# Security & Privacy Scorecard

## MetaMask: Trade Crypto

## What This Means for You

In-app behavior is tracked by several analytics services, and crash reports may include session replays sent to Sentry. User location can be collected by Braze for CRM and analytics targeting. If identity verification features are used, personal documents are processed by Veriff, a third-party provider.

## Recommendation: Acceptable

**Best For:** Managing crypto and Web3 wallets day-to-day
**Avoid If:** You want zero location tracking by third parties

## Key Findings

**Data Security** - 4 findings (2 medium, 1 low, 1 info)

**Network Security** - 4 findings (1 medium, 1 low, 2 info)

**Code Safety** - 0 findings

**Privacy** - 3 findings (1 medium, 1 low, 1 info)

## Privacy Concerns

### What Data is Collected

MetaMask collects behavioral and usage data through Mixpanel and Braze. Crash reports, which may include session replays, are sent to Sentry. Braze also collects user location for CRM targeting and push notification personalization. Using identity verification requires submitting identity documents to Veriff, a third-party KYC provider.

### Third-Party Data Sharing

User data is shared with these third-party services:

- **Sentry** - Receives crash reports and may capture session replay data reflecting in-app activity.
- **Braze** - Receives behavioral data and location information, and handles push notification targeting.
- **Mixpanel** - Receives product usage and analytics data.
- **Branch** - Receives attribution data to track how users engage with and arrive at the app.
- **Firebase Messaging** - Handles push notification delivery only, with no additional behavioral data collection.
- **Veriff** - Processes identity documents if KYC or identity verification features are used.

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 83/100 |
| Privacy | 83/100 |
| Data Security | 85/100 |
| Network Security | 92/100 |
| Code Safety | 89/100 |
| Data Collection | 87/100 |
| Data Sharing | 90/100 |
| User Control | 89/100 |

## Positive Security Features

- Network communications for wallet protocol interactions use standard TLS encryption.
- Firebase Messaging is scoped to push notification delivery, without additional behavioral tracking.
- Identity verification for KYC uses a dedicated third-party service, keeping document processing isolated from the main app.

## Areas for Improvement

- Crash reporting includes session replay data sent to Sentry, which may capture sensitive in-app interactions beyond basic error information.
- User location is collected by Braze for CRM and analytics targeting, extending data collection beyond what core wallet functionality requires.
- Multiple analytics and attribution services collect behavioral data, broadening the overall scope of third-party data sharing.

---

## About This Analysis

This scorecard is based on automated static analysis of the published app binary and configuration files.

### App Details

| Field | Value |
|---|---|
| App | MetaMask: Trade Crypto |
| Package ID | io.metamask.MetaMask |
| Version | 7.72.0 (Build 4333) |
| Scan Date | 2026-04-09 |