CITT

    Scan results

    Fast Budget - Expense Manager

    Android

    Keep your personal or family finances easily under control with Fast Budget. Track daily expenses, improve savings, and visualize money flow with customizable charts.

    TRUSTish

    This app did not meet one of the trust checks in this assessment.

    The five trust checks

    CITT SCORE
    92
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Personal finance tracking for everyday budgeters

    What It Means For You

    Financial transactions and budget data are stored in Firebase and optionally synced via Dropbox. Analytics and crash reporting through Firebase are disabled until the user explicitly consents, and ad networks (Google AdMob, Facebook Audience Network) are never activated for paying subscribers. Users who connect bank accounts do so through Salt Edge, a third-party financial data aggregation service.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (5)

    Data Security

    1 total
    1 Medium

    Code Security

    3 total
    1 Medium
    2 Info

    Third-Party Risk

    1 total
    1 Low

    Third-Party Services

    Firebase Auth, Firebase Realtime Database, Firebase Storage, Firebase Remote Config, Firebase Crashlytics, Firebase Analytics, Firebase App Check, Google AdMob, Facebook Audience Network, Dropbox SDK, Google Play Billing, Google Play Core, Salt Edge, OkHttp3, MPAndroidChart, OpenCSV, JXL

    Security Strengths

    • ✓Android Auto Backup fully disabled with comprehensive data_extraction_rules.xml excluding all domains from cloud backup and device transfer
    • ✓Firebase Analytics and Crashlytics disabled by default — only enabled after explicit user consent
    • ✓Firebase App Check integrated for server-side device attestation
    • ✓No SSL validation bypass — no custom TrustManager, no ALLOW_ALL_HOSTNAME_VERIFIER, no onReceivedSslError override
    • ✓All production APIs enforce HTTPS; cleartext restricted to localhost and emulator addresses only
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data

    Package

    com.blodhgard.easybudget

    Version

    7.0.3 (versionCode 26538)

    Analysis Date

    Jun 13, 2026

    Classes Analyzed

    16,274

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Very Secure

    Fast Budget secures transactions with HTTPS protection and strong authentication controls. Premium subscribers avoid ads and ad-network tracking, making it a solid option for straightforward budget management.

    Key Findings

    Data Security - 1 finding (1 medium)

    Network Security - 0 findings

    Code Safety - 3 findings (1 medium, 2 info)

    Privacy - 1 finding (1 low)

    Privacy Concerns

    What Data is Collected

    • Financial information: transactions, account balances, budgets, debts, and credit card details are accessed and stored on your device
    • Usage data: sent to Firebase Analytics only after your explicit consent
    • Crash reports: sent to Firebase Crashlytics only after your explicit consent
    • Advertising identifier: may be shared with Google and Meta for free-tier users who opt into personalized ads

    Third-Party Data Sharing

    The following third parties may receive your data:

    • Google (AdMob, Firebase) - advertising for free-tier users and optional analytics and crash reporting after consent
    • Meta (Facebook Audience Network) - advertising for free-tier users who consent to personalized ads
    • Salt Edge - bank account synchronization, if you choose to connect a bank account
    • Dropbox - backup of your financial data, if you enable the Dropbox backup feature

    Understanding the Scores

    Security: 92/100
    Privacy: 92/100

    Security Breakdown

    • Data Security: 88/100 - Your financial data is protected by Android's app isolation, optional biometric lock, and an automatic lockout after failed PIN attempts.
    • Network Security: 100/100 - All communications with the app's servers travel over HTTPS. Unencrypted connections are blocked for external services.
    • Code Safety: 94/100 - The app uses secure coding practices throughout, including safely constructed database queries and properly scoped permissions.

    Privacy Breakdown

    • Data Collection: 93/100 - Your financial data stays on your device. Analytics and crash reporting are off by default and only activated with your explicit consent.
    • Data Sharing: 94/100 - Third-party data sharing is limited to advertising identifiers for free-tier users who consent to personalized ads, plus optional services like backup and bank sync that you choose to enable.
    • User Control: 100/100 - You can request deletion of your data, and consent for analytics and personalized ads is gathered before anything is shared with third parties.

    Positive Security Features

    • All production network connections use HTTPS, and unencrypted connections are blocked for external addresses
    • Biometric authentication support lets you lock the app with fingerprint or face recognition
    • The app locks automatically after 7 failed PIN attempts, with a 10-minute cooldown
    • Firebase Analytics and crash reporting are disabled by default and only enabled after you explicitly consent
    • Firebase App Check verifies the authenticity of the app before granting server access
    • Cloud backup is disabled by default, keeping your financial data off external storage unless you choose to enable Dropbox backup
    • Dropbox backup uses a secure authorization flow with no private keys or secrets stored in the app
    • Ad networks are never activated for premium subscribers, so no advertising identifier is shared if you pay for the app
    • Database queries are constructed safely throughout, protecting against data corruption from malformed input

    Areas for Improvement

    GDPR / CCPA Compliance

    The app's privacy practices could be strengthened by:

    1. Encrypting the Local Financial Database
      Using an encrypted database for storing transaction history, credit card details, and debt records would protect your complete financial history on devices subjected to forensic examination or advanced physical access. This would bring the app in line with industry recommendations for sensitive financial data at rest.

    2. Tightening App Link Verification for Authentication Screens
      Enabling domain ownership verification for the authentication and registration screen links would ensure only Fast Budget can respond to those links, preventing other apps on the same device from potentially interfering with the sign-in flow.

    Security Enhancements

    1. Verified App Links for Sign-In
      Activating verified handling for authentication-related app links would ensure that only Fast Budget opens those screens, adding an extra layer of protection against link interception by other installed apps.

    Technical Context

    App Type: Personal finance and expense manager (sensitive financial data)
    Classes Analyzed: 16,274
    Third-Party Services: 17 services identified
    Context Tags: financial, sensitive_data

    About This Analysis

    This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

    App Details

    Developer: AppFer SRL
    Version: 7.0.3 (versionCode 26538)
    Analysis Date: 2026-06-13
    Package: com.blodhgard.easybudget

    Analysis Limitations

    • Static analysis only (code review without running the app)
    • Based on APK version 7.0.3 analyzed on 2026-06-13
    • May not reflect server-side security controls
    • Cannot detect all runtime behaviors

    Right of Reply

    Developer not yet contacted