Ivory for Mastodon by Tapbots Security & Privacy Scorecard

by Tapbots · iOS

92
Overall trust score
Very Secure
95
Security
91
Privacy

Posts and account activity stay within Tapbots' own servers and Apple's platform services. Giphy and Google Translate are available as optional features, and data is only sent to them when users actively use those tools. No advertising networks have access to user activity.

Best for

Mastodon users who want a polished experience

Findings

  • 0 critical
  • 1 high
  • 3 medium
  • 7 low
  • 12 info

2 issues identified across security and privacy analysis.

Top security issues

  • Development planning documents shipped in production bundle expose subscription server API endpoints, request schemas, and internal class names enabling targeted bypass attempts
  • NSAllowsArbitraryLoads disables App Transport Security globally, exposing OAuth tokens and content on HTTP Mastodon instances
  • Browser handoff URL templates use unencoded $URL substitution for DuckDuckGo, Edge, 1Password, and Opera Touch handlers

Top privacy issues

  • Safari content extension relays all Mastodon browsing URLs through Tapbots server by default without user disclosure
  • Subscription verification sends persistent device identifiers (uuid and GUID) to Tapbots server on every entitlement check, undisclosed in privacy label
  • App Group shared container lacks backup exclusion, exposing cached DM previews, notification content, and widget data in iCloud/iTunes backups

Full analysis

Version: 2.5 (Build 25000)
Scan Date: 2026-03-29

What This Means for You

Posts and account activity stay within Tapbots' own servers and Apple's platform services. Giphy and Google Translate are available as optional features, and data is only sent to them when users actively use those tools. No advertising networks have access to user activity.

Recommendation: Very Secure

Best For: Mastodon users who want a polished experience

Key Findings

Data Security - 3 findings (1 low, 2 info)

Network Security - 4 findings (1 medium, 1 low, 2 info)

Code Safety - 0 findings

Privacy - 5 findings (1 medium, 3 low, 1 info)

Privacy Concerns

What Data is Collected

Ivory collects only what is needed to operate a Mastodon account. The app connects to the user's chosen Mastodon server and Tapbots' own services for push notifications, subscription management, and configuration updates. GIF search and text translation are only activated when users choose to use those features.

Third-Party Data Sharing

User data is shared with the following services:

  • Tapbots - Push notifications (push_ivory.tapbots.com), subscription management (subscription.tapbots.net), and remote configuration (tapbots.net)
  • Apple - Core app services via CloudKit, StoreKit, and authentication
  • Giphy - GIF search, contacted only when users actively use the GIF picker
  • Google Translate - Text translation, contacted only when users actively use the translate feature
  • instances.social - Mastodon server discovery

User activity is not shared with advertising networks or behavioral tracking services.

Understanding the Scores

Category Score
Security 95/100
Privacy 91/100
Data Security 97/100
Network Security 93/100
Code Safety 96/100
Data Collection 96/100
Data Sharing 100/100
User Control 92/100

Positive Security Features

  • All third-party service connections are tied to features users choose to activate, not passive background access
  • Advertising and behavioral tracking networks are absent from the app
  • Data sharing is limited to Tapbots' own infrastructure and established Apple platform services
  • A perfect Data Sharing score reflects that posts and account data are not sold or forwarded to outside parties

Areas for Improvement

  • Some network connections use transport security settings that could be strengthened to better protect user data on public or untrusted Wi-Fi networks.
  • A small number of local data handling practices could be tightened to reduce how long certain information is retained on the device.
  • Transparency around which optional features contact external services could be made more prominent within the app's settings.

About This Analysis

This scorecard was produced through automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed in this version.

App Details

Field Value
Package ID com.tapbots.Ivory
Version 2.5 (Build 25000)
Scan Date 2026-03-29
Platform iOS

Versions & scan history

ScanDateOverall score
#1 (current) 92/100