Scan results

Recommendation: Trustworthy

A solid local-first expense tracker where your financial information stays on-device. Effective for budgeting, savings goals, and comprehensive money management.

Key Findings

Data Security - 2 findings (1 medium, 1 info)

Network Security - 0 findings

Code Safety - 0 findings

Privacy - 1 finding (1 info)

Privacy Concerns

What Data is Collected

• Financial records (transactions, budgets, savings goals, debts): accessed on your device and not sent to any developer server
• Advertising identifier: shared with Google AdMob for ad targeting (requires your consent before activation)
• App session and usage data: shared with Firebase Analytics automatically in the background
• Crash reports: shared with Firebase Crashlytics to help the developer identify and fix issues
• Financial database backup: optionally uploaded to your personal Google Drive account if you enable the backup feature

Third-Party Data Sharing

The following third parties may receive your data:

• Google AdMob - advertising (consent required before ads are activated)
• Firebase Analytics (Google) - automatic session and usage telemetry
• Firebase Crashlytics (Google) - crash and error reporting
• Google Drive - optional financial data backup to your personal Google account

Understanding the Scores

Security: 92/100
Privacy: 87/100

Security Breakdown

• Data Security: 84/100 - Your financial information is kept on your device with no developer backend. Financial screens may be captured by screen-recording tools, and the app-lock passcode could be accessible on a physically compromised device.
• Network Security: 100/100 - All network communications use secure encrypted connections with no insecure overrides.
• Code Safety: 100/100 - Strong code protections are applied throughout, with no dangerous permissions requested.

Privacy Breakdown

• Data Collection: 85/100 - Your financial records stay on your phone with no developer server involved. Standard analytics and advertising identifiers are shared automatically with Google in the background.
• Data Sharing: 90/100 - Data sharing is limited to Google's analytics and advertising services, with ads gated behind your explicit consent before activation.
• User Control: 90/100 - Premium subscribers bypass ads entirely, and the Google Drive backup is fully optional and uses the minimal authorization scope needed.

Positive Security Features

• All financial data stays on your device with no developer-owned backend server
• Ad display requires your consent before the advertising SDK activates
• No sensitive permissions requested (no location, camera, contacts, or microphone access)
• Google Drive backup uses secure, minimal-access authorization over an encrypted connection
• All network traffic uses secure encrypted connections
• Code obfuscation applied to the release build for additional protection
• Database queries use parameterized structures to prevent data corruption from malformed input

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Analytics Consent Control
   Firebase Analytics sends session data to Google automatically, independent of the ad consent flow. Extending the existing consent mechanism to cover analytics as well would give users fuller control over what background information is shared.

2. Transparent In-App Data Disclosure
   Clearly documenting all third-party services and the types of information each receives directly within the app's settings or privacy section would help users make more informed choices.

Security Enhancements

1. Financial Screen Protection
   Enabling screen capture restrictions on financial screens and the PIN entry screen would prevent screen-recording tools from capturing account balances, transaction history, and the app-lock passcode.

2. App-Lock Passcode Storage
   Applying stronger storage protection to the app-lock passcode would make it more resilient on devices that may fall into unfamiliar hands.

Technical Context

App Type: Personal finance and expense tracking (sensitive financial data)
Classes Analyzed: 534
Third-Party Services: 14
Context Tags: financial, sensitive_data, ads

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: KTW Technologies
Version: 11.3 (versionCode 138)
Analysis Date: 2026-06-13
Package: com.ktwapps.walletmanager

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 11.3 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors