Scan results

Recommendation: Trustworthy

Trump Accounts delivers strong account security for managing government-backed children's retirement funds. Login protection uses strong device encryption, all network connections are encrypted, and backup is disabled to prevent unauthorized extraction. Financial account data may be cached without encryption in some on-device storage areas, and an ad-attribution service sends a commercial signal when a child's account is first funded.

Key Findings

Data Security: 1 finding (1 low)

Network Security: 1 finding (1 medium)

Code Safety: 5 findings (3 medium, 2 low)

Privacy: 2 findings (2 medium)

Privacy Concerns

What Leaves the Device

• Advertising identifier and first-account-funding conversion event: sent to Singular for ad attribution
• App usage and performance analytics: sent to Firebase Analytics, Firebase Performance, and Firebase Sessions
• Crash and error reports: sent to Firebase Crashlytics and Sentry
• Financial account linking data: processed by Plaid
• Payment processing data: handled by Stripe
• In-app survey responses: sent to Sprig (UserLeap)

What Stays on the Device

• Identity document scans for account verification are processed entirely on the device by Google ML Kit and are not sent to any third party.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Firebase (Google) - analytics, crash reporting, performance monitoring, push notifications, and remote configuration
• Singular - ad attribution and install conversion tracking
• Stripe - payment processing
• Plaid - financial account linking
• Sentry - error and performance monitoring
• Sprig (UserLeap) - in-app surveys
• Twilio Conversations - in-app customer support chat
• Persona - identity verification
• Google Maps / Google Places - location services
• Bitdrift Capture - observability and logging
• PairIP - licensing and entitlements

Understanding the Scores

Security: 83/100
Privacy: 82/100

Security Breakdown

• Data Security: 78/100. Financial account information may be cached in on-device storage without encryption in some areas, making it accessible on a physically compromised device.
• Network Security: 93/100. All network connections use secure HTTPS exclusively, with no cleartext traffic permitted. Login session data is restricted to Robinhood's own domains.
• Code Safety: 85/100. Several embedded web interfaces have access surfaces broader than their stated purpose, though practical exploitation requires additional conditions to be met.

Privacy Breakdown

• Data Collection: 86/100. Analytics, performance, crash, and attribution data are sent to multiple third-party services. An advertising identifier and a first-account-funding event are shared with a commercial attribution vendor.
• Data Sharing: 90/100. Data sharing is scoped to functional and analytics services. Login session data is restricted to Robinhood's own infrastructure and cannot reach third-party servers.
• User Control: 89/100. Account deletion is supported and data deletion can be requested from the developer. The attribution SDK ships in every install and requests advertising ID permissions regardless of the remote killswitch setting, which limits user control over attribution data.

Positive Security Features

• Login sessions and account access are protected by strong encryption backed by the device's secure hardware
• App backup is disabled, preventing account data from being extracted via cloud backup or USB transfer
• In-app support chat history is encrypted on the device
• Login session data is restricted to Robinhood's own domains and cannot reach third-party servers
• All network connections use HTTPS exclusively with no cleartext traffic permitted
• Identity document scanning for account verification is processed entirely on the device

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Complete the Data Safety disclosure
   The Google Play Data Safety section does not name Singular as a data recipient or describe that advertising identifiers and account-funding conversion signals are shared with a commercial attribution company. Updating the disclosure to name Singular explicitly would give users a complete picture.

2. Limit attribution SDK shipping footprint
   The Singular attribution SDK is included in every installed copy and requests advertising ID permissions regardless of whether the remote killswitch is enabled. Shipping the SDK only to users who have affirmatively consented to marketing communications would better match the governance expectations of a government-program app for children.

Security Enhancements

1. Restrict file sharing scope
   The file provider used to share downloaded account statements and tax documents covers the entire external storage area rather than a specific folder. Scoping it to the app's dedicated document directory would limit what other apps can access when receiving a shared file.

2. Lock the custom navigation scheme
   The app's internal navigation scheme cannot be cryptographically verified, which allows other installed apps to potentially send navigation triggers to the app. Migrating all navigation to HTTPS App Links would close this gap.

Technical Context

App Type: Government-sponsored children's retirement account management (financial, high sensitivity)
Classes Analyzed: 56,932
Third-Party Services: 23
Context Tags: financial, sensitive_data, government, ads, camera

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Department of the Treasury
Version: 2026.29.0 (versionCode 20262900)
Analysis Date: 2026-07-29
Package: gov.trumpaccounts.goldeneagle

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 2026.29.0 analyzed on 2026-07-29
• May not reflect server-side security controls
• Cannot detect all runtime behaviors