Reddit Security & Privacy Scorecard

Reddit

What This Means for You

Your Reddit user ID is shared with every third-party Devvit mini-app you interact with, and if you approved ad tracking, your device's advertising identifier is also forwarded to AppsFlyer for cross-app attribution without that being clearly stated in the permission prompt.

Recommendation: Acceptable with Awareness

Reddit uses secure login flows and device integrity checks, but Devvit mini-apps can access your user ID and the app permits unencrypted connections inside embedded content areas. Third-party attribution tracking via AppsFlyer is not fully disclosed in the privacy consent prompt shown at first launch.

Best For: General Reddit users comfortable with standard social app data practices and ad personalization.

Key Findings

Data Security - 3 findings (1 medium, 2 info)

Network Security - 4 findings (1 medium, 2 low, 1 info)

Code Safety - 3 findings (1 medium, 2 info)

Privacy - 4 findings (1 low, 3 info)

Privacy Concerns

What Data is Collected

• Personal information: Reddit username, user ID, email address
• Device information: Device advertising identifier (IDFA), install ID, device type
• Usage data: Screen views, feed interactions, ad impressions, subreddit activity, experiment participation
• Behavioral data: Login and signup events, in-app actions tracked via Reddit's EventKit analytics system

Third-Party Data Sharing

The following third parties may receive your data:

• AppsFlyer - Cross-app install attribution tracking using your device advertising identifier
• Branch - Referral attribution and link routing
• Firebase Crashlytics - Crash and error reporting (analytics disabled by Reddit)
• Google Sign-In - Authentication if you use Google login
• Microsoft CodePush - Over-the-air JavaScript bundle delivery for app updates

Understanding the Scores

Security: 90/100
Privacy: 94/100

Security Breakdown

• Data Security: 98/100 - Strong storage practices; authentication data is well protected with appropriate access controls
• Network Security: 90/100 - Secure login flows in place; embedded content areas permit unencrypted connections on open networks
• Code Safety: 98/100 - Device integrity verification implemented; Devvit mini-app bridge lacks per-action permission gating

Privacy Breakdown

• Data Collection: 99/100 - Behavioral analytics are extensive but kept on Reddit's own servers
• Data Sharing: 96/100 - Limited external sharing; AppsFlyer receives your device advertising ID when tracking is authorized
• User Control: 99/100 - ATT consent controls present; attribution disclosure in the permission prompt could be more complete

Positive Security Features

• Secure login uses a system-isolated session with PKCE protection, preventing the app from reading your credentials during sign-in
• Apple App Attest device integrity verification ensures requests originate from genuine, unmodified Reddit app installations
• Over-the-air code updates are protected by cryptographic signature verification, blocking unauthorized code injection even if a configuration key were extracted
• Google Firebase Analytics fully disabled with five separate configuration switches; only crash reporting remains active
• Privacy API usage fully declared with Apple-approved reason codes, meeting App Store compliance requirements
• Authentication data stored using the most protective device-locked storage class available

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Transparent Attribution Disclosure
   The ad tracking permission prompt should explicitly state that approving tracking also enables AppsFlyer to perform cross-app attribution on your device, not only Reddit's own ad personalization.

2. Devvit User ID Access Controls
   Third-party Devvit mini-app developers receive your Reddit user ID automatically at session start without a separate permission step. Adding explicit user consent or pseudonymization for this data handoff would align with minimal data exposure principles.

Security Enhancements

1. Devvit Bridge Permission Gating
   Screenshot capture and share sheet pre-filling that can be invoked by Devvit mini-apps should require explicit per-action user confirmation rather than being available to any Devvit developer by default.

2. Remove Legacy Unused Code
   Inactive code from a discontinued feature continues to declare iCloud storage entitlements, which expands the app's data surface unnecessarily and may affect App Store privacy disclosures.

Technical Context

App Type: Social news and community platform
Classes Analyzed: iOS binary and bundle static analysis
Third-Party Services: 14 services identified
Context Tags: social, ads, attribution tracking, third-party SDK, mini apps

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Reddit Inc.
Version: 2026.19.0 (build 629618)
Analysis Date: 2026-05-12
Package: com.reddit.Reddit

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 2026.19.0 analyzed on 2026-05-12
• May not reflect server-side security controls
• Cannot detect all runtime behaviors