Spending Tracker Security & Privacy Scorecard

Spending Tracker

What This Means for You

Your spending records stay on your phone rather than being sent to a company's server, though the free version uses advertising that may build a behavioral profile linking your identity to financial app usage across other apps.

Recommendation: Trustworthy

Thoughtfully designed budget tracker with strong privacy protections. Biometric authentication, GDPR-compliant ad consent, no invasive permissions, and offline-first architecture. Ideal for everyday expense tracking.

Best For: Casual budget trackers and everyday expense managers who want a reliable local-first financial app

Key Findings

Data Security - 2 findings (1 high, 1 medium)

Network Security - 1 finding (1 low)

Code Safety - 0 findings

Privacy - 2 findings (2 info)

Privacy Concerns

What Data is Collected

• Financial transactions, budgets, and income records: accessed on your device and stored locally, not sent to the developer's servers
• Advertising ID: shared with Google AdMob to serve and target ads
• App category interest (personal finance): shared with Google's advertising platform for behavioral targeting
• Device information (model, OS version, app version): sent to Microsoft when the app crashes

Third-Party Data Sharing

The following third parties may receive your data:

• Google AdMob - advertising display and behavioral profiling
• Microsoft App Center - crash reporting and diagnostics
• Dropbox - optional, user-controlled backup of your financial data

Understanding the Scores

Security: 82/100
Privacy: 88/100

Security Breakdown

• Data Security: 78/100 - Your financial records are stored locally on your device. The database is not encrypted, which means your data could be accessed if someone gains physical access to your phone's internal storage.
• Network Security: 95/100 - Nearly all communication with external services uses secure, encrypted connections.
• Code Safety: 100/100 - No code safety issues found. The app ships with release settings and no developer backdoors.

Privacy Breakdown

• Data Collection: 88/100 - Your spending data stays on your device. Advertising tools access your Advertising ID and app category for ad targeting.
• Data Sharing: 88/100 - Advertising identifiers and crash diagnostics may be shared with Google and Microsoft. Your personal financial records are not shared with third parties.
• User Control: 92/100 - Strong user control through biometric lock, GDPR-compliant ad consent management, and optional Dropbox backup you can enable or disable at any time.

Positive Security Features

• Biometric authentication (fingerprint or face recognition) available as an app lock option
• Financial data stays on your device by default; Google Cloud backup is disabled
• No location or contacts permissions requested, keeping the permission footprint minimal
• GDPR-compliant ad consent defaults to non-personalized ads before you agree to targeted advertising
• Secure file sharing for CSV and PDF exports prevents unauthorized access to exported files
• Firebase crash collection explicitly disabled, reducing background data transmission
• Release build with no debug settings or developer backdoors

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Data Deletion Capability
   The Play Store data safety section states that data cannot be deleted, which may create a gap with GDPR's right to erasure for advertising-related data held by third parties.

2. Opt-in Crash Reporting
   Crash reporting to Microsoft is active by default and requires users to turn it off in Settings under Data and Privacy. Defaulting to opt-in would give users more control from the start.

Security Enhancements

1. Database Encryption
   Encrypting the financial database would protect your transaction history if your device is lost, stolen, or accessed without your permission.

2. Screenshot Protection
   Adding protection to prevent financial screens from appearing in the app switcher or being captured by screen recording tools would reduce the risk of accidental data exposure.

Technical Context

App Type: Personal finance manager, sensitive financial data
Classes Analyzed: 0
Third-Party Services: 15 third-party services identified
Context Tags: financial, sensitive_data, ads

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: MH Riley Ltd
Version: 2.8.1 (versionCode 600216)
Analysis Date: 2026-06-13
Package: com.mhriley.spendingtracker

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 2.8.1 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors