Scan results

Recommendation: Acceptable

This is a capable expense tracker for day-to-day budgeting, but its advertised "privacy-focused" and "no data shared" claims are contradicted by how it actually works: Facebook receives your purchase activity automatically, and your financial records are not protected by encryption on your device. Acceptable for casual expense tracking if you understand these tradeoffs.

Key Findings

Data Security - 2 findings (1 high, 1 medium)

Network Security - 0 findings

Code Safety - 2 findings (1 low, 1 info)

Privacy - 3 findings (2 high, 1 medium)

Privacy Concerns

What Data is Collected

• Financial records (expenses, budgets, transactions, income): accessed and stored on your device
• In-app purchase history: shared with Facebook and RevenueCat for subscription tracking
• App usage events and interactions: shared with Facebook and Firebase Analytics
• Device identifier: shared with Superwall for paywall management and A/B testing
• Crash and performance data: shared with Firebase Crashlytics

Third-Party Data Sharing

The following third parties may receive your data:

• Facebook - automatic purchase event logging, app usage tracking, and advertising identifier collection
• Firebase (Google) - analytics, crash reporting, authentication, and optional cloud sync
• Superwall - subscription paywall optimization, receives a persistent device identifier linked to your Google account
• RevenueCat - subscription and entitlement management
• Amazon - in-app purchase processing

Understanding the Scores

Security: 80/100
Privacy: 72/100

Security Breakdown

• Data Security: 68/100 - Financial records are stored without encryption on your device, and screens displaying your financial data can be captured in screenshots or screen recordings.
• Network Security: 100/100 - All network communication is protected by industry-standard encryption, with no cleartext exceptions.
• Code Safety: 95/100 - The app is built with strong, modern coding practices and uses current security frameworks throughout.

Privacy Breakdown

• Data Collection: 80/100 - The app collects a moderate set of data, including usage events and in-app purchase details that are sent to third-party services.
• Data Sharing: 78/100 - Multiple third-party services receive data, with Facebook receiving purchase activity and Superwall receiving your persistent device identifier.
• User Control: 80/100 - You can request data deletion and your data is encrypted in transit to third parties.

Positive Security Features

• All network traffic uses standard, system-validated encryption with no cleartext exceptions
• No custom security bypass implementations were found in the networking code
• Biometric authentication is available for locking access to the app
• Browser-based paywall views have developer debugging disabled in production

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Accurate Data Sharing Disclosure
   The Play Store privacy declaration states "No data shared with third parties," but purchase activity is automatically transmitted to Facebook. Updating this declaration to accurately reflect sharing with Facebook, Superwall, Firebase, and RevenueCat would align the disclosure with actual app behavior.

2. Advertising Access Scope
   All bundled third-party services are granted access to Android's interest-based advertising features, including interest categories inferred from cross-app browsing behavior. Restricting this access to only the services that require it would reduce unnecessary data exposure for users.

Security Enhancements

1. Financial Data Protection
   Encrypting the local database that stores your financial records would protect your data if your device is lost, stolen, or accessed by data recovery tools. The app already uses secure hardware for biometric authentication, so the infrastructure for stronger data protection is in place.

2. Screen Capture Protection
   Preventing screenshots and screen recordings on financial screens would stop other apps and the device task switcher from capturing your expense and budget information.

Technical Context

App Type: Personal finance and expense tracking, sensitive financial data
Classes Analyzed: 3,100
Third-Party Services: 17
Context Tags: financial, sensitive_data, ads

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Amit Mohan
Version: 3.19.8 (versionCode 508; Play Store shows 3.19.9)
Analysis Date: 2026-06-13
Package: com.amitm29.am.dailyexpensesmanager

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 3.19.8 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors