# Security & Privacy Scorecard

## Money Manager Expense & Budget

## What This Means for You

Your full transaction history and account balances are stored without encryption on your device, and the optional PC sync feature can expose that data to anyone on your Wi-Fi network without requiring a password by default. Five advertising networks automatically receive your device identifiers each time you open the app, and granting notification access gives this app visibility into every notification from every other app on your phone.

## Recommendation: Acceptable

Suitable for basic personal budgeting on a private device if you do not enable PC Manager or cloud sync. Your financial data remains on your device under normal use, but is not encrypted at rest, and several security gaps could matter if your phone is lost, physically accessed, or connected to shared Wi-Fi. Five ad networks and Firebase analytics run at startup, making this a poor fit for users who want their finances kept separate from advertising systems.

**Best For:** Casual expense trackers who do not use PC Manager or cloud sync, and who are comfortable with ad-supported apps on personal devices

## Key Findings

**Data Security** - 4 findings (3 high, 1 low)

**Network Security** - 2 findings (1 high, 1 low)

**Code Safety** - 3 findings (1 medium, 2 low)

**Privacy** - 4 findings (1 high, 2 medium, 1 info)

## Privacy Concerns

### What Data is Collected

- Device identifiers (advertising ID, device model, carrier): sent to five advertising networks and Google Firebase at app startup
- App usage and performance data: sent to Google Firebase Analytics and Crashlytics
- Financial transaction history, account names, and balances: stored on your device; sent to Realbyte servers only if you opt into cloud sync
- Banking notification text: accessed on your device from your messaging and banking apps when you grant notification access; sent to Realbyte servers if cloud sync is enabled

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Google AdMob - mobile advertising
- AppLovin MAX - mobile advertising
- IronSource/LevelPlay - mobile advertising
- Facebook Audience Network - advertising and cross-app identity linking with your Facebook profile
- Kakao AdFit - mobile advertising
- Google Firebase (Analytics, Crashlytics) - usage tracking and crash reporting
- Realbyte Inc. - cloud backup and data sync (when you enable it)

## Understanding the Scores

**Security:** 70/100
**Privacy:** 75/100

### Security Breakdown

- **Data Security:** 60/100 - Financial records, account details, and app settings are stored without database encryption, and financial screens lack protection against screen capture by other apps.
- **Network Security:** 74/100 - Cloud communications use encrypted connections. The optional PC sync feature sends your data over an unencrypted local connection and does not require a password unless you set one manually.
- **Code Safety:** 89/100 - Strong security practices throughout the codebase. Secure token storage uses the Android device keychain, and the app avoids unsafe SSL handling in all web views.

### Privacy Breakdown

- **Data Collection:** 75/100 - Five advertising networks receive your device identifiers automatically at startup. Financial data the app reads and processes stays on your device unless you opt into cloud sync.
- **Data Sharing:** 85/100 - Data sharing with third parties is limited to advertising and analytics services. Your actual financial transaction data is not shared with any third party.
- **User Control:** 81/100 - You can request data deletion, and optional features like cloud sync and PC Manager require deliberate setup. Google Drive backup is scoped to app files only.

## Positive Security Features

- ADB backup is disabled with comprehensive extraction rules, preventing USB-based data extraction
- Cloud authentication tokens are protected using the Android device keychain with proper per-operation encryption
- All cloud API communications use HTTPS
- Server identity validation is in place for promotion API connections, protecting against unauthorized certificate substitution
- Network security settings restrict trust to authorized certificates, including in environments that install custom certificate authorities
- Google Drive backup accesses only app-specific files, not your full Drive contents
- No account passwords, server secrets, or private keys were found in the app package

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Advertising Consent Dialog**
   Five advertising networks initialize at app startup before any user interaction or consent prompt. Adding a consent management platform would let users make an informed choice before device identifiers are shared with advertising services.

2. **Notification Access Transparency**
   When requesting notification access, the app could more clearly explain which notifications it reads and for what purpose, so users understand the full scope of access they are granting.

### Security Enhancements

1. **Financial Database Protection**
   Encrypting the local financial database would protect your transaction history, account names, and banking data if your device is lost, stolen, or physically accessed by someone else.

2. **PC Manager Authentication and Secure Transfer**
   The PC Manager feature should require a strong password by default and use an encrypted local connection, so that your financial data is not accessible to other devices on the same Wi-Fi network without your explicit authorization.

3. **Screen Capture Protection for Financial Screens**
   Enabling screen protection on transaction, account, and budget screens would prevent other apps with recording permissions from capturing your financial data while the app is in use.

## Technical Context

**App Type:** Personal finance, expense tracking, and asset management with sensitive financial and banking data
**Classes Analyzed:** 35,587
**Third-Party Services:** 21
**Context Tags:** financial, sensitive_data, ads, location

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Realbyte Inc.
**Version:** 4.11.1 GF (versionCode 1167)
**Analysis Date:** 2026-06-13
**Package:** com.realbyteapps.moneymanagerfree

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 4.11.1 GF analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors