Scan results

Recommendation: TRUSTED

CITT found strong privacy architecture in this build: no third-party analytics SDKs, ad networks, or tracking identifiers are present in the binary. Passwords are protected with strong encryption and biometric authentication, and browsing data remains on the device. Anonymous first-party telemetry capability is present but the binary indicates it carries no personal information or search content.

Key Findings

Data Security: 0 findings

Network Security: 0 findings

Code Safety: 2 findings (2 low)

Privacy: 0 findings

Privacy Concerns

What Leaves the Device

First-party anonymous usage telemetry capability is present in this build; the binary indicates no personal information, search queries, or persistent device identifiers are involved, but whether data is sent during use was not observed in this static analysis.

What Stays on the Device

• Browsing history (URLs, page titles, visit counts, and timestamps): stored locally in an on-device database. Users who back up to iCloud should be aware that the browsing history database may be included in those backups under the default configuration.
• Saved passwords: kept on the device, protected with strong encryption and biometric authentication.
• Tracker block statistics: processed and retained on the device with no evidenced off-device reporting.
• VPN configuration: stored locally in the device Keychain.

Third-Party Data Sharing

No third-party data sharing was identified in this analysis.

Understanding the Scores

Security: 96/100
Privacy: 94/100

Security Breakdown

• Data Security: 88/100. Passwords are stored with application-layer encryption and a biometric-protected key hierarchy. Browsing history is held in a local on-device database; Keychain accessibility configuration and backup scope for the browsing store are noted in Areas for Improvement below.
• Network Security: 100/100. HTTPS upgrades are applied before outbound connections are established via a bundled upgrade filter, and no network security gaps were identified in this build.
• Code Safety: 97/100. Strong code safety posture throughout this build. Two low-severity observations about URL scheme input handling are noted in Areas for Improvement.

Privacy Breakdown

• Data Collection: 98/100. This build contains no advertising, analytics, or crash-reporting SDKs. Anonymous first-party telemetry carries no personal information, no search content, and no persistent device identifiers.
• Data Sharing: 100/100. No data-sharing relationships with third parties were identified in this build.
• User Control: 99/100. The Fire Button function deletes the on-device browsing history database entirely. Cross-device sync uses end-to-end encryption with user-controlled keys.

Positive Security Features

• This build bundles no third-party analytics, advertising, or crash-reporting SDKs, and no third-party data flows were identified.
• No persistent cross-app tracking identifiers are used anywhere in this build.
• Browsing history and tracker block statistics remain on the device with no evidenced reporting to external servers.
• Saved passwords are protected with application-layer encryption and a biometric-protected key hierarchy.
• Cross-device sync in this build uses end-to-end encryption with a memory-hard key derivation function, providing strong protection for synced data.
• HTTPS upgrades are applied via a bundled filter before outbound connections are established, reducing exposure to cleartext redirects.
• The Fire Button function deletes the on-device browsing history database entirely, giving users a strong on-device privacy control.
• Data sharing across browser extensions is scoped to the developer's own Team ID; third-party extensions are not granted access to shared containers in this configuration.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Extension Privacy Manifests - API Declaration Gaps
   Apple's Required Reasons API framework (documented at developer.apple.com/documentation/bundleresources/privacy-manifest-files) requires that apps declare which Required Reasons APIs their extensions use in an accompanying privacy manifest. This build's VPN tunnel and widget extensions each include a privacy manifest file, but those manifests appear to omit the NSUserDefaults API declaration. Whether this gap affects the App Store privacy label for those extensions could not be determined from the binary alone. Adding the missing declarations would make those manifests more complete.

2. Browsing History and iCloud Backup
   Apple recommends applying the highest available file protection to sensitive data stores. The on-device database holding browsing history (URLs, titles, timestamps, visit counts) in this build uses the default file protection level, which means an iCloud backup may include that data. Users who want browsing history excluded from iCloud backups may wish to verify whether DuckDuckGo excludes this data from backups in the app or iOS Settings.

Security Enhancements

1. Keychain Accessibility for Sensitive Items
   Industry best practice recommends configuring Keychain items that hold VPN keys, subscription data, or login data with the highest device-bound accessibility class, so those items remain on the originating device and are not eligible for migration via iCloud Keychain.

2. URL Scheme Input Handling
   The URL scheme handler in this build dispatches to internal views including the password manager UI without confirming which app triggered the request. Applying input validation to scheme-triggered actions that open sensitive UI would reduce the surface available to other installed apps.

Technical Context

App Type: Privacy-focused browser with integrated VPN and password manager (high sensitivity)
Classes Analyzed: 38
Third-Party Services: 6 (utility libraries: GRDB, Lottie, JWTKit, ZIPFoundation, Kingfisher, Gzip)
Context Tags: privacy, browser, vpn, password_manager, sensitive_data

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: DuckDuckGo
Version: 7.236.0 (Build 18)
Analysis Date: 2026-09-10
Package: com.duckduckgo.mobile.ios

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 7.236.0 (Build 18) analyzed on 2026-09-10
• May not reflect server-side security controls
• Cannot detect all runtime behaviors