This practice may be illegal in the USA. Two American companies were sanctioned by the FTC in 2014 for making this same error:
FTC Final Orders with Fandango and Credit Karma Provide Guidance on Mobile App Security
Here's the app I tested:
Sending personal data which should be encrypted:
Harvesting the data from Burp via MITM attack:
