# Security & Privacy Scorecard

## EveryDollar: Budget Management

## What This Means for You

Your name, phone number, birth date, and subscription purchase history are shared with third-party marketing platforms, building a detailed financial profile beyond the app itself.

## Recommendation: Acceptable

EveryDollar applies strong encryption and blocks all unencrypted connections, keeping your financial data secure in transit. The app shares your name, phone number, birth date, and subscription purchase history with marketing and attribution platforms, which extends your data footprint to third parties. For users focused on budgeting tools and comfortable with this data sharing, the app's core security practices are solid.

**Best For:** Users who trust Ramsey Solutions' ecosystem and prioritize budgeting features over data minimization with third-party marketing platforms

## Key Findings

**Data Security** - 1 finding (1 medium)

**Network Security** - 0 findings

**Code Safety** - 2 findings (1 high, 1 medium)

**Privacy** - 3 findings (1 high, 1 medium, 1 info)

## Privacy Concerns

### What Data is Collected

- Personal information: name, email address, phone number, and date of birth shared with Braze for marketing purposes
- Financial information: subscription purchase amounts and purchase history shared with Braze and AppsFlyer
- Device and usage data: app interaction and install attribution data sent to AppsFlyer
- Location data: home city and geographic coordinates may be shared with Braze

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Braze - Marketing engagement platform; receives your name, email, phone number, birth date, and subscription purchase details
- AppsFlyer - Install attribution analytics; receives your subscription purchase history to support cross-app audience tracking
- Firebase - Push notifications and app connectivity
- Zendesk - Customer support communications
- Optimizely - Feature experimentation and personalization
- Plaid Link - Bank account connection (user-initiated, core feature)

## Understanding the Scores

**Security:** 83/100
**Privacy:** 79/100

### Security Breakdown

- **Data Security:** 80/100 - Financial data and account information are well-protected using encrypted storage, though one third-party component used in bank-connection flows stores login information without additional application-layer encryption
- **Network Security:** 100/100 - All network traffic is encrypted and unencrypted connections are blocked globally throughout the app
- **Code Safety:** 78/100 - The app implements secure authorization flows and encrypted storage, though two third-party SDK components introduce exposure risks during active bank-connection sessions

### Privacy Breakdown

- **Data Collection:** 86/100 - The app collects the personal details needed to operate a budget manager, with name, birth date, and phone number also used for marketing platform engagement
- **Data Sharing:** 79/100 - Personal information and subscription purchase history are shared with marketing and attribution platforms, which extends your data footprint beyond Ramsey Solutions
- **User Control:** 89/100 - Data deletion is supported, and users can request removal of their information through the developer

## Positive Security Features

- All network traffic is encrypted; unencrypted connections are disabled globally throughout the app
- Automatic cloud backup is disabled, preventing financial data from being saved to Google Drive
- The app is protected against analysis or modification in release builds
- Account information and session data are protected using hardware-backed encrypted storage
- Bank account connections use a properly scoped authorization protocol that resists unauthorized session takeover
- No private server keys or secret configuration files were found embedded in the app
- Standard operating system certificate validation is used without custom overrides

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Reduce marketing data scope**
   Limiting the personal information shared with marketing platforms to identifiers needed for communication, rather than full profile data including birth date, phone number, and purchase amounts, would better align with data minimization principles.

2. **Purchase history data minimization**
   Subscription data forwarded to attribution platforms for analytics could be scoped to event counts rather than detailed purchase history that can be correlated across apps.

### Security Enhancements

1. **Bank-connection session storage**
   Login information cached during bank-connection sessions could be stored with additional application-layer encryption beyond the default app sandbox protection.

2. **Third-party SDK isolation during bank flows**
   Components handling bank-connection screens and serving web-based in-app content from third-party servers could be further sandboxed to limit exposure if a third-party service were compromised.

## Technical Context

**App Type:** Personal finance and budget management (financial data, high sensitivity)
**Classes Analyzed:** 13,318
**Third-Party Services:** 14 identified
**Context Tags:** financial, sensitive_data

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Ramsey Solutions (The Lampo Group, LLC)
**Version:** 2026.6.110 (versionCode 3161)
**Analysis Date:** 2026-06-13
**Package:** com.everydollar.android

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 2026.6.110 analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors