Monefy - Budget & Expenses app Security & Privacy Scorecard

Monefy - Budget & Expenses app

What This Means for You

Your complete spending history is silently uploaded to Monefy's servers every time you open the app, and if the app crashes on a financial screen, a screenshot of your balance may be sent to a third-party service.

Recommendation: Acceptable

Monefy silently uploads your financial database on every app start without consent. Financial data may be shared in crash reports sent to third parties. Suitable only for casual tracking if you don't consider spending history sensitive.

Best For: Casual budget trackers who prioritize simplicity and don't treat spending history as sensitive

Key Findings

Data Security - 3 findings (1 high, 2 medium)

Network Security - 0 findings

Code Safety - 2 findings (1 low, 1 info)

Privacy - 3 findings (2 high, 1 medium)

Privacy Concerns

What Data is Collected

• Financial data: Your transaction records, account balances, and spending categories are sent to Monefy's servers on every app launch, without a prompt or opt-out
• Device information: Your device ID, device model, operating system version, locale, and timezone are sent to Monefy's servers alongside your financial data
• Crash reports: App performance data, and potentially screenshots of your financial screens, may be shared with Sentry when the app encounters an error
• Sync data: If you choose to enable Google Drive or Dropbox sync, your budget data is shared with those services at your direction

Third-Party Data Sharing

The following third parties may receive your data:

• Firebase (Google) - App analytics, crash reporting, and performance monitoring
• Sentry - Crash reporting, potentially including screenshots of financial screens during an error
• RevenueCat - In-app purchase and subscription management
• Dropbox - Cloud data sync (only when you enable this feature)
• Google Drive - Cloud data sync (only when you enable this feature)

Understanding the Scores

Security: 78/100
Privacy: 65/100

Security Breakdown

• Data Security: 70/100 - Backup exports use a shared static encryption key and an outdated encryption approach, and the app PIN uses a security configuration that does not meet current recommendations. Data is protected in transit, but exported backups have meaningful weaknesses.
• Network Security: 100/100 - All communication with servers uses HTTPS. Your data is well protected in transit.
• Code Safety: 99/100 - The app's code is clean and well-structured, with strong safety practices throughout.

Privacy Breakdown

• Data Collection: 73/100 - The app sends your complete financial database to Monefy's servers on every launch without asking for your consent. Device identifiers are included in these uploads.
• Data Sharing: 80/100 - A limited set of third parties receives data, primarily for analytics, crash reporting, and purchase management. Cloud sync services only receive data when you actively enable them.
• User Control: 78/100 - Firebase Analytics and RevenueCat honor your device's ad-tracking preferences. However, there is no way to opt out of the automatic financial database upload that runs on every launch.

Positive Security Features

• All data transmitted between the app and servers uses HTTPS
• Dropbox sign-in uses a secure authorization flow through your device's browser, reducing the risk of sign-in interception
• Firebase Analytics provides a user opt-out mechanism for analytics tracking
• RevenueCat respects your device's ad-tracking opt-out setting
• Sentry's screen recording feature is included in the app but is not active

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Transparent data upload disclosure
   The automatic upload of your financial database to Monefy's servers should be clearly disclosed before it occurs, with the option to opt out.

2. Financial screen protection
   Enabling screen protection on budget and transaction screens would prevent your financial data from appearing in Android's Recent Apps view or being captured by other apps on the device.

Security Enhancements

1. Stronger backup encryption
   Database backup exports would benefit from a unique encryption key generated per user, rather than a shared key embedded in the app, along with a more secure encryption configuration.

2. Stronger PIN security
   The app PIN uses a security configuration that does not meet current recommendations. Increasing the number of processing rounds would significantly raise the cost of unauthorized PIN recovery from extracted files.

Technical Context

App Type: Personal finance and budget tracking, high data sensitivity
Classes Analyzed: 308
Third-Party Services: 14
Context Tags: financial, sensitive_data

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Reflective Technologies ApS
Version: 1.22.10 (versionCode 2228)
Analysis Date: 2026-06-13
Package: com.monefy.app.lite

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.22.10 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors