# Security & Privacy Scorecard

## Signal Private Messenger

**Package:** org.thoughtcrime.securesms
**Version:** 7.71.2 (Build 164101)
**Scan Date:** 2026-02-02

## What This Means for You

Messages are end-to-end encrypted and Signal does not collect contacts, messages, or usage data. Payments use Stripe, maps use Google Maps, and GIFs use GIPHY, so those features involve third-party services. Push notifications are delivered via Firebase Cloud Messaging, which does not see message content.

## Recommendation: Very Secure

**Best For:** Anyone wanting truly private messaging

## Key Findings

**Data Security** - 0 findings

**Network Security** - 0 findings

**Code Safety** - 0 findings

**Privacy** - 1 finding (1 info)

## Privacy Concerns

### What Data is Collected

Signal identifies accounts by phone number only. Messages, contacts, and usage patterns are not collected or stored on Signal's servers.

### Third-Party Data Sharing

Certain optional features in the app connect to third-party services:

- **Stripe** processes payments if the user uses Signal's payment features.
- **Google Maps** handles location sharing within conversations.
- **GIPHY** powers GIF search within conversations.
- **Firebase Cloud Messaging** delivers push notifications without exposing message content to the notification service.

Each service receives only the information required to perform its specific function.

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 100/100 |
| Privacy | 100/100 |
| Data Security | 100/100 |
| Network Security | 100/100 |
| Code Safety | 100/100 |
| Data Collection | 100/100 |
| Data Sharing | 100/100 |
| User Control | 100/100 |

## Positive Security Features

- Messages and calls are protected by end-to-end encryption, readable only by the communicating parties.
- Signal does not collect or store contacts, message history, or usage patterns on its servers.
- Push notifications are delivered through Firebase Cloud Messaging without that service gaining access to message content.

## Areas for Improvement

- Using the payments feature routes data through Stripe, a third-party payment processor. Users who want to keep financial activity entirely private should consider whether to use this feature.
- Sharing location within conversations connects to Google Maps. Users should be mindful of when they choose to share location data with contacts.
- GIF searches are processed by GIPHY, which may log the terms searched. Regular use of GIF search sends those search terms to a third party.

---

## About This Analysis

This scorecard is generated through automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed at the time of the scan.

### App Details

- **App Name:** Signal Private Messenger
- **Package ID:** org.thoughtcrime.securesms
- **Version:** 7.71.2 (Build 164101)
- **Scan Date:** 2026-02-02