# Security & Privacy Scorecard

## Budget planner—Expense tracker

## What This Means for You

Your security PIN is stored without protection and your complete budget history is not encrypted on your device, leaving your financial data readable to other apps or anyone with physical access to your phone. Four advertising networks also receive your app usage patterns.

## Recommendation: Acceptable

Acceptable for everyday personal budget tracking on a personal device. The app has meaningful security gaps though: your PIN is saved without secure protection, your financial database is stored without encryption on your device, and an unguarded internal mechanism allows any other installed app to clear your PIN lock without your knowledge. Four advertising networks also receive your app usage patterns.

**Best For:** Casual budget trackers on a personal device who are comfortable with an ad-supported app and do not store highly sensitive payee contact data

## Key Findings

**Data Security** - 5 findings (5 medium)

**Network Security** - 1 finding (1 medium)

**Code Safety** - 4 findings (2 medium, 2 low)

**Privacy** - 1 finding (1 info)

## Privacy Concerns

### What Data is Collected

- Financial records: your expenses, income, accounts, and payee details are accessed on your device and stored locally
- Device identifiers: your device's advertising ID is shared with ad networks and analytics services
- Usage patterns: how you interact with the app may be shared with advertising and analytics partners
- Approximate location: may be shared with advertising networks

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Google AdMob - advertising and ad targeting
- AppLovin MAX - ad mediation and interest-based advertising
- Vungle (Liftoff) - video advertising
- Facebook Audience Network - display and video advertising, cross-app tracking
- Yandex Mobile Ads - advertising
- Singular - install attribution and marketing analytics
- Firebase Analytics - app usage analytics
- Firebase Crashlytics - crash and error reporting

## Understanding the Scores

**Security:** 72/100
**Privacy:** 82/100

### Security Breakdown

- **Data Security:** 65/100 - Your financial database and PIN are stored on your device without protection, making them accessible to other apps or anyone with physical access to your phone.
- **Network Security:** 78/100 - Backend communication uses encrypted HTTPS connections. The Bluetooth data sync feature, however, transmits your financial history without authentication or encryption when active.
- **Code Safety:** 76/100 - Several internal components lack proper access controls, including one that could allow another installed app to reset your PIN lock or cancel your in-app purchases without your authorization.

### Privacy Breakdown

- **Data Collection:** 78/100 - Your financial records stay on your device and are not sent to the developer's servers. Your device ID and app usage patterns are shared with advertising and analytics partners.
- **Data Sharing:** 82/100 - Data shared with third parties is limited to device identifiers and usage signals rather than your actual financial records.
- **User Control:** 82/100 - The app offers PIN and fingerprint lock options so you can control who can access your data on your device.

## Positive Security Features

- All communication with the developer's servers uses encrypted HTTPS connections
- Google Drive backup requires your explicit authorization before syncing, giving you direct control over what is uploaded to your Google account

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Secure On-Device Data Storage**
   Your financial database and authentication PIN would benefit from stronger on-device protection to prevent unauthorized access by other installed apps or in physical access scenarios.

2. **Backup Exclusions for Financial Data**
   Excluding your financial database and PIN settings from automatic Android cloud backups would prevent unintended exposure through backup services.

### Security Enhancements

1. **Screen Capture Protection**
   Enabling screenshot protection on financial screens would prevent your account balances and transaction history from appearing in the device's recent apps view or being captured by other apps.

2. **PIN Reset Authentication Gate**
   The PIN reset mechanism should require verification before clearing your authentication settings, preventing other installed apps from bypassing your lock screen.

## Technical Context

**App Type:** Personal finance and budget tracking (Finance category)
**Classes Analyzed:** 714
**Third-Party Services:** 18
**Context Tags:** financial, ads, sensitive_data, privacy

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** DEEP SPARK LTD
**Version:** 9.0.1 (Build 363265241)
**Analysis Date:** 2026-06-13
**Package:** com.colpit.diamondcoming.isavemoney

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 9.0.1 analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors