Scan results

Recommendation: Acceptable

EveryDollar applies strong encryption and blocks all unencrypted connections, keeping your financial data secure in transit. The app shares your name, phone number, birth date, and subscription purchase history with marketing and attribution platforms, which extends your data footprint to third parties. For users focused on budgeting tools and comfortable with this data sharing, the app's core security practices are solid.

Key Findings

Data Security - 1 finding (1 medium)

Network Security - 0 findings

Code Safety - 2 findings (1 high, 1 medium)

Privacy - 3 findings (1 high, 1 medium, 1 info)

Privacy Concerns

What Data is Collected

• Personal information: name, email address, phone number, and date of birth shared with Braze for marketing purposes
• Financial information: subscription purchase amounts and purchase history shared with Braze and AppsFlyer
• Device and usage data: app interaction and install attribution data sent to AppsFlyer
• Location data: home city and geographic coordinates may be shared with Braze

Third-Party Data Sharing

The following third parties may receive your data:

• Braze - Marketing engagement platform; receives your name, email, phone number, birth date, and subscription purchase details
• AppsFlyer - Install attribution analytics; receives your subscription purchase history to support cross-app audience tracking
• Firebase - Push notifications and app connectivity
• Zendesk - Customer support communications
• Optimizely - Feature experimentation and personalization
• Plaid Link - Bank account connection (user-initiated, core feature)

Understanding the Scores

Security: 83/100
Privacy: 79/100

Security Breakdown

• Data Security: 80/100 - Financial data and account information are well-protected using encrypted storage, though one third-party component used in bank-connection flows stores login information without additional application-layer encryption
• Network Security: 100/100 - All network traffic is encrypted and unencrypted connections are blocked globally throughout the app
• Code Safety: 78/100 - The app implements secure authorization flows and encrypted storage, though two third-party SDK components introduce exposure risks during active bank-connection sessions

Privacy Breakdown

• Data Collection: 86/100 - The app collects the personal details needed to operate a budget manager, with name, birth date, and phone number also used for marketing platform engagement
• Data Sharing: 79/100 - Personal information and subscription purchase history are shared with marketing and attribution platforms, which extends your data footprint beyond Ramsey Solutions
• User Control: 89/100 - Data deletion is supported, and users can request removal of their information through the developer

Positive Security Features

• All network traffic is encrypted; unencrypted connections are disabled globally throughout the app
• Automatic cloud backup is disabled, preventing financial data from being saved to Google Drive
• The app is protected against analysis or modification in release builds
• Account information and session data are protected using hardware-backed encrypted storage
• Bank account connections use a properly scoped authorization protocol that resists unauthorized session takeover
• No private server keys or secret configuration files were found embedded in the app
• Standard operating system certificate validation is used without custom overrides

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Reduce marketing data scope
   Limiting the personal information shared with marketing platforms to identifiers needed for communication, rather than full profile data including birth date, phone number, and purchase amounts, would better align with data minimization principles.

2. Purchase history data minimization
   Subscription data forwarded to attribution platforms for analytics could be scoped to event counts rather than detailed purchase history that can be correlated across apps.

Security Enhancements

1. Bank-connection session storage
   Login information cached during bank-connection sessions could be stored with additional application-layer encryption beyond the default app sandbox protection.

2. Third-party SDK isolation during bank flows
   Components handling bank-connection screens and serving web-based in-app content from third-party servers could be further sandboxed to limit exposure if a third-party service were compromised.

Technical Context

App Type: Personal finance and budget management (financial data, high sensitivity)
Classes Analyzed: 13,318
Third-Party Services: 14 identified
Context Tags: financial, sensitive_data

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Ramsey Solutions (The Lampo Group, LLC)
Version: 2026.6.110 (versionCode 3161)
Analysis Date: 2026-06-13
Package: com.everydollar.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 2026.6.110 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors