# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Strong. Strong result in this area. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## DuckDuckGo Private Browser ## What This Means for You The DuckDuckGo iOS browser (version 7.236.0) bundles no third-party analytics, advertising, or crash-reporting SDKs, and browsing history, saved passwords, and tracker block statistics remain stored on the device. ## Recommendation: TRUSTED CITT found strong privacy architecture in this build: no third-party analytics SDKs, ad networks, or tracking identifiers are present in the binary. Passwords are protected with strong encryption and biometric authentication, and browsing data remains on the device. Anonymous first-party telemetry capability is present but the binary indicates it carries no personal information or search content. **Best For:** People who want a browser with no third-party ad networks, analytics SDKs, or persistent tracking identifiers, and strong on-device password protection. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 0 findings **Network Security:** 0 findings **Code Safety:** 2 findings (2 low) **Privacy:** 0 findings ## Privacy Concerns ### What Leaves the Device First-party anonymous usage telemetry capability is present in this build; the binary indicates no personal information, search queries, or persistent device identifiers are involved, but whether data is sent during use was not observed in this static analysis. ### What Stays on the Device - Browsing history (URLs, page titles, visit counts, and timestamps): stored locally in an on-device database. Users who back up to iCloud should be aware that the browsing history database may be included in those backups under the default configuration. - Saved passwords: kept on the device, protected with strong encryption and biometric authentication. - Tracker block statistics: processed and retained on the device with no evidenced off-device reporting. - VPN configuration: stored locally in the device Keychain. ### Third-Party Data Sharing No third-party data sharing was identified in this analysis. ## Understanding the Scores **Security:** 96/100 **Privacy:** 94/100 ### Security Breakdown - **Data Security:** 88/100. Passwords are stored with application-layer encryption and a biometric-protected key hierarchy. Browsing history is held in a local on-device database; Keychain accessibility configuration and backup scope for the browsing store are noted in Areas for Improvement below. - **Network Security:** 100/100. HTTPS upgrades are applied before outbound connections are established via a bundled upgrade filter, and no network security gaps were identified in this build. - **Code Safety:** 97/100. Strong code safety posture throughout this build. Two low-severity observations about URL scheme input handling are noted in Areas for Improvement. ### Privacy Breakdown - **Data Collection:** 98/100. This build contains no advertising, analytics, or crash-reporting SDKs. Anonymous first-party telemetry carries no personal information, no search content, and no persistent device identifiers. - **Data Sharing:** 100/100. No data-sharing relationships with third parties were identified in this build. - **User Control:** 99/100. The Fire Button function deletes the on-device browsing history database entirely. Cross-device sync uses end-to-end encryption with user-controlled keys. ## Positive Security Features - This build bundles no third-party analytics, advertising, or crash-reporting SDKs, and no third-party data flows were identified. - No persistent cross-app tracking identifiers are used anywhere in this build. - Browsing history and tracker block statistics remain on the device with no evidenced reporting to external servers. - Saved passwords are protected with application-layer encryption and a biometric-protected key hierarchy. - Cross-device sync in this build uses end-to-end encryption with a memory-hard key derivation function, providing strong protection for synced data. - HTTPS upgrades are applied via a bundled filter before outbound connections are established, reducing exposure to cleartext redirects. - The Fire Button function deletes the on-device browsing history database entirely, giving users a strong on-device privacy control. - Data sharing across browser extensions is scoped to the developer's own Team ID; third-party extensions are not granted access to shared containers in this configuration. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Extension Privacy Manifests - API Declaration Gaps** Apple's Required Reasons API framework (documented at developer.apple.com/documentation/bundleresources/privacy-manifest-files) requires that apps declare which Required Reasons APIs their extensions use in an accompanying privacy manifest. This build's VPN tunnel and widget extensions each include a privacy manifest file, but those manifests appear to omit the NSUserDefaults API declaration. Whether this gap affects the App Store privacy label for those extensions could not be determined from the binary alone. Adding the missing declarations would make those manifests more complete. 2. **Browsing History and iCloud Backup** Apple recommends applying the highest available file protection to sensitive data stores. The on-device database holding browsing history (URLs, titles, timestamps, visit counts) in this build uses the default file protection level, which means an iCloud backup may include that data. Users who want browsing history excluded from iCloud backups may wish to verify whether DuckDuckGo excludes this data from backups in the app or iOS Settings. ### Security Enhancements 1. **Keychain Accessibility for Sensitive Items** Industry best practice recommends configuring Keychain items that hold VPN keys, subscription data, or login data with the highest device-bound accessibility class, so those items remain on the originating device and are not eligible for migration via iCloud Keychain. 2. **URL Scheme Input Handling** The URL scheme handler in this build dispatches to internal views including the password manager UI without confirming which app triggered the request. Applying input validation to scheme-triggered actions that open sensitive UI would reduce the surface available to other installed apps. ## Technical Context **App Type:** Privacy-focused browser with integrated VPN and password manager (high sensitivity) **Classes Analyzed:** 38 **Third-Party Services:** 6 (utility libraries: GRDB, Lottie, JWTKit, ZIPFoundation, Kingfisher, Gzip) **Context Tags:** privacy, browser, vpn, password_manager, sensitive_data --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** DuckDuckGo **Version:** 7.236.0 (Build 18) **Analysis Date:** 2026-09-10 **Package:** com.duckduckgo.mobile.ios ### Analysis Limitations - Static analysis only (code review without running the app) - Based on IPA version 7.236.0 (Build 18) analyzed on 2026-09-10 - May not reflect server-side security controls - Cannot detect all runtime behaviors