'%3e%3cpath%20d='M138%2095.6436V147H0V0H138V51.3564H59.3526V95.6436H138Z'%20fill='white'/%3e%3cpath%20d='M208%200V147H150V0H208Z'%20fill='white'/%3e%3cpath%20d='M361%200V51.4292H321.377V147H261.731V51.4292H220V0H361Z'%20fill='white'/%3e%3cpath%20d='M512%200V51.4292H472.939V147H414.139V51.4292H373V0H512Z'%20fill='white'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_1_12'%3e%3crect%20width='512'%20height='147'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Scan results
Duolingo: Language & Chess
iOSDuolingo is a popular language learning app using gamification and bite-sized lessons to teach multiple languages. It features social learning, offline support, and a freemium model with in-app purchases and advertisements.
Quick Verdict
Best for: Daily language practice with occasional ads
Not For: Users who prefer not to have sessions recorded
What It Means For You
In-app taps and screen interactions are captured by a session replay service. Usage data is shared with over a dozen advertising and analytics companies, including networks linked to Facebook and ByteDance, to serve targeted ads and measure how users installed the app.
Quick Verdict
Best for: Daily language practice with occasional ads
Not For: Users who prefer not to have sessions recorded
What It Means For You
In-app taps and screen interactions are captured by a session replay service. Usage data is shared with over a dozen advertising and analytics companies, including networks linked to Facebook and ByteDance, to serve targeted ads and measure how users installed the app.
Method and Limitations
Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.
Findings (25)
Data Security
2 totalNetwork Security
4 totalCode Security
6 totalPrivacy
10 totalThird-Party Risk
3 totalThird-Party Services
Security Strengths
- ✓Authentication credentials stored in Keychain with kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly — strongest iOS protection
- ✓Firebase Analytics explicitly disabled via FIREBASE_ANALYTICS_COLLECTION_ENABLED: false
- ✓WKWebView only — no legacy UIWebView, no app-defined JavaScript-to-native bridge
- ✓Adjust SDK correctly propagates ATT consent status with GDPR deletion endpoint configured
- ✓AppsFlyer uses ATT-bifurcated domain routing for privacy-safe attribution without consent
Version diff is on the Developer plan. See developer plans.
Context Tags
Package
com.duolingo.DuolingoMobile
Version
7.116.0 (Build 7.116.0.9)
Analysis Date
Apr 1, 2026
Was this analysis helpful?
Feedback helps us improve our analysis
Recommendation: Acceptable
Key Findings
Data Security - 2 findings (1 medium, 1 info)
Network Security - 4 findings (2 high, 1 low, 1 info)
Code Safety - 0 findings
Privacy - 10 findings (5 medium, 5 info)
Privacy Concerns
What Data is Collected
- Screen recordings of in-app taps, swipes, and interactions via a session replay service
- App usage patterns, lesson progress, and in-app engagement behavior
- Device identifiers and advertising IDs used for ad targeting and audience profiling
- Install source and referral data showing how users discovered and installed the app
Third-Party Data Sharing
Data is shared with the following third-party services:
- FullStory - Session replay and behavioral analytics
- Facebook / Meta - Advertising, audience targeting, and attribution (Core, Login, Share, and AEM integrations)
- Adjust - Install attribution and marketing analytics
- Liftoff (Vungle) - In-app advertising
- ByteDance / Pangle - In-app advertising (two separate integrations: CSJ and PAG)
- Xiaohongshu (RedNote) - Social platform integration
- QQ Music - Music platform integration
- AppsFlyer - Marketing attribution and analytics
- Google AdMob - In-app advertising
- Unity Ads - In-app advertising
- Firebase Analytics - Usage analytics (noted as disabled in this version)
- Firebase Crashlytics - Crash reporting
- Sentry - Error and performance monitoring
- Zendesk - Customer support
- Ably - Real-time messaging infrastructure
- Google Sign-In - Authentication
Understanding the Scores
| Category | Score |
|---|---|
| Security | 77/100 |
| Privacy | 78/100 |
| Data Security | 93/100 |
| Network Security | 73/100 |
| Code Safety | 92/100 |
| Data Collection | 82/100 |
| Data Sharing | 84/100 |
| User Control | 84/100 |
Positive Security Features
- Locally stored data is handled responsibly, reflected in a Data Security score of 93 out of 100.
- Application code follows safe development practices, reflected in a Code Safety score of 92 out of 100.
- Data Collection, Data Sharing, and User Control scores all exceed 80 out of 100, indicating above-average privacy practices compared to the broader app ecosystem.
Areas for Improvement
- Two network-level issues pose a moderate risk to user data during transmission. While unlikely to affect routine app use, they represent configurations that fall short of current best practices.
- The session replay service records granular details of how users interact with the app, going beyond typical analytics and giving a third party detailed insight into in-app behavior.
- The advertising and tracking footprint is broad. Over a dozen third-party companies receive data about user activity, including advertising networks with ties to Facebook and ByteDance.
About This Analysis
This scorecard is based on automated static analysis of the application package. Scores reflect the security and privacy posture of the app at the time of analysis and may change with future updates.
App Details
| Field | Value |
|---|---|
| Package | com.duolingo.DuolingoMobile |
| Version | 7.116.0 (Build 7.116.0.9) |
| Platform | Android |
| Scan Date | April 1, 2026 |
| Severity Breakdown | 2 high, 9 medium, 4 low, 10 info |
Right of Reply
Developer not yet contacted