Telegram Messenger Security & Privacy Scorecard

Telegram

What This Means for You

Your phone contacts are sent to and stored on Telegram's servers when you enable contact sync, and two embedded video players (Vimeo and YouTube) load their code from external servers on every playback, creating a dependency on those companies' infrastructure.

Recommendation: Acceptable with Awareness

Excellent privacy with zero tracking and encrypted chats. Two medium-risk issues with Vimeo and YouTube CDN dependencies and server-side contact storage require awareness. Generally secure for privacy-conscious users.

Best For: Privacy-conscious users who want a feature-rich messaging app with no third-party tracking or ads

Key Findings

Data Security - 2 findings (1 low, 1 info)

Network Security - 3 findings (2 medium, 1 info)

Code Safety - 4 findings (2 low, 2 info)

Privacy - 3 findings (3 info)

Privacy Concerns

What Data is Collected

• Contact information: names and phone numbers from your address book (uploaded to Telegram's servers)
• Account information: phone number used for registration
• Message content: stored encrypted on-device and on Telegram's cloud servers
• Usage data: call metadata, channel and group interactions

Third-Party Data Sharing

The following third parties may receive your data:

• Firebase (Google) - Phone number verification for account registration only; no analytics or tracking
• Stripe - Client-side payment processing for in-app purchases; payment data goes directly to Stripe

Understanding the Scores

Security: 90/100
Privacy: 88/100

Security Breakdown

• Data Security: 96/100 - Local message database is encrypted on-device; key derivation path cannot be fully confirmed through static analysis alone
• Network Security: 88/100 - Strong HTTPS usage overall; Vimeo and YouTube embedded players load scripts from external servers without integrity verification
• Code Safety: 99/100 - No memory safety issues found; biometric app lock properly bound to device; some URL scheme validation not statically verifiable

Privacy Breakdown

• Data Collection: 91/100 - No third-party tracking or advertising; contact upload to cloud servers is the primary data collection concern
• Data Sharing: 97/100 - Contacts shared with Telegram servers; no advertising or analytics companies receive your data
• User Control: 90/100 - On-device notification decryption and biometric lock give you strong control; contact sync opt-out is the main gap

Positive Security Features

• Zero third-party analytics, advertising, or crash reporting SDKs confirmed across the entire app
• Local message history is encrypted on your device using industry-standard database encryption
• App lock uses biometric authentication (Face ID / Touch ID) with a device-bound key that is automatically invalidated if new biometric enrollments are added
• Push notification content is decrypted on your device before being displayed - the message text never passes through Apple's servers in readable form
• HLS video player uses locally-bundled code with no dependency on external servers
• No memory safety issues found across more than 353,000 analyzed functions
• Payment processing (Apple Pay) uses publicly registered merchant identifiers only - no payment credentials or private keys are stored in the app

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Contact Sync Transparency
   Users should be clearly informed before contact upload begins that their full address book - including contacts who are not Telegram users and have not consented - will be stored on Telegram's servers. A granular opt-in per sync event would give users meaningful control.

2. Third-Party Script Integrity
   The Vimeo and YouTube embedded players load code from those companies' servers each time a video plays. Users sharing sensitive video links in chats should be aware that playback creates a connection to those external servers.

Security Enhancements

1. Embedded Video Player Scripts
   Adding integrity verification for the Vimeo and YouTube player scripts would ensure that the code loaded from those CDNs has not been altered in transit, reducing the risk of tampered scripts running inside the app.

2. Custom URL Scheme Validation
   The tonsite:// URL scheme, used for TON-based website links, should include explicit input validation to prevent maliciously crafted links from opening unintended content in the in-app browser.

Technical Context

App Type: Encrypted messaging, voice/video calls, channels and groups - high privacy sensitivity
Classes Analyzed: 353,108
Third-Party Services: 2 (Firebase Phone Verification, Stripe Payments)
Context Tags: social, contacts, voip, payments

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Telegram FZ-LLC
Version: 12.6.3 (Build 32738)
Analysis Date: 2026-04-17
Package: ph.telegra.Telegraph

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 12.6.3 analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors