"Last but not least, all communications are transmitted in clear text; no encryption is involved across the whole app." It's pretty common to send and receive

"Last but not least, all communications are transmitted in clear text; no encryption is involved across the whole app." It's pretty common to send and receive API requests in clear text, since the encryption for this part should be handled by HTTPS. But you're right, this app only uses HTTP