# Security & Privacy Scorecard

## DuckDuckGo, Duck.ai, & VPN

## What This Means for You

Your online activity is well-protected from third-party companies, but DuckDuckGo collects its own usage analytics tied to a persistent identifier assigned at install that you cannot switch off.

## Recommendation: Acceptable with Awareness

An excellent browser for protecting your privacy online. The app has a hardcoded authentication value for its internal security service and stores VPN configuration keys without the same strong protection applied to your saved passwords, which could pose risks on a physically compromised device. First-party usage analytics run in the background and cannot be disabled.

**Best For:** Privacy-conscious users seeking a browser with zero third-party analytics tracking

## Key Findings

**Data Security** - 1 finding (1 medium)

**Network Security** - 0 findings

**Code Safety** - 2 findings (1 medium, 1 info)

**Privacy** - 6 findings (2 low, 4 info)

## Privacy Concerns

### What Data is Collected

- Usage data: app interactions, search activity, Duck.ai usage patterns, and feature engagement events tied to a persistent install identifier
- Device information: install cohort, form factor, and behavioral segment classifications (e.g., weekly/monthly active user status)
- Location data: only when you grant permission to a specific website you are visiting - not collected by DuckDuckGo for its own purposes
- Camera and microphone: only when you actively use voice search or the sync QR-code pairing feature

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Google Play - receives install referral attribution data when you first install the app, used by DuckDuckGo to measure campaign performance
- Google Play Billing - processes subscription payments if you purchase a DuckDuckGo subscription plan
- Google Play Services - standard Android platform integration for app distribution and device services

## Understanding the Scores

**Security:** 97/100

**Privacy:** 91/100

### Security Breakdown

- **Data Security:** 93/100 - Strong encrypted storage for passwords, sync data, and subscription information, with one exception in VPN configuration handling
- **Network Security:** 100/100 - All connections use strong encryption with no insecure communication patterns found
- **Code Safety:** 98/100 - Robust code practices throughout, with a hardcoded internal authentication value and a minor autofill interface observation

### Privacy Breakdown

- **Data Collection:** 90/100 - No third-party analytics SDKs; first-party usage telemetry collects behavioral data tied to a persistent identifier
- **Data Sharing:** 100/100 - No user data shared with advertising networks or third-party analytics companies
- **User Control:** 84/100 - Strong user controls overall, but first-party usage analytics cannot be disabled from within the app

## Positive Security Features

- Zero third-party analytics SDKs bundled - no Firebase, Crashlytics, Mixpanel, Amplitude, Adjust, AppsFlyer, or Facebook SDK present
- No advertising identifier collection anywhere in the app
- Passwords, sync data, email protection data, and subscription information all protected with strong Android-level encrypted storage
- Backup disabled, preventing sensitive data from being extracted via USB debugging
- Web debugging interface disabled in production builds
- Autofill looks up your saved passwords using the real address bar URL, not a value that could be manipulated by a page
- JavaScript-based navigation schemes explicitly blocked to prevent malicious redirects
- No device hardware identifiers (IMEI or equivalent) collected
- Voice search processed entirely on your device - audio is never sent to DuckDuckGo servers
- Camera used exclusively for the sync QR-code pairing flow, with explicit Android permission required

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Usage Analytics Opt-Out**
   Users should be given a clear, accessible option to disable first-party usage telemetry, including the persistent install identifier and behavioral event tracking, from within the app's privacy settings.

2. **Transparency on Behavioral Profiling**
   The scope of Duck.ai interaction tracking (over 150 event types including prompt length and timing patterns) could be more prominently disclosed in the app's privacy settings so users understand what product analytics are collected when using the AI assistant.

### Security Enhancements

1. **VPN Configuration Storage**
   Applying the same strong Android-level encrypted storage used for saved passwords and subscription data to VPN configuration would provide consistent protection for all sensitive app data.

2. **Server-Managed Authentication Values**
   Moving the internal malicious-site protection authentication value to a server-side configuration system would allow it to be rotated without requiring all users to update the app simultaneously.

## Technical Context

**App Type:** Privacy browser, VPN, and AI assistant - high sensitivity

**Classes Analyzed:** 33,365

**Third-Party Services:** 7 (Google Play Billing, Google Play Install Referrer, Google Play Services, SQLCipher, ZXing/JourneyApps, WireGuard Java, Conscrypt)

**Context Tags:** browser, vpn, privacy, ai_assistant

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** DuckDuckGo

**Version:** 5.278.1 (build 52781000)

**Analysis Date:** 2026-05-08

**Package:** com.duckduckgo.mobile.android

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 5.278.1 analyzed on 2026-05-08
- May not reflect server-side security controls
- Cannot detect all runtime behaviors