Can I trust Fast Budget - Expense Manager?
This scan is more than 90 days old.
This app did not meet one of the trust checks that applied to it, with no red flags.
- Best for
- Personal finance tracking for everyday budgeters
- What it means for you
- Financial transactions and budget data are stored in Firebase and optionally synced via Dropbox. Analytics and crash reporting through Firebase are disabled until the user explicitly consents, and ad networks (Google AdMob, Facebook Audience Network) are never activated for paying subscribers. Users who connect bank accounts do so through Salt Edge, a third-party financial data aggregation service.
- Main concern
- Full financial history stored unencrypted in SQLite; readable on rooted/forensic device
- The developer's description
- Keep your personal or family finances easily under control with Fast Budget. Track daily expenses, improve savings, and visualize money flow with customizable charts.
- Third-party services
- 17
- Findings rated low or higher
- 3
Open on Google PlayOpens the app's listing on Google Play in a new tab.
Full findings
Open this scan in your dashboardThe account that ran this scan sees every finding and the Rescan button there.
Trust checks
Secure by Design
StrongStrong security foundation
Why this result
This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.
Data Minimization
StrongTracking done right
Why this result
The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.
Manifest Mismatch
StrongEverything visible
Why this result
The check compares the app's privacy disclosures against what the code does: the data categories collected, the companies named in code as their recipients, and the identifiers attached to each. The comparison covers the store listing, the in-app privacy text and any privacy manifest shipped in the build. Every claim compared matched the code here.
The in-app consent screen explicitly names all advertising partners by name. Cloud sync is the documented core feature of the app. No contradictions were found between what the app's own disclosures say and what the code actually does.
User Control
StrongNo lock-in
Why this result
The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.
Truly Local
One criterion not metContains code to send personal data off the device
Why this result
This app presents itself as working offline or on the device alone, and this build contains code written to send personal data to servers. The check covers analytics, crash reporting, advertising code and any first-party endpoint the code addresses personal data to. Code of this kind is common; what this check reports is the distance between that code and how the app describes itself.
Strengths
- Android Auto Backup fully disabled with comprehensive data_extraction_rules.xml excluding all domains from cloud backup and device transfer
- Firebase Analytics and Crashlytics disabled by default — only enabled after explicit user consent
- Firebase App Check integrated for server-side device attestation
- No SSL validation bypass — no custom TrustManager, no ALLOW_ALL_HOSTNAME_VERIFIER, no onReceivedSslError override
- All production APIs enforce HTTPS; cleartext restricted to localhost and emulator addresses only
- Dropbox integration uses PKCE (code_challenge_method=S256) with no app secret in APK
- No addJavascriptInterface exposed anywhere in the app
- Parameterized queries used throughout — no SQL injection risk
- Biometric authentication option via BiometricManager
- Account lockout after 7 failed PIN attempts (10-minute cooldown)
What the app contains
17 services
Third-party services the scan names in the build:
- Firebase Auth
- Firebase Realtime Database
- Firebase Storage
- Firebase Remote Config
- Firebase Crashlytics
- Firebase Analytics
- Firebase App Check
- Google AdMob
- Facebook Audience Network
- Dropbox SDK
- Google Play Billing
- Google Play Core
- Salt Edge
- OkHttp3
- MPAndroidChart
- OpenCSV
- JXL
Libraries
| Library | Version | Advisory |
|---|---|---|
| Room | not recorded | none confirmed |
| Google Play Billing | not recorded | none confirmed |
| Facebook Audience Network | not recorded | none confirmed |
| Facebook SDK | not recorded | none confirmed |
| Jackson | not recorded | none confirmed |
| Datatransport | not recorded | none confirmed |
| Google Mobile Ads (AdMob) | 12451000 | none confirmed |
| Google Sign-In | 12451000 | none confirmed |
| Google Play Services | 12451000 | none confirmed |
| Google Play Services Location | 12451000 | none confirmed |
Show all 21 librariesShow fewer
Method and limits
Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.
- Files decompiled
- 16,274
- Scan date
- 13 June 2026
Corrections
No correction is published for this app.
Developer response
No response is published for this app.
Report an error Opens an email to [email protected] that names this app and this scan.