Proton Mail: Encrypted Email Security & Privacy Scorecard
Android
Emails are end-to-end encrypted, meaning even Proton cannot read them. Push notifications are delivered through Firebase Cloud Messaging, and crash reports go to a self-hosted Sentry instance rather than a third-party service. Purchases go through Google Play Billing, which shares transaction data with Google.
Best for
Anyone wanting private email with minimal data exposure
Findings
- 0 critical
- 0 high
- 1 medium
- 2 low
- 4 info
1 issue identified across security and privacy analysis.
Top security issues
- Jetpack Compose PreviewActivity Exported in Production Build
- Third-Party Libraries Use Unencrypted SharedPreferences
- JavaScript Enabled in Human Verification WebView
Top privacy issues
- Database and SharedPreferences Encryption Status Unverified
- Icon Disguise Feature (Privacy Enhancement)
- Client-Side API Keys Present in App Resources
Full analysis
Proton Mail: Encrypted Email
ch.protonmail.android | Version 7.7.1 (Build 16244) | Analyzed: March 4, 2026
What This Means for You
Emails are end-to-end encrypted, meaning even Proton cannot read them. Push notifications are delivered through Firebase Cloud Messaging, and crash reports go to a self-hosted Sentry instance rather than a third-party service. Purchases go through Google Play Billing, which shares transaction data with Google.
Recommendation: Very Secure
Best For: Anyone wanting private email with minimal data exposure
Key Findings
Data Security - 2 findings (1 low, 1 info)
Network Security - 0 findings
Code Safety - 0 findings
Privacy - 1 finding (1 info)
Privacy Concerns
What Data is Collected
Push notification delivery requires registration with Firebase Cloud Messaging, which processes delivery data on Google's servers. In-app purchases are handled by Google Play Billing, which collects transaction details. Basic device information is shared with Google Play Services to support core app functionality.
Third-Party Data Sharing
Purchase history and transaction details are shared with Google through Google Play Billing. Push notification delivery data passes through Google's Firebase infrastructure. No advertising networks or behavioral profiling services receive user data.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 97/100 |
| Privacy | 100/100 |
| Data Security | 96/100 |
| Network Security | 100/100 |
| Code Safety | 97/100 |
| Data Collection | 100/100 |
| Data Sharing | 100/100 |
| User Control | 100/100 |
Positive Security Features
- Email content is encrypted end-to-end before it leaves the device, so no one other than the sender and recipients can read it
- Crash and error reports are sent to Proton's own self-hosted infrastructure rather than a commercial third-party service
- No advertising, behavioral profiling, or third-party analytics SDKs are present in the app
- Third-party integrations are limited to infrastructure essentials, with no data shared for marketing purposes
Areas for Improvement
- In-app purchase data, including what is bought and when, flows through Google Play Billing and is subject to Google's data practices
- Push notification delivery routes through Google's Firebase infrastructure, meaning Google handles the delivery path for incoming message alerts
About This Analysis
This scorecard is generated from automated static analysis of the app's compiled code and configuration. It reflects security and privacy practices found in the version analyzed below.
App Details
| App Name | Proton Mail: Encrypted Email |
| Package ID | ch.protonmail.android |
| Version | 7.7.1 (Build 16244) |
| Scan Date | March 4, 2026 |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 98/100 |