Budget App Privacy Audit

Tracker and permission data comes from Exodus Privacy, a non-profit that performs static analysis on Android APKs and publishes the results. We did not generate these numbers ourselves — we collected, categorised and cross-compared them, and every row links to the underlying report.

A "tracker" is a piece of third-party code whose purpose is to collect data about the user or their usage. Exodus detects these by code signature in the shipped binary. Categories — advertising, profiling, identification, location, analytics, crash reporting — are Exodus's own classification.

What this measures, and what it does not:

• — The presence of tracking code is not proof that data is sold. It shows what the app is technically equipped to collect.
• — Crash reporting and analytics are counted as trackers. Many are benign. That is why we separate advertising, profiling and identification, which are not.
• — This is Android only. iOS builds can differ, and some apps in these categories ship on iOS alone.
• — Figures are for the app version listed, on the date listed. Apps change. We re-check quarterly.
• — Apps with no Android build, including web apps, cannot be analysed this way and are not in the table.

On our own app: BudgetVault is a web app with no Android binary, so it cannot be measured by this method, and we have kept it out of the table rather than score ourselves by a different standard. For the record, our site and app load two analytics services: Google Analytics 4 and Vercel Analytics. Google Analytics receives page views and feature events — for example, that a transaction was added and whether it was income or expense. It never receives amounts, descriptions, categories or balances; those stay in your browser. Our privacy policy lists exactly what each service receives.