# Security & Privacy Scorecard

## Monthly Budget & Expense App

## What This Means for You

Your in-app purchase activity is automatically sent to Facebook, and all your financial records are stored without encryption on your device, where they can be read if your phone is accessed without your permission.

## Recommendation: Acceptable

This is a capable expense tracker for day-to-day budgeting, but its advertised "privacy-focused" and "no data shared" claims are contradicted by how it actually works: Facebook receives your purchase activity automatically, and your financial records are not protected by encryption on your device. Acceptable for casual expense tracking if you understand these tradeoffs.

**Best For:** Casual users who want a simple expense tracker and are comfortable with purchase and usage data being shared with advertising and analytics services.

## Key Findings

**Data Security** - 2 findings (1 high, 1 medium)

**Network Security** - 0 findings

**Code Safety** - 2 findings (1 low, 1 info)

**Privacy** - 3 findings (2 high, 1 medium)

## Privacy Concerns

### What Data is Collected

- Financial records (expenses, budgets, transactions, income): accessed and stored on your device
- In-app purchase history: shared with Facebook and RevenueCat for subscription tracking
- App usage events and interactions: shared with Facebook and Firebase Analytics
- Device identifier: shared with Superwall for paywall management and A/B testing
- Crash and performance data: shared with Firebase Crashlytics

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Facebook - automatic purchase event logging, app usage tracking, and advertising identifier collection
- Firebase (Google) - analytics, crash reporting, authentication, and optional cloud sync
- Superwall - subscription paywall optimization, receives a persistent device identifier linked to your Google account
- RevenueCat - subscription and entitlement management
- Amazon - in-app purchase processing

## Understanding the Scores

**Security:** 80/100
**Privacy:** 72/100

### Security Breakdown

- **Data Security:** 68/100 - Financial records are stored without encryption on your device, and screens displaying your financial data can be captured in screenshots or screen recordings.
- **Network Security:** 100/100 - All network communication is protected by industry-standard encryption, with no cleartext exceptions.
- **Code Safety:** 95/100 - The app is built with strong, modern coding practices and uses current security frameworks throughout.

### Privacy Breakdown

- **Data Collection:** 80/100 - The app collects a moderate set of data, including usage events and in-app purchase details that are sent to third-party services.
- **Data Sharing:** 78/100 - Multiple third-party services receive data, with Facebook receiving purchase activity and Superwall receiving your persistent device identifier.
- **User Control:** 80/100 - You can request data deletion and your data is encrypted in transit to third parties.

## Positive Security Features

- All network traffic uses standard, system-validated encryption with no cleartext exceptions
- No custom security bypass implementations were found in the networking code
- Biometric authentication is available for locking access to the app
- Browser-based paywall views have developer debugging disabled in production

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Accurate Data Sharing Disclosure**
   The Play Store privacy declaration states "No data shared with third parties," but purchase activity is automatically transmitted to Facebook. Updating this declaration to accurately reflect sharing with Facebook, Superwall, Firebase, and RevenueCat would align the disclosure with actual app behavior.

2. **Advertising Access Scope**
   All bundled third-party services are granted access to Android's interest-based advertising features, including interest categories inferred from cross-app browsing behavior. Restricting this access to only the services that require it would reduce unnecessary data exposure for users.

### Security Enhancements

1. **Financial Data Protection**
   Encrypting the local database that stores your financial records would protect your data if your device is lost, stolen, or accessed by data recovery tools. The app already uses secure hardware for biometric authentication, so the infrastructure for stronger data protection is in place.

2. **Screen Capture Protection**
   Preventing screenshots and screen recordings on financial screens would stop other apps and the device task switcher from capturing your expense and budget information.

## Technical Context

**App Type:** Personal finance and expense tracking, sensitive financial data
**Classes Analyzed:** 3,100
**Third-Party Services:** 17
**Context Tags:** financial, sensitive_data, ads

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Amit Mohan
**Version:** 3.19.8 (versionCode 508; Play Store shows 3.19.9)
**Analysis Date:** 2026-06-13
**Package:** com.amitm29.am.dailyexpensesmanager

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 3.19.8 analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors