# Did not meet TRUSTED criteria The app was assessed and did not meet all of the criteria for the TRUSTED mark. The specific items are listed below so the result can be weighed before installing. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Respect**: Not met. Did not meet one criterion in this area. - **Honest Experience**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Child-Safe**: Critical issue. Has a high-severity open item in this area, detailed below. --- # Security & Privacy Scorecard ## Trump Accounts: Official App ## What This Means for You Login sessions are protected by strong device encryption, and app backup is disabled to prevent extraction. Advertising identifiers and an account-funding event are sent to a commercial attribution vendor each time a child's account receives its first deposit. ## Recommendation: Trustworthy Trump Accounts delivers strong account security for managing government-backed children's retirement funds. Login protection uses strong device encryption, all network connections are encrypted, and backup is disabled to prevent unauthorized extraction. Financial account data may be cached without encryption in some on-device storage areas, and an ad-attribution service sends a commercial signal when a child's account is first funded. **Best For:** Parents and guardians managing a government-backed children's retirement account (Trump Account IRA). ## Key Findings **Data Security:** 1 finding (1 low) **Network Security:** 1 finding (1 medium) **Code Safety:** 5 findings (3 medium, 2 low) **Privacy:** 2 findings (2 medium) ## Privacy Concerns ### What Leaves the Device - Advertising identifier and first-account-funding conversion event: sent to Singular for ad attribution - App usage and performance analytics: sent to Firebase Analytics, Firebase Performance, and Firebase Sessions - Crash and error reports: sent to Firebase Crashlytics and Sentry - Financial account linking data: processed by Plaid - Payment processing data: handled by Stripe - In-app survey responses: sent to Sprig (UserLeap) ### What Stays on the Device - Identity document scans for account verification are processed entirely on the device by Google ML Kit and are not sent to any third party. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Firebase (Google) - analytics, crash reporting, performance monitoring, push notifications, and remote configuration - Singular - ad attribution and install conversion tracking - Stripe - payment processing - Plaid - financial account linking - Sentry - error and performance monitoring - Sprig (UserLeap) - in-app surveys - Twilio Conversations - in-app customer support chat - Persona - identity verification - Google Maps / Google Places - location services - Bitdrift Capture - observability and logging - PairIP - licensing and entitlements ## Understanding the Scores **Security:** 83/100 **Privacy:** 82/100 ### Security Breakdown - **Data Security:** 78/100. Financial account information may be cached in on-device storage without encryption in some areas, making it accessible on a physically compromised device. - **Network Security:** 93/100. All network connections use secure HTTPS exclusively, with no cleartext traffic permitted. Login session data is restricted to Robinhood's own domains. - **Code Safety:** 85/100. Several embedded web interfaces have access surfaces broader than their stated purpose, though practical exploitation requires additional conditions to be met. ### Privacy Breakdown - **Data Collection:** 86/100. Analytics, performance, crash, and attribution data are sent to multiple third-party services. An advertising identifier and a first-account-funding event are shared with a commercial attribution vendor. - **Data Sharing:** 90/100. Data sharing is scoped to functional and analytics services. Login session data is restricted to Robinhood's own infrastructure and cannot reach third-party servers. - **User Control:** 89/100. Account deletion is supported and data deletion can be requested from the developer. The attribution SDK ships in every install and requests advertising ID permissions regardless of the remote killswitch setting, which limits user control over attribution data. ## Positive Security Features - Login sessions and account access are protected by strong encryption backed by the device's secure hardware - App backup is disabled, preventing account data from being extracted via cloud backup or USB transfer - In-app support chat history is encrypted on the device - Login session data is restricted to Robinhood's own domains and cannot reach third-party servers - All network connections use HTTPS exclusively with no cleartext traffic permitted - Identity document scanning for account verification is processed entirely on the device ## Areas for Improvement ### GDPR / CCPA Compliance The app's privacy practices could be strengthened by: 1. **Complete the Data Safety disclosure** The Google Play Data Safety section does not name Singular as a data recipient or describe that advertising identifiers and account-funding conversion signals are shared with a commercial attribution company. Updating the disclosure to name Singular explicitly would give users a complete picture. 2. **Limit attribution SDK shipping footprint** The Singular attribution SDK is included in every installed copy and requests advertising ID permissions regardless of whether the remote killswitch is enabled. Shipping the SDK only to users who have affirmatively consented to marketing communications would better match the governance expectations of a government-program app for children. ### Security Enhancements 1. **Restrict file sharing scope** The file provider used to share downloaded account statements and tax documents covers the entire external storage area rather than a specific folder. Scoping it to the app's dedicated document directory would limit what other apps can access when receiving a shared file. 2. **Lock the custom navigation scheme** The app's internal navigation scheme cannot be cryptographically verified, which allows other installed apps to potentially send navigation triggers to the app. Migrating all navigation to HTTPS App Links would close this gap. ## Technical Context **App Type:** Government-sponsored children's retirement account management (financial, high sensitivity) **Classes Analyzed:** 56,932 **Third-Party Services:** 23 **Context Tags:** financial, sensitive_data, government, ads, camera --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Department of the Treasury **Version:** 2026.29.0 (versionCode 20262900) **Analysis Date:** 2026-07-29 **Package:** gov.trumpaccounts.goldeneagle ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 2026.29.0 analyzed on 2026-07-29 - May not reflect server-side security controls - Cannot detect all runtime behaviors