields and Unix seconds in others, and the parser notes which for each field.

Figure 3 shows how many rows each artifact produced on the three images. The images differ a great deal, 178 opened postings on one and 1 on another, which shows different use or retention, not a rate. Account and App State gave 32 rows and Startup Log 5 on every image, which is what a fixed set of settings and a short log look like. The other five artifacts vary with use.

Two details guard against over-reading. The viewed-postings list gives each posting identifier a time. Of 28 identifiers that also had a cached response, 14 were cached within 60 seconds of the viewed time, 8 later and 6 earlier, so the cache time is not a viewed time. And the recent-searches list is capped at 24 rows, which two images reached, so an older search that is not listed proves nothing [S1].

Most of what a reader might hope for is not on the device. Figure 4 lets you pick a kind of evidence and see whether it is on the device, where, what we counted, and the wording a report can use. Where the pages we read say who holds a record, the explorer says so; where they do not, it says the question is not established.

Signed out: what a missing account email means

On all three images the stored login was empty and the signed-in flag was false. Chats and messages were empty, the hidden-postings and saved-searches lists were empty, one image had a single favorite, and one had no recent searches. The parser exports an account email when one is present. None was [S1]. For an examiner this has five consequences.

• No named person. Without an account email, nothing in the container ties the searches and viewed postings to a named person. Any such link must come from another source.
• No account does not follow. A signed-out app is consistent with never having signed in. It is also consistent with a sign-out. We ran no sign-in or sign-out test, so we do not know whether an earlier sign-in leaves a value behind.
• Browsing is not acting. The container shows searches and opened postings. It shows no message, no payment and no meeting. A flag in the cached posting says whether the advertiser gave contact details, not what they were.
• The signed-in layout is unobserved. The state has keys for drafts, active and inactive postings, payment cards and autofill fields. We saw only their empty shapes, and the parser does not export them. On a signed-in phone, check these by hand and tell the maintainers what you find.
• The service holds the rest. The account, any messages relayed through Craigslist and the person's own postings are not in this container. Craigslist's policy says it may share data in response to a subpoena, search warrant, court order or other legal process, and it states no retention periods [S8]. Whether the service still holds a record is a question for the service.

What an examiner can and cannot conclude

Can, with the file and key named. The app's stored state held these searches and opened-posting identifiers, with these recorded times, when the evidence was taken. That is consistent with the app having been used on this phone to look at classified listings. The cached posting pages show what the app received for those listings, which may no longer be online.

Cannot. The container does not show who held the phone, whether anyone contacted a seller, paid or met, or whether a listing was genuine or fraudulent. It does not show that nothing else was searched or opened: the searches list is capped and the cache keeps a sample. A phone supports a claim that nothing happened only where it could have recorded the event (LAB-TR-0034 [S17]). Opening a listing on this app looks the same on the device as any other use, and nothing here makes it suspicious in itself.

For wording, use the weaker honest statement. "The app's recent-searches list held 24 entries and holds at most 24" is true. "The person searched only these things" is a guess. The same discipline applies to a missing key (LAB-0005).

What this does not prove

Sources

Every number and claim, and where it comes from. Web pages were read between 5 and 6 November 2026 and are cited by publisher, title, date and address. Where a page shows no date we say so. We did not use U.S. Department of Justice news releases, because their pages could not be read automatically. S1 and S2 are Lab records: the parser and its synthetic fixtures are in preparation for the open-source project and the Lab artifact repository. S16 is on Zenodo (doi:10.5281/zenodo.23717928). S17 is a Lab Technical Report available on this site (no DOI yet): LAB-TR-0034.

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related

The Craigslist module, its synthetic fixtures and test cases are in preparation for the open-source project and the Lab artifact repository. Sibling articles on other apps, including the marketplace app in LAB-0008, are listed on the research index.