Scan results

Recommendation: Acceptable

Acceptable for everyday personal budget tracking on a personal device. The app has meaningful security gaps though: your PIN is saved without secure protection, your financial database is stored without encryption on your device, and an unguarded internal mechanism allows any other installed app to clear your PIN lock without your knowledge. Four advertising networks also receive your app usage patterns.

Key Findings

Data Security - 5 findings (5 medium)

Network Security - 1 finding (1 medium)

Code Safety - 4 findings (2 medium, 2 low)

Privacy - 1 finding (1 info)

Privacy Concerns

What Data is Collected

• Financial records: your expenses, income, accounts, and payee details are accessed on your device and stored locally
• Device identifiers: your device's advertising ID is shared with ad networks and analytics services
• Usage patterns: how you interact with the app may be shared with advertising and analytics partners
• Approximate location: may be shared with advertising networks

Third-Party Data Sharing

The following third parties may receive your data:

• Google AdMob - advertising and ad targeting
• AppLovin MAX - ad mediation and interest-based advertising
• Vungle (Liftoff) - video advertising
• Facebook Audience Network - display and video advertising, cross-app tracking
• Yandex Mobile Ads - advertising
• Singular - install attribution and marketing analytics
• Firebase Analytics - app usage analytics
• Firebase Crashlytics - crash and error reporting

Understanding the Scores

Security: 72/100
Privacy: 82/100

Security Breakdown

• Data Security: 65/100 - Your financial database and PIN are stored on your device without protection, making them accessible to other apps or anyone with physical access to your phone.
• Network Security: 78/100 - Backend communication uses encrypted HTTPS connections. The Bluetooth data sync feature, however, transmits your financial history without authentication or encryption when active.
• Code Safety: 76/100 - Several internal components lack proper access controls, including one that could allow another installed app to reset your PIN lock or cancel your in-app purchases without your authorization.

Privacy Breakdown

• Data Collection: 78/100 - Your financial records stay on your device and are not sent to the developer's servers. Your device ID and app usage patterns are shared with advertising and analytics partners.
• Data Sharing: 82/100 - Data shared with third parties is limited to device identifiers and usage signals rather than your actual financial records.
• User Control: 82/100 - The app offers PIN and fingerprint lock options so you can control who can access your data on your device.

Positive Security Features

• All communication with the developer's servers uses encrypted HTTPS connections
• Google Drive backup requires your explicit authorization before syncing, giving you direct control over what is uploaded to your Google account

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Secure On-Device Data Storage
   Your financial database and authentication PIN would benefit from stronger on-device protection to prevent unauthorized access by other installed apps or in physical access scenarios.

2. Backup Exclusions for Financial Data
   Excluding your financial database and PIN settings from automatic Android cloud backups would prevent unintended exposure through backup services.

Security Enhancements

1. Screen Capture Protection
   Enabling screenshot protection on financial screens would prevent your account balances and transaction history from appearing in the device's recent apps view or being captured by other apps.

2. PIN Reset Authentication Gate
   The PIN reset mechanism should require verification before clearing your authentication settings, preventing other installed apps from bypassing your lock screen.

Technical Context

App Type: Personal finance and budget tracking (Finance category)
Classes Analyzed: 714
Third-Party Services: 18
Context Tags: financial, ads, sensitive_data, privacy

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: DEEP SPARK LTD
Version: 9.0.1 (Build 363265241)
Analysis Date: 2026-06-13
Package: com.colpit.diamondcoming.isavemoney

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 9.0.1 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors