# Security & Privacy Scorecard

## Fast Budget - Expense Manager

## What This Means for You

Your financial records are protected in transit and secured on your phone, and if you use the free version and opt into personalized ads, your advertising identifier may be shared with Google and Meta.

## Recommendation: Very Secure

Fast Budget secures transactions with HTTPS protection and strong authentication controls. Premium subscribers avoid ads and ad-network tracking, making it a solid option for straightforward budget management.

**Best For:** Users who want a well-secured personal finance tool with strong network protections and optional biometric access

## Key Findings

**Data Security** - 1 finding (1 medium)

**Network Security** - 0 findings

**Code Safety** - 3 findings (1 medium, 2 info)

**Privacy** - 1 finding (1 low)

## Privacy Concerns

### What Data is Collected

- Financial information: transactions, account balances, budgets, debts, and credit card details are accessed and stored on your device
- Usage data: sent to Firebase Analytics only after your explicit consent
- Crash reports: sent to Firebase Crashlytics only after your explicit consent
- Advertising identifier: may be shared with Google and Meta for free-tier users who opt into personalized ads

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Google (AdMob, Firebase) - advertising for free-tier users and optional analytics and crash reporting after consent
- Meta (Facebook Audience Network) - advertising for free-tier users who consent to personalized ads
- Salt Edge - bank account synchronization, if you choose to connect a bank account
- Dropbox - backup of your financial data, if you enable the Dropbox backup feature

## Understanding the Scores

**Security:** 92/100
**Privacy:** 92/100

### Security Breakdown

- **Data Security:** 88/100 - Your financial data is protected by Android's app isolation, optional biometric lock, and an automatic lockout after failed PIN attempts.
- **Network Security:** 100/100 - All communications with the app's servers travel over HTTPS. Unencrypted connections are blocked for external services.
- **Code Safety:** 94/100 - The app uses secure coding practices throughout, including safely constructed database queries and properly scoped permissions.

### Privacy Breakdown

- **Data Collection:** 93/100 - Your financial data stays on your device. Analytics and crash reporting are off by default and only activated with your explicit consent.
- **Data Sharing:** 94/100 - Third-party data sharing is limited to advertising identifiers for free-tier users who consent to personalized ads, plus optional services like backup and bank sync that you choose to enable.
- **User Control:** 100/100 - You can request deletion of your data, and consent for analytics and personalized ads is gathered before anything is shared with third parties.

## Positive Security Features

- All production network connections use HTTPS, and unencrypted connections are blocked for external addresses
- Biometric authentication support lets you lock the app with fingerprint or face recognition
- The app locks automatically after 7 failed PIN attempts, with a 10-minute cooldown
- Firebase Analytics and crash reporting are disabled by default and only enabled after you explicitly consent
- Firebase App Check verifies the authenticity of the app before granting server access
- Cloud backup is disabled by default, keeping your financial data off external storage unless you choose to enable Dropbox backup
- Dropbox backup uses a secure authorization flow with no private keys or secrets stored in the app
- Ad networks are never activated for premium subscribers, so no advertising identifier is shared if you pay for the app
- Database queries are constructed safely throughout, protecting against data corruption from malformed input

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Encrypting the Local Financial Database**
   Using an encrypted database for storing transaction history, credit card details, and debt records would protect your complete financial history on devices subjected to forensic examination or advanced physical access. This would bring the app in line with industry recommendations for sensitive financial data at rest.

2. **Tightening App Link Verification for Authentication Screens**
   Enabling domain ownership verification for the authentication and registration screen links would ensure only Fast Budget can respond to those links, preventing other apps on the same device from potentially interfering with the sign-in flow.

### Security Enhancements

1. **Verified App Links for Sign-In**
   Activating verified handling for authentication-related app links would ensure that only Fast Budget opens those screens, adding an extra layer of protection against link interception by other installed apps.

## Technical Context

**App Type:** Personal finance and expense manager (sensitive financial data)
**Classes Analyzed:** 16,274
**Third-Party Services:** 17 services identified
**Context Tags:** financial, sensitive_data

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** AppFer SRL
**Version:** 7.0.3 (versionCode 26538)
**Analysis Date:** 2026-06-13
**Package:** com.blodhgard.easybudget

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 7.0.3 analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors