# Security & Privacy Scorecard

## MoneyCoach

## What This Means for You

Your financial records, including transactions, accounts, credit card statements, and loan data, are stored on your device without the strongest available data protection settings, while your advertising ID is shared with Google Ads in a manner that is not accurately reflected in the app's own privacy disclosures.

## Recommendation: Significant Security Concerns

High-risk findings include a hardcoded internal communication channel exposed in the app binary, an unencrypted financial database, and push notification handling that can load arbitrary web pages inside the app. Users who require strong financial data security or who use modified devices should evaluate alternative apps before trusting MoneyCoach with their full financial picture.

**Best For:** Users comfortable with analytics and advertising tracking who want Apple Wallet integration and open banking budgeting features.

## Key Findings

**Data Security** - 4 findings (1 medium, 1 low, 2 info)

**Network Security** - 3 findings (2 medium, 1 low)

**Code Safety** - 3 findings (1 high, 1 low, 1 info)

**Privacy** - 3 findings (1 medium, 2 info)

## Privacy Concerns

### What Data is Collected

- Financial data: transactions, accounts, credit card details, loan schedules, budgets
- Device information: advertising identifier (IDFA), device model, operating system
- Apple Wallet data: payment card transactions (via FinanceKit with your permission)
- Usage data: in-app interactions, feature engagement, subscription events

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Firebase Analytics - usage and behavior analytics
- Firebase Crashlytics - crash and error reporting
- Google Ads On-Device Conversion - advertising performance measurement, receives device advertising ID
- Mixpanel - behavioral analytics (routed via EU endpoint for GDPR compliance)
- RevenueCat - subscription and purchase management, may receive email and display name
- Branch.io - install attribution and marketing analytics
- SuperwallKit - paywall and subscription offer optimization
- GoCardless (Nordigen) - open banking connections (required for bank account integration)
- Tally.so - in-app forms and surveys

## Understanding the Scores

**Security:** 83/100
**Privacy:** 91/100

### Security Breakdown

- **Data Security:** 72/100 - Financial data stored without the strongest protection settings; some file access controls weaker than expected for a finance app
- **Network Security:** 83/100 - Allows unencrypted connections to its own domain and loads external URLs from push notifications without validation
- **Code Safety:** 82/100 - An internal communication channel is exposed in the production binary; development test files were included in the public release

### Privacy Breakdown

- **Data Collection:** 90/100 - Collects financial and device data appropriate to core features; ATT permission prompt shown before advertising ID access
- **Data Sharing:** 93/100 - Data shared with multiple analytics and advertising services; GDPR-aware routing via Mixpanel EU endpoint
- **User Control:** 93/100 - Standard iOS permission model in use; FinanceKit access can be revoked

## Positive Security Features

- Sensitive items such as session data and signing keys are stored in the iOS Keychain using hardware-backed protection, scoped to a single narrow access group
- No JavaScript-to-native communication bridge is exposed inside the in-app browser, reducing the attack surface for malicious web content
- Apple Wallet access via FinanceKit is accurately described in the permission prompt and properly declared in the app's privacy manifest
- Mixpanel analytics are routed through an EU endpoint, supporting GDPR-compliant data handling
- The advertising identifier access is gated behind Apple's App Tracking Transparency permission prompt

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Accurate Tracking Disclosure**
   The app's privacy manifest currently declares that the device advertising ID is not used for tracking, while the app sends it to Google Ads for conversion measurement. Aligning these declarations with actual data flows would give users accurate information before they consent.

2. **Clearer Disclosure of Analytics Partners**
   The full list of analytics, attribution, and advertising services (including Branch.io, SuperwallKit, and RevenueCat attribution features) could be more transparently surfaced to users before account creation.

### Security Enhancements

1. **Strengthen Financial Data Protection at Rest**
   The financial database and associated files could adopt stronger iOS Data Protection settings so that stored data remains inaccessible when the device is locked, consistent with industry practice for finance applications.

2. **Push Notification URL Validation**
   URLs delivered via push notifications that open in an in-app browser should be validated against an allowlist of trusted domains before loading, preventing crafted notifications from directing users to unexpected web pages.

## Technical Context

**App Type:** Personal finance aggregation and budgeting, high sensitivity
**Classes Analyzed:** iOS binary symbols and headers (static analysis, no Binary Ninja pass)
**Third-Party Services:** 12 identified
**Context Tags:** financial, sensitive_data, ads

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Duuro
**Version:** 11.3 (Build 1156)
**Analysis Date:** 2026-04-17
**Package:** com.duuro.moneyCoach

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 11.3 (Build 1156) analyzed on 2026-04-17
- May not reflect server-side security controls
- Cannot detect all runtime behaviors