Google Gemini Security & Privacy Scorecard

Google Gemini

What This Means for You

Your usage, interactions, and location data are linked to your Google account through ongoing telemetry, and the in-app support pages load server-controlled content in a way that could put you at risk if Google's support systems were ever compromised.

Recommendation: Acceptable with Awareness

Trusted app from Google with proper security controls, including Keychain storage for authentication data and device integrity verification. Users should be aware that telemetry is linked to their Google account and that the screen-sharing feature transmits real-time screen content to Google's servers when active.

Best For: Google ecosystem users who want AI assistant features and are comfortable with Google's data practices.

Key Findings

Data Security - 1 finding (1 low)

Network Security - 1 finding (1 low)

Code Safety - 3 findings (1 medium, 1 low, 1 info)

Privacy - 5 findings (1 low, 4 info)

Privacy Concerns

What Data is Collected

• Account information: Google account identity linked to all sessions
• Usage data: App interactions, feature usage, and performance events via Google Clearcut telemetry
• Location data: Precise and approximate location when granted, used for Gemini responses and other Google services
• Screen content: Real-time screen capture transmitted to Google servers during Live screen-sharing sessions (requires explicit user activation)
• Device information: Device identifiers and app integrity signals

Third-Party Data Sharing

The following third parties may receive your data:

• Google (Clearcut / CCT Logging) - Interaction and performance telemetry linked to your Google account
• Google (Firebase) - Push notifications and dynamic link routing
• Google (Maps and Places SDK) - Location-aware features
• Google (Integrity API) - Device and app integrity verification
• Spotify (iOS SDK) - Integration for Gemini extensions routing

Understanding the Scores

Security: 92/100
Privacy: 97/100

Security Breakdown

• Data Security: 97/100 - Authentication data stored securely in Keychain; sensitive files excluded from device backups
• Network Security: 94/100 - All production traffic uses HTTPS; a broad exception permits unencrypted content in support-page views
• Code Safety: 92/100 - Strong integrity verification in place; support page views load server-controlled content with registered native message handlers

Privacy Breakdown

• Data Collection: 98/100 - Minimal data collection scope; Firebase Analytics explicitly disabled; no third-party advertising SDKs
• Data Sharing: 100/100 - No data sharing with external advertising or analytics companies outside Google's ecosystem
• User Control: 99/100 - Standard iOS permission prompts for location, camera, and screen sharing; screen broadcast requires explicit user activation

Positive Security Features

• Authentication data is stored in iOS Keychain with appropriate protection settings, keeping your sign-in information off disk
• Apple App Attest and Google Integrity API verify your device and app have not been tampered with before sensitive operations
• Modern cryptography is used throughout the app for data protection operations
• Sensitive files are explicitly marked to be excluded from iCloud and iTunes backups
• Firebase Analytics is fully disabled, meaning your in-app activity is not sent to Firebase
• No third-party advertising or behavioral tracking SDKs are present (no Adjust, AppsFlyer, Amplitude, Mixpanel, or similar)
• Child safety compliance via Apple's declared age-range entitlement

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Clearer Scope for Location Use
   The location permission disclosure states data is used for "Gemini's responses and other Google services." Users would benefit from a more specific description of which Google services receive their location data beyond Gemini itself.

2. Transparency Around Installed App Detection
   The app can detect whether certain non-Google apps (such as Canva, iHeartRadio, Instacart, OpenTable, and Pandora) are installed on your device. It could be strengthened by confirming these results are not included in telemetry sent to Google.

Security Enhancements

1. Support Page Content Loading
   The in-app support and help pages load server-supplied HTML content into a view that has native message handlers registered. Industry best practice recommends strict sanitization of server-sourced HTML before rendering it alongside registered native bridges.

2. Encrypted HTTP Exception Scope
   The app permits unencrypted HTTP content to load in all in-app views. Recommend scoping this exception to only the specific domains that require it, reducing the standing attack surface on unsecured networks.

Technical Context

App Type: AI assistant with Google account integration, location, camera, and screen-sharing capabilities
Classes Analyzed: iOS binary symbols and configuration files
Third-Party Services: 15 identified (primarily Google ecosystem services)
Context Tags: ai-assistant, location, camera, screen-capture, google-account, telemetry

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Google LLC
Version: 1.2026.1370001 (build 1.2026.1370001.0)
Analysis Date: 2026-04-11
Package: com.google.gemini

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS app version 1.2026.1370001 analyzed on 2026-04-11
• May not reflect server-side security controls
• Cannot detect all runtime behaviors