<!-- TRUSTED_VERDICT_HEADER -->
# Not yet TRUSTED

One area below did not meet the trust standard, so the app is not TRUSTED yet.

## Trust Pillars

- **Secure by Design**: Under review. We could not fully verify this area yet.
- **Data Respect**: Needs work. Falls short of our standard here and needs improvement.
- **Honest Experience**: Needs work. Falls short of our standard here and needs improvement.
- **User Control**: Strong. Meets a high bar in this area.
- **Child-Safe**: Not applicable. Does not apply to this app.

---
<!-- /TRUSTED_VERDICT_HEADER -->

# Security & Privacy Scorecard

## com.hammer.simplebudget

## What This Means for You

Usage data and device activity may be shared with the app developer and the services it integrates with. The category summary below shows the scope so people can decide whether it fits their needs.

## Recommendation: Solid

This app has some areas that could be strengthened but rests on a solid foundation for typical use.

**Best For:** Casual budgeters comfortable with PostHog analytics and Sentry crash reporting who don't use iTunes or Finder backups

**Avoid If:** Privacy-conscious users or anyone who backs up to iTunes/Finder — auth tokens and financial data are accessible in unencrypted backups without a jailbreak

## Key Findings

**Data Security:** 4 findings (1 medium, 1 low, 2 info)

**Network Security:** 4 findings (2 low, 2 info)

**Code Safety:** 0 findings

**Privacy:** 6 findings (1 medium, 4 low, 1 info)

## Privacy Concerns

### What Data is Collected

Review the app's store listing and in-app privacy notices for a full data collection disclosure.

### Third-Party Data Sharing

**The following third parties may receive user data:**
- Capacitor (Ionic)
- Sentry
- PostHog
- RevenueCat
- Quiltt
- Capawesome LiveUpdate
- Supabase
- Alamofire
- ZIPFoundation
- Apple AdServices (AAAttribution)

## Understanding the Scores

**Security:** 78/100
**Privacy:** 75/100

### Security Breakdown

- **Data Security:** 79/100. How the app handles stored data.
- **Network Security:** 92/100. How the app handles data in transit.
- **Code Safety:** 79/100. Overall code hygiene signals.

### Privacy Breakdown

- **Data Collection:** 77/100. Scope of data collected.
- **Data Sharing:** 83/100. Third-party data sharing behavior.
- **User Control:** 80/100. Controls the app offers over personal data.

## Positive Security Features

- PostHog screen recording is explicitly disabled in the production build
- Sentry Replay masks all text and blocks bank-linking UI even when session replay is active
- Bank OAuth connector uses robust three-layer origin validation preventing cross-origin message injection

## Areas for Improvement

- Review the category summary above for where the app could strengthen its practices.
- Keep the app updated to receive the latest security improvements from the developer.

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on mobile applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Unknown developer
**Version:** 6.3.0 (Build 1783613054)
**Analysis Date:** 2026-07-15
**Package:** com.hammer.simplebudget