<!-- TRUSTEDVERDICTHEADER -->

Did not meet TRUSTED criteria

The app was assessed and did not meet all of the criteria for the TRUSTED mark. The specific items are listed below so the result can be weighed before installing.

Trust Pillars

• Secure by Design: Not met. Did not meet one criterion in this area.
• Data Respect: Critical issue. Has a high-severity open item in this area, detailed below.
• Honest Experience: Critical issue. Has a high-severity open item in this area, detailed below.
• User Control: Strong. Strong result in this area.
• Child-Safe: Critical issue. Has a high-severity open item in this area, detailed below.

---

<!-- /TRUSTEDVERDICTHEADER -->

Security & Privacy Scorecard

Trump Accounts: Official App

What This Means for You

A child's IRA funding event and advertising identifier are transmitted to a commercial marketing attribution vendor at app launch without a parental consent gate, and behavioral data linked to account identity may be sent to a third-party UX research platform.

Recommendation: Solid

This mandated government app for children's retirement accounts has sound foundational security: account sign-in data is protected by device hardware-backed encryption, and all production traffic uses modern transport protection with no cleartext exceptions. The main gap is that advertising and analytics SDKs transmit data tied to a child's financial activity to commercial third parties without an age-appropriate consent step. Families who qualify for Trump Accounts have no alternative to this platform, and the core financial security architecture is solid.

Best For: Parents and guardians required to manage their child's Trump Account through this government-designated platform.

Key Findings

Data Security - 1 finding (1 high)

Network Security - 3 findings (2 medium, 1 low)

Code Safety - 5 findings (1 high, 1 medium, 3 low)

Privacy - 3 findings (1 high, 1 medium, 1 low)

Privacy Concerns

What Data is Collected

• Account and identity information (name, Social Security Number, financial data): shared with Robinhood's servers to operate the account
• Advertising identifier: sent to Singular for marketing attribution, linked to financial account funding events
• Behavioral data and survey responses: may be sent to Sprig (UserLeap), tied to Robinhood account identity
• Mobile network carrier type and name: sent to error and performance monitoring services
• Location data: accessed on the device for address verification; network-based location may also be used

Third-Party Data Sharing

Third parties that may receive data from the app:

• Singular - advertising attribution; receives advertising identifier and financial account funding events
• Google Firebase - analytics, crash reporting, performance monitoring, and push notifications
• Sprig (UserLeap) - UX research; may receive behavioral data and session recordings linked to account identity
• Sentry - error reporting and crash diagnostics
• Bitdrift Capture - performance and network monitoring
• Stripe - payment processing
• Plaid Link - bank account linking for external contributions
• Google Maps / Places - address verification and location services

Understanding the Scores

Security: 75/100
Privacy: 70/100

Security Breakdown

• Data Security: 59/100. Account sign-in data is protected by device hardware-backed encryption on supported devices. On older or edge-case devices where this hardware protection is unavailable, a fallback path may rely on a weaker mechanism, leaving account sign-in data potentially less secure.
• Network Security: 80/100. All production traffic is secured with modern transport protection and no cleartext exceptions. The release build includes development infrastructure addresses compiled in, a minor information disclosure.
• Code Safety: 82/100. Modern Android components are used throughout, and memory diagnostics tools are correctly disabled in the release build. Several internal components can be accessed by co-installed apps, and a development feature that can redirect all API traffic to an arbitrary server is present in the release build.

Privacy Breakdown

• Data Collection: 67/100. Advertising identifiers and financial lifecycle events are transmitted to a commercial attribution vendor at launch, without an age-appropriate consent step before transmission.
• Data Sharing: 76/100. Data is distributed across multiple third-party platforms including marketing attribution, UX research, analytics, and error reporting services.
• User Control: 82/100. The app supports data deletion requests per the Play Store data safety declaration, and some third-party analytics flows are gated behind functional consent settings.

Positive Security Features

• Production connections to Robinhood's services include additional server identity verification that protects against traffic interception
• Account sign-in data is secured using the device's hardware-backed key storage when available
• Identity document verification for account setup runs entirely on the device; document images are not transmitted to external servers
• All network traffic is required to use encrypted connections with no exceptions configured
• Memory diagnostics tools are fully inactive in the release build, as designed
• No device serial number or IMEI collection was identified in the code

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Age-Appropriate Consent for Advertising Tracking
   Adding a verifiable parental consent step before advertising identifiers and financial lifecycle events are transmitted to attribution and analytics platforms would align with federal children's privacy requirements.

2. Limiting Third-Party Data Flows for Minor Account Holders
   Restricting behavioral data, survey interactions, and session recordings from being sent to commercial UX research platforms when the account beneficiary is a minor would reduce unnecessary commercial data exposure for children.

Security Enhancements

1. Remove Development Backends from Release Build
   The ability to redirect API traffic to custom or staging servers should be confined to development builds; removing it from the production app would eliminate risk on modified devices.

2. Restrict Internal Components
   Several activities accessible to co-installed apps could be restricted by adding permission requirements, limiting exposure to other apps installed on the same device.

3. Remove Staging Infrastructure References
   Internal development server addresses compiled into the release build should be removed to reduce information exposure.

Technical Context

App Type: Government financial app managing children's individual retirement accounts (high sensitivity)
Classes Analyzed: 56,932
Third-Party Services: 21
Context Tags: financial, sensitive_data, government, children, ads, location

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Department of the Treasury
Version: 2026.29.0 (versionCode 20262900)
Analysis Date: 2026-07-23
Package: gov.trumpaccounts.goldeneagle

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 2026.29.0 analyzed on 2026-07-23
• May not reflect server-side security controls
• Cannot detect all runtime behaviors