Scan results

Recommendation: Very Secure

Wikipedia delivers exceptional privacy: no ads, no third-party tracking, and no commercial analytics SDKs. Uses first-party Wikimedia analytics with consent. Best-in-class choice for privacy-focused readers.

Key Findings

Data Security - 0 findings

Network Security - 1 finding (1 info)

Code Safety - 2 findings (1 low, 1 info)

Privacy - 3 findings (3 info)

Privacy Concerns

What Data is Collected

• Usage data: App interactions and reading activity may be sent to Wikimedia-operated analytics servers (meta.wikimedia.org), with your consent requested during initial setup.
• Device information: An anonymous app install identifier is shared with Wikimedia's own analytics and donation systems to correlate activity within the app.
• Payment information: If you choose to donate, payment details are processed by Adyen.

Third-Party Data Sharing

The following third parties may receive your data:

• Wikimedia Foundation - First-party analytics and encyclopedia services
• hCaptcha - Bot protection verification during login and account-related actions
• Adyen - Payment processing for optional in-app donations

Understanding the Scores

Security: 97/100
Privacy: 100/100

Security Breakdown

• Data Security: 100/100 - Sensitive information is handled securely throughout the app.
• Network Security: 100/100 - All connections enforce secure HTTPS with no insecure exceptions permitted anywhere in the app.
• Code Safety: 97/100 - Strong coding practices throughout, with a developer testing panel included in the production build as a low-severity item.

Privacy Breakdown

• Data Collection: 100/100 - Data collection is minimal and limited to first-party Wikimedia analytics, with user consent requested at onboarding.
• Data Sharing: 100/100 - No data is shared with advertising networks or commercial tracking services.
• User Control: 100/100 - Users are presented with a clear analytics consent choice during initial setup.

Positive Security Features

• All network connections use secure HTTPS with no insecure exceptions anywhere in the app
• No advertising, tracking, attribution, or commercial analytics SDKs present
• First-party analytics only, sent to Wikimedia's own servers with user consent collected at onboarding
• Article content display is isolated from native app capabilities, limiting the impact of content-based attacks
• No advertising identifier or cross-app tracking framework in use

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Analytics Consent Gating Confirmation
   Confirming that all analytics data transmission is fully gated on the consent choice made during onboarding would provide additional transparency to users.

2. Privacy Manifest
   Adding an app privacy manifest could make the App Store privacy label more complete.

Security Enhancements

1. Developer Testing Panel
   The production binary includes a developer testing panel that exposes toggles for certain app behaviors. Removing or restricting access to these tools in production releases would align with standard software release practices.

Technical Context

App Type: Reference and encyclopedia
Classes Analyzed: 0
Third-Party Services: 13 identified
Context Tags: location, donations

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Wikimedia Foundation
Version: 8.2.0 (Build 6087)
Analysis Date: 2026-06-21
Package: org.wikimedia.wikipedia

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 8.2.0 analyzed on 2026-06-21
• May not reflect server-side security controls
• Cannot detect all runtime behaviors