Revolut – Kids & Teens Security & Privacy Scorecard

Android

83
Overall trust score
Trustworthy
86
Security
82
Privacy

Usage data and crash reports are shared with Firebase Analytics and Crashlytics. The app uses encrypted local storage and biometric authentication to protect financial data on the device. Ad tracking is opted out unconditionally, and data sharing with third parties is limited compared to most financial apps.

Best for

Families managing kids' finances with standard analytics

Findings

  • 0 critical
  • 0 high
  • 6 medium
  • 3 low
  • 0 info

1 issue identified across security and privacy analysis.

Top security issues

  • Debug authentication flow with production API endpoints compiled into release APK, bypassable via Frida runtime instrumentation
  • SQLCipher database passphrase derived from MD5 hash of device installation ID — no salt, no key stretching
  • Biometric KYC verification token database stored in plaintext Room database, missing SQLCipher encryption applied to all other app databases

Top privacy issues

  • Firebase Analytics and internal device identifier tracking (installationId, hardwareId) run without child-specific consent gate, violating COPPA and GDPR-K for minor users
  • Advertising framework permissions (AD_MANAGER_APP, ACCESS_ADSERVICES_AD_ID) declared in child-directed app with no child-directed treatment flags — brings app into COPPA/Families Policy scope
  • Analytics pipeline uses IAB TCF adult GDPR consent framework only; no code path disables Firebase Analytics based on child vs. parent account type

Full analysis

Revolut - Kids & Teens

What This Means for You

Your child's account data travels through analytics services that lack age-specific consent controls required for users under 13, and a disabled developer feature left in the app could allow account access on a compromised device.

Recommendation: Use With Caution

Contains COPPA compliance concerns and a debug authentication flow that could be bypassed via runtime instrumentation. Review Revolut's current privacy practices for children under 13 before use.

Best For: Parents seeking supervised teen spending who accept standard fintech analytics and are comfortable with Revolut's existing security controls

Key Findings

Data Security - 4 findings (2 medium, 1 low, 1 info)

Network Security - 2 findings (1 medium, 1 info)

Code Safety - 5 findings (1 medium, 2 low, 2 info)

Privacy - 3 findings (2 medium, 1 info)

Privacy Concerns

What Data is Collected

  • Personal information: name, phone number, identity documents for KYC verification
  • Financial information: account balances, transaction history, spending analytics
  • Device information: persistent device and installation identifiers collected on every analytics event
  • Biometric data: biometric verification tokens generated during identity verification
  • Location data: location used for maps and payment features
  • Usage data: in-app interactions, preferences, spending patterns

Third-Party Data Sharing

The following third parties may receive your data:

  • Google Firebase - analytics, crash reporting, performance monitoring, and push notifications
  • Google AdServices - advertising identifier access declared in the app (no active ad-serving code found, but permissions are present)
  • Google Maps - location and mapping features
  • hCaptcha - bot and fraud prevention during sign-in

Understanding the Scores

Security: 86/100
Privacy: 82/100

Security Breakdown

  • Data Security: 78/100 - Most databases are encrypted using strong keys, but one database holding biometric verification data is not, and the legacy encryption setup for the main database uses a weaker approach
  • Network Security: 94/100 - All traffic is encrypted in transit with no cleartext exceptions, and server authentication is correctly enforced throughout
  • Code Safety: 90/100 - Strong anti-tamper and integrity protections are in place, though a disabled developer login feature remains compiled into the app and a server-controlled toggle can disable screen capture protection

Privacy Breakdown

  • Data Collection: 84/100 - The app collects persistent device identifiers for analytics without distinguishing between child and adult users, and advertising framework permissions are declared with no child-directed treatment configured
  • Data Sharing: 90/100 - The developer declares no third-party data sharing in the Play Store listing; analytics and crash data flows to Google Firebase services
  • User Control: 85/100 - Parents have supervision controls over spending and card management; data deletion is supported; parental consent is required for account creation below the age of data consent threshold

Positive Security Features

  • All network traffic is encrypted in transit with no cleartext exceptions configured
  • Server authentication is enforced throughout with no SSL bypass found in the code
  • Biometric authentication uses hardware-backed keys with cryptographic binding, ensuring biometric data never leaves the secure hardware
  • Anti-tamper and integrity verification protections detect unauthorized modifications to the app
  • Backup access via USB is disabled, preventing data extraction through that channel
  • Ad tracking is limited by default across all analytics events as a built-in control
  • Screen capture protection is active on sensitive financial screens by default
  • The data sharing channel between this app and the parent Revolut app is protected by a signature-level permission, meaning only official Revolut apps can access it

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. Age-Gated Analytics Consent
    The analytics pipeline, including device identifier collection, should check whether the account holder is a child before initializing tracking. The current adult consent framework (IAB TCF) does not satisfy COPPA or GDPR requirements for minors. A child account type check before enabling analytics would address this gap.

  2. Child-Directed Treatment for Advertising Permissions
    Advertising-related permissions and the Ad Manager flag are present in the app but appear unused. Removing these permissions, or adding explicit child-directed treatment flags, would eliminate the compliance risk if ad-serving code is introduced in a future update.

Security Enhancements

  1. Consistent Database Encryption
    The biometric verification database could be encrypted using the same approach already applied to all other databases in the app. This would ensure consistent protection across all locally stored sensitive data.

  2. Debug Code Removal from Production Builds
    The developer authentication flow, which includes live production account access paths, should be excluded at build time from production releases rather than relying on a runtime environment check. Compile-time exclusion removes the code entirely from production devices.

Technical Context

App Type: Children's financial app (fintech, supervised spending for teens and kids)
Classes Analyzed: 36,843
Third-Party Services: 27 identified
Context Tags: financial, sensitivedata, children, identityverification, biometric, location, nfc, coppa, gdpr

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Revolut Ltd
Version: 5.110 (versionCode 511009258)
Analysis Date: 2026-05-26
Package: com.revolut.junior

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on APK version 5.110 analyzed on 2026-05-26
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors

Versions & scan history

ScanDateOverall score
#1 (current) 83/100