Scan results

Recommendation: Trustworthy

Key Findings

Data Security - 3 findings (2 medium, 1 low)

Network Security - 1 finding (1 medium)

Code Safety - 0 findings

Privacy - 4 findings (4 medium)

Privacy Concerns

What Data is Collected

WhatsApp collects phone numbers, contacts lists, and message metadata to operate the service. Google ML Kit processes content on the device to power features like smart replies. Google reCAPTCHA shares device signals with Google during account setup and verification.

Third-Party Data Sharing

User data passes through the following third-party services:

• Google Drive - Stores user chat history when backups are enabled, giving Google access to message content
• Firebase Cloud Messaging - Routes all incoming notifications through Google's delivery infrastructure
• Google Play Services - Provides device-level platform integration and authentication support
• Google Play Billing - Handles payment processing for purchases made inside the app
• NPCI UPI SDK - Processes payments through India's national payments network for users in India
• Google reCAPTCHA - Shares device information with Google to verify user identity during registration
• Psiphon VPN - Provides connectivity support in regions where the service faces restrictions

Understanding the Scores

Positive Security Features

• The app uses the Signal Protocol (libsignal) for end-to-end encrypted messaging, a widely trusted standard for private communications.
• Google Tink is integrated for cryptographic operations, providing a well-maintained library from Google's security team.
• A Code Safety score of 95/100 reflects a well-hardened application binary.

Areas for Improvement

• Enabling Google Drive backup gives Google access to the complete message history. Users who value message privacy may want to keep backups disabled or review which data is included in the backup.
• All notifications are routed through Firebase, meaning Google's infrastructure processes information about when and how often messages are received. Users who prefer to limit data shared with Google should be aware of this design choice.
• Financial transactions in India pass through the NPCI UPI network, adding a third party to any payments made within the app.

About This Analysis

Scores and findings are based on static analysis of the app package at the version listed below. Results reflect the app's behavior at the time of the scan and may change with future updates.

App Details