CITT

    Scan results

    Budget App & Tracker: Spendee

    Android

    Save money effortlessly with Spendee — the FREE budget app and expense tracker trusted by nearly 3,000,000 people. Track what matters, plan smarter, and keep money flowing toward your goals with synced bank accounts and real-time control.

    CITT SCORE
    32
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Budget tracking with Google and Facebook data sharing

    Not For: You keep sensitive financial accounts linked to apps

    What It Means For You

    Usage behavior and financial tracking habits are shared with Firebase, Google Analytics, and Facebook. Linking bank accounts or cards means user financial data may not be fully protected. User activity is used to improve targeting across advertising networks not selected by the user.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    6 total
    1 Critical
    1 High
    2 Medium
    1 Low
    1 Info

    Network Security

    2 total
    1 Critical
    1 Medium

    Code Security

    3 total
    2 High
    1 Medium

    Privacy

    3 total
    1 Critical
    1 Medium
    1 Low

    Permission Usage

    1 total
    1 Medium

    Third-Party Services

    Firebase Analytics, Google Analytics, Facebook SDK, Plaid Link SDK, Sentry, Firebase Crashlytics, Firebase Cloud Messaging, Firebase Remote Config, Firebase Firestore, Firebase Storage, Firebase Auth, Google Sign-In

    Security Strengths

    • ✓Backup protection properly configured (allowBackup=false)
    • ✓WebView debugging disabled in production
    • ✓Secure WebView defaults (file access disabled, mixed content blocked)
    • ✓Android KeyStore correctly implemented with biometric protection
    • ✓All SDKs are recent versions with no known CVEs
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    banking
    budget tracking
    gdpr violation
    unencrypted storage
    oauth
    webview
    third party tracking
    analytics

    Package

    com.cleevio.spendee

    Version

    5.5.49 (build 1740000068)

    Analysis Date

    Jan 26, 2026

    Classes Analyzed

    22,916

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (1 critical, 1 high, 2 medium, 1 low, 1 info)

    Network Security - 2 findings (1 critical, 1 medium)

    Code Safety - 0 findings

    Privacy - 3 findings (1 critical, 1 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    Spendee collects transaction history, spending categories, linked bank account details, and in-app behavior. Device identifiers and usage patterns are gathered by analytics and advertising services running in the background.

    Third-Party Data Sharing

    Data is shared with the following services:

    • Firebase (Google) - Cloud storage, authentication, messaging, and analytics
    • Google Analytics - Behavioral tracking and usage profiling
    • Facebook SDK - Cross-app behavioral profiling and advertising targeting
    • Plaid - Linking to bank accounts and financial institutions
    • Sentry - Application error and performance data

    Understanding the Scores

    CategoryScore
    Security30/100
    Privacy35/100
    Data Security25/100
    Network Security45/100
    Code Safety50/100
    Data Collection85/100
    Data Sharing80/100
    User Control70/100

    Positive Security Features

    • Firebase Authentication provides a recognized infrastructure for managing user accounts and sign-in sessions.
    • Crash and error reporting through Sentry and Firebase Crashlytics supports ongoing stability improvements.
    • Google Sign-In is available as an authentication option, reducing password-related risks for users who choose it.

    Areas for Improvement

    • Data transmitted between the app and external services travels with less protection than expected for financial transactions.
    • The volume of behavioral data shared with advertising networks should be reduced, especially for users who connect bank accounts or payment cards.
    • Greater transparency about what financial data is retained, for how long, and who can access it would help users make an informed choice before linking accounts.

    About This Analysis

    Scores and findings are based on static analysis of the application package. Results reflect the state of the app at the time of analysis and are intended to help users make informed decisions about the apps they install.

    App Details

    • App Name: Budget App & Tracker: Spendee
    • Package ID: com.cleevio.spendee
    • Version: 5.5.49 (build 1740000068)
    • Platform: Android
    • Scan Date: January 26, 2026

    Right of Reply

    Developer not yet contacted