# Security & Privacy Scorecard

## Money Manager: Expense Tracker

## What This Means for You

Your financial data stays entirely on your phone with no developer server involved, though third-party analytics services send session information to Google automatically and your financial screens can be captured by screen-recording apps.

## Recommendation: Trustworthy

A solid local-first expense tracker where your financial information stays on-device. Effective for budgeting, savings goals, and comprehensive money management.

**Best For:** Anyone wanting a capable expense tracker that keeps financial records on their device rather than sending them to a developer-owned server.

## Key Findings

**Data Security** - 2 findings (1 medium, 1 info)

**Network Security** - 0 findings

**Code Safety** - 0 findings

**Privacy** - 1 finding (1 info)

## Privacy Concerns

### What Data is Collected

- Financial records (transactions, budgets, savings goals, debts): accessed on your device and not sent to any developer server
- Advertising identifier: shared with Google AdMob for ad targeting (requires your consent before activation)
- App session and usage data: shared with Firebase Analytics automatically in the background
- Crash reports: shared with Firebase Crashlytics to help the developer identify and fix issues
- Financial database backup: optionally uploaded to your personal Google Drive account if you enable the backup feature

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Google AdMob - advertising (consent required before ads are activated)
- Firebase Analytics (Google) - automatic session and usage telemetry
- Firebase Crashlytics (Google) - crash and error reporting
- Google Drive - optional financial data backup to your personal Google account

## Understanding the Scores

**Security:** 92/100
**Privacy:** 87/100

### Security Breakdown

- **Data Security:** 84/100 - Your financial information is kept on your device with no developer backend. Financial screens may be captured by screen-recording tools, and the app-lock passcode could be accessible on a physically compromised device.
- **Network Security:** 100/100 - All network communications use secure encrypted connections with no insecure overrides.
- **Code Safety:** 100/100 - Strong code protections are applied throughout, with no dangerous permissions requested.

### Privacy Breakdown

- **Data Collection:** 85/100 - Your financial records stay on your phone with no developer server involved. Standard analytics and advertising identifiers are shared automatically with Google in the background.
- **Data Sharing:** 90/100 - Data sharing is limited to Google's analytics and advertising services, with ads gated behind your explicit consent before activation.
- **User Control:** 90/100 - Premium subscribers bypass ads entirely, and the Google Drive backup is fully optional and uses the minimal authorization scope needed.

## Positive Security Features

- All financial data stays on your device with no developer-owned backend server
- Ad display requires your consent before the advertising SDK activates
- No sensitive permissions requested (no location, camera, contacts, or microphone access)
- Google Drive backup uses secure, minimal-access authorization over an encrypted connection
- All network traffic uses secure encrypted connections
- Code obfuscation applied to the release build for additional protection
- Database queries use parameterized structures to prevent data corruption from malformed input

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Analytics Consent Control**
   Firebase Analytics sends session data to Google automatically, independent of the ad consent flow. Extending the existing consent mechanism to cover analytics as well would give users fuller control over what background information is shared.

2. **Transparent In-App Data Disclosure**
   Clearly documenting all third-party services and the types of information each receives directly within the app's settings or privacy section would help users make more informed choices.

### Security Enhancements

1. **Financial Screen Protection**
   Enabling screen capture restrictions on financial screens and the PIN entry screen would prevent screen-recording tools from capturing account balances, transaction history, and the app-lock passcode.

2. **App-Lock Passcode Storage**
   Applying stronger storage protection to the app-lock passcode would make it more resilient on devices that may fall into unfamiliar hands.

## Technical Context

**App Type:** Personal finance and expense tracking (sensitive financial data)
**Classes Analyzed:** 534
**Third-Party Services:** 14
**Context Tags:** financial, sensitive_data, ads

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** KTW Technologies
**Version:** 11.3 (versionCode 138)
**Analysis Date:** 2026-06-13
**Package:** com.ktwapps.walletmanager

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 11.3 analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors