# Security & Privacy Scorecard ## Receipt Scanner: Easy Expense ## What This Means for You Your purchase amounts and financial app behavior are shared with five advertising platforms, which may use this data to build profiles for ad targeting. ## Recommendation: Acceptable Effective expense tracker that handles your financial records with solid security practices. Your purchase data and subscription information are shared with five advertising platforms for financial profiling. Acceptable if you prioritize convenience over financial privacy. **Best For:** Users who prioritize convenience and don't mind their subscription costs and financial app behavior shared with advertising platforms ## Key Findings **Data Security** - 3 findings (1 medium, 1 low, 1 info) **Network Security** - 3 findings (1 medium, 1 low, 1 info) **Code Safety** - 7 findings (2 medium, 3 low, 2 info) **Privacy** - 6 findings (3 high, 2 medium, 1 info) ## Privacy Concerns ### What Data is Collected - Account information: Your email address and profile details are sent to Firebase servers for account management and cross-device sync - Expense and receipt data: Your expense records, amounts, merchant names, and receipt photos are uploaded to the app's cloud servers for backup and cross-device access - Advertising identifiers: Your Google Advertising ID is collected by five advertising SDKs including Facebook, Google Analytics, Tenjin, Amplitude, and Google AdServices - Purchase and subscription data: Your subscription plan, price, and transaction details are sent to Tenjin's servers for advertising attribution - Location data: Your location may be collected for mileage tracking features and sent to the app's cloud services - Support chat data: Your name, email, and phone number may be shared with Freshworks when you use the in-app support chat ### Third-Party Data Sharing **The following third parties may receive your data:** - Tenjin - Receives your subscription cost and purchase details for advertising attribution - Facebook - Receives your advertising ID and app usage behavior for ad targeting - Google Firebase Analytics - Receives usage behavior and device identifiers for analytics - Amplitude - Receives analytics events and may receive revenue data - Google AdServices - Receives your advertising ID for interest-based advertising and remarketing - Freshworks (Freshchat) - Receives your name and email when you use in-app support chat ## Understanding the Scores **Security:** 87/100 **Privacy:** 68/100 ### Security Breakdown - **Data Security:** 83/100 - Sensitive account information is protected using your device's hardware-backed secure storage. Some financial data cached for offline use may be included in automatic device backups. - **Network Security:** 87/100 - Network connections use secure protocols and web payment components are configured with strict file access restrictions. - **Code Safety:** 88/100 - The app follows solid engineering practices overall. A payment-related embedded browser component has a broad configuration, and a debugging tool was retained in the production build. ### Privacy Breakdown - **Data Collection:** 68/100 - The app collects your account details, expense records, device identifiers, and potentially location data. Five advertising SDKs also collect your advertising ID. - **Data Sharing:** 78/100 - Expense data is shared with cloud services for sync and backup. Purchase and behavior data are shared with advertising attribution and analytics platforms. - **User Control:** 72/100 - You can request data deletion and access your receipts across devices. Ad tracking consent is enabled automatically before any consent dialog is shown to you. ## Positive Security Features - Sensitive login information is protected using your device's secure hardware chip, making it significantly harder to extract - Web content used for payments is handled with strict restrictions that prevent access to your local files - Receipt images are analyzed on your device for text extraction rather than sent to an external cloud service for processing - Crash reporting data collection is disabled in this build ## Areas for Improvement ### GDPR / CCPA Compliance The app's privacy practices could be strengthened by: 1. **Ad Tracking Consent** All advertising consent signals are pre-enabled in the app's configuration before any consent dialog is shown. EU residents should be asked for explicit permission before advertising data is processed, as required under applicable regulations. 2. **Financial Behavior Sharing Disclosure** Subscription costs and purchase details are shared with an advertising attribution platform linked to your advertising ID. Providing a clear in-app disclosure and opt-out option would give users better control over this data flow. ### Security Enhancements 1. **Offline Data Storage Protection** Financial data stored locally for offline use could be better protected by excluding it from automatic device and cloud backups. 2. **Bank Linking Flow Hardening** The callback handling for bank account linking uses URL patterns that could potentially be registered by another app on the same device. Moving to verified app links would eliminate this risk. ## Technical Context **App Type:** Business expense tracker handling financial records, receipt photos, and bank connections **Classes Analyzed:** 1,400 **Third-Party Services:** 17 **Context Tags:** financial, sensitive_data, location, camera --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy. ### App Details **Developer:** Easy Expense Tracker Inc. **Version:** 5.62.0 (Build 540055909) **Analysis Date:** June 13, 2026 **Package:** com.easyexpense ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 5.62.0 analyzed on June 13, 2026 - May not reflect server-side security controls - Cannot detect all runtime behaviors