Scan results

Recommendation: Acceptable with Awareness

An excellent browser for protecting your privacy online. The app has a hardcoded authentication value for its internal security service and stores VPN configuration keys without the same strong protection applied to your saved passwords, which could pose risks on a physically compromised device. First-party usage analytics run in the background and cannot be disabled.

Key Findings

Data Security - 1 finding (1 medium)

Network Security - 0 findings

Code Safety - 2 findings (1 medium, 1 info)

Privacy - 6 findings (2 low, 4 info)

Privacy Concerns

What Data is Collected

• Usage data: app interactions, search activity, Duck.ai usage patterns, and feature engagement events tied to a persistent install identifier
• Device information: install cohort, form factor, and behavioral segment classifications (e.g., weekly/monthly active user status)
• Location data: only when you grant permission to a specific website you are visiting - not collected by DuckDuckGo for its own purposes
• Camera and microphone: only when you actively use voice search or the sync QR-code pairing feature

Third-Party Data Sharing

The following third parties may receive your data:

• Google Play - receives install referral attribution data when you first install the app, used by DuckDuckGo to measure campaign performance
• Google Play Billing - processes subscription payments if you purchase a DuckDuckGo subscription plan
• Google Play Services - standard Android platform integration for app distribution and device services

Understanding the Scores

Security: 97/100

Privacy: 91/100

Security Breakdown

• Data Security: 93/100 - Strong encrypted storage for passwords, sync data, and subscription information, with one exception in VPN configuration handling
• Network Security: 100/100 - All connections use strong encryption with no insecure communication patterns found
• Code Safety: 98/100 - Robust code practices throughout, with a hardcoded internal authentication value and a minor autofill interface observation

Privacy Breakdown

• Data Collection: 90/100 - No third-party analytics SDKs; first-party usage telemetry collects behavioral data tied to a persistent identifier
• Data Sharing: 100/100 - No user data shared with advertising networks or third-party analytics companies
• User Control: 84/100 - Strong user controls overall, but first-party usage analytics cannot be disabled from within the app

Positive Security Features

• Zero third-party analytics SDKs bundled - no Firebase, Crashlytics, Mixpanel, Amplitude, Adjust, AppsFlyer, or Facebook SDK present
• No advertising identifier collection anywhere in the app
• Passwords, sync data, email protection data, and subscription information all protected with strong Android-level encrypted storage
• Backup disabled, preventing sensitive data from being extracted via USB debugging
• Web debugging interface disabled in production builds
• Autofill looks up your saved passwords using the real address bar URL, not a value that could be manipulated by a page
• JavaScript-based navigation schemes explicitly blocked to prevent malicious redirects
• No device hardware identifiers (IMEI or equivalent) collected
• Voice search processed entirely on your device - audio is never sent to DuckDuckGo servers
• Camera used exclusively for the sync QR-code pairing flow, with explicit Android permission required

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Usage Analytics Opt-Out
   Users should be given a clear, accessible option to disable first-party usage telemetry, including the persistent install identifier and behavioral event tracking, from within the app's privacy settings.

2. Transparency on Behavioral Profiling
   The scope of Duck.ai interaction tracking (over 150 event types including prompt length and timing patterns) could be more prominently disclosed in the app's privacy settings so users understand what product analytics are collected when using the AI assistant.

Security Enhancements

1. VPN Configuration Storage
   Applying the same strong Android-level encrypted storage used for saved passwords and subscription data to VPN configuration would provide consistent protection for all sensitive app data.

2. Server-Managed Authentication Values
   Moving the internal malicious-site protection authentication value to a server-side configuration system would allow it to be rotated without requiring all users to update the app simultaneously.

Technical Context

App Type: Privacy browser, VPN, and AI assistant - high sensitivity

Classes Analyzed: 33,365

Third-Party Services: 7 (Google Play Billing, Google Play Install Referrer, Google Play Services, SQLCipher, ZXing/JourneyApps, WireGuard Java, Conscrypt)

Context Tags: browser, vpn, privacy, ai_assistant

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: DuckDuckGo

Version: 5.278.1 (build 52781000)

Analysis Date: 2026-05-08

Package: com.duckduckgo.mobile.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 5.278.1 analyzed on 2026-05-08
• May not reflect server-side security controls
• Cannot detect all runtime behaviors