MyMoney—Track Expense & Budget Security & Privacy Scorecard

MyMoney—Track Expense & Budget

What This Means for You

Your backup files can be read by anyone who obtains them, and other apps installed on a shared device may be able to access your complete financial records without your approval.

Recommendation: Acceptable

Backup files use a fixed passphrase that is identical for every user, so a backed-up file is readable by anyone who knows how the app works. A design in the migration feature also allows other installed apps to access your full transaction history without prompting you. For solo users on secured devices who keep backups in private storage, the app is a solid and privacy-respecting choice.

Best For: Solo users on secured devices who keep backups in private storage

Key Findings

Data Security - 2 findings (1 high, 1 medium)

Network Security - 0 findings

Code Safety - 1 finding (1 medium)

Privacy - 0 findings

Privacy Concerns

What Data is Collected

• Financial records (transactions, account balances, budgets): accessed on your device and stored locally, never sent off-device
• App performance data: may be sent to Google if you choose to opt in to crash reporting
• Device identifiers: may be sent to Google if you opt in to crash reporting

Third-Party Data Sharing

The following third parties may receive your data:

• Google (Firebase): crash reports and basic device information, only if you explicitly opt in to crash reporting

No advertising or behavioral tracking data is shared with any third party.

Understanding the Scores

Security: 75/100
Privacy: 92/100

Security Breakdown

• Data Security: 60/100 - Financial records are stored without additional encryption, and backup files use a fixed passphrase shared by all users, making backed-up data more vulnerable if files leave your device.
• Network Security: 100/100 - All network communication is encrypted in transit and no unprotected connections are permitted.
• Code Safety: 82/100 - The app is built with a minimal network footprint and no browser components, though a migration feature can be triggered by other installed apps under certain conditions.

Privacy Breakdown

• Data Collection: 100/100 - Your financial data stays entirely on your device.
• Data Sharing: 100/100 - No advertising, analytics, or tracking services are present.
• User Control: 100/100 - You have complete control over your data, with crash reporting available only if you choose to enable it.

Positive Security Features

• System-level Android backup is disabled, preventing automatic cloud backup of your financial records
• All network connections require encryption in transit with no unprotected connections permitted
• No advertising, analytics, attribution, or social login services are included in the app
• Crash reporting is disabled by default and requires your explicit opt-in
• Minimal attack surface with no browser components, external link handling, or custom URL entry points
• Backup file encryption uses a structurally sound approach combining authenticated encryption

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Clearer Crash Reporting Disclosure
   The privacy policy could more explicitly describe what data is included in crash reports and how long it is retained by Google.

2. User-Controlled Data Deletion
   The Play Store data safety section notes that data cannot be deleted. Providing a clear in-app data wipe option would improve transparency and user control.

Security Enhancements

1. Unique Backup Passphrase per User
   Backup files currently use a fixed passphrase that is identical for all users. Allowing users to set their own backup password would ensure that only they can restore their data.

2. Migration Feature Access Control
   The migration feature should verify that the requesting app is trusted before providing access to financial data, rather than relying on a parameter that any installed app can supply.

Technical Context

App Type: Personal finance tracker — sensitive financial data
Classes Analyzed: 2,400
Third-Party Services: 6 identified (Firebase Crashlytics, Firebase Installations, Firebase Sessions, Firebase Data Transport, Google Play Services, AndroidX DataStore)
Context Tags: financial, sensitive_data

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Ananta Raha
Version: 6.2-free (versionCode 53)
Analysis Date: 2026-06-13
Package: com.raha.app.mymoney.free

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 6.2-free analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors