# Security & Privacy Scorecard

## Proton Mail: Encrypted Email

**ch.protonmail.android** | Version 7.7.1 (Build 16244) | Analyzed: March 4, 2026

## What This Means for You

Emails are end-to-end encrypted, meaning even Proton cannot read them. Push notifications are delivered through Firebase Cloud Messaging, and crash reports go to a self-hosted Sentry instance rather than a third-party service. Purchases go through Google Play Billing, which shares transaction data with Google.

## Recommendation: Very Secure

**Best For:** Anyone wanting private email with minimal data exposure

## Key Findings

**Data Security** - 2 findings (1 low, 1 info)

**Network Security** - 0 findings

**Code Safety** - 0 findings

**Privacy** - 1 finding (1 info)

## Privacy Concerns

### What Data is Collected

Push notification delivery requires registration with Firebase Cloud Messaging, which processes delivery data on Google's servers. In-app purchases are handled by Google Play Billing, which collects transaction details. Basic device information is shared with Google Play Services to support core app functionality.

### Third-Party Data Sharing

Purchase history and transaction details are shared with Google through Google Play Billing. Push notification delivery data passes through Google's Firebase infrastructure. No advertising networks or behavioral profiling services receive user data.

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 97/100 |
| Privacy | 100/100 |
| Data Security | 96/100 |
| Network Security | 100/100 |
| Code Safety | 97/100 |
| Data Collection | 100/100 |
| Data Sharing | 100/100 |
| User Control | 100/100 |

## Positive Security Features

- Email content is encrypted end-to-end before it leaves the device, so no one other than the sender and recipients can read it
- Crash and error reports are sent to Proton's own self-hosted infrastructure rather than a commercial third-party service
- No advertising, behavioral profiling, or third-party analytics SDKs are present in the app
- Third-party integrations are limited to infrastructure essentials, with no data shared for marketing purposes

## Areas for Improvement

- In-app purchase data, including what is bought and when, flows through Google Play Billing and is subject to Google's data practices
- Push notification delivery routes through Google's Firebase infrastructure, meaning Google handles the delivery path for incoming message alerts

---

## About This Analysis

This scorecard is generated from automated static analysis of the app's compiled code and configuration. It reflects security and privacy practices found in the version analyzed below.

### App Details

| | |
|---|---|
| **App Name** | Proton Mail: Encrypted Email |
| **Package ID** | ch.protonmail.android |
| **Version** | 7.7.1 (Build 16244) |
| **Scan Date** | March 4, 2026 |