# Security & Privacy Scorecard

## Wikipedia

## What This Means for You

Your reading activity and analytics are sent only to Wikimedia's own servers, with your consent for analytics requested the first time you open the app.

## Recommendation: Very Secure

Wikipedia delivers exceptional privacy: no ads, no third-party tracking, and no commercial analytics SDKs. Uses first-party Wikimedia analytics with consent. Best-in-class choice for privacy-focused readers.

**Best For:** Privacy-conscious users seeking a tracker-free, ad-free reference experience

## Key Findings

**Data Security** - 0 findings

**Network Security** - 1 finding (1 info)

**Code Safety** - 2 findings (1 low, 1 info)

**Privacy** - 3 findings (3 info)

## Privacy Concerns

### What Data is Collected

- Usage data: App interactions and reading activity may be sent to Wikimedia-operated analytics servers (meta.wikimedia.org), with your consent requested during initial setup.
- Device information: An anonymous app install identifier is shared with Wikimedia's own analytics and donation systems to correlate activity within the app.
- Payment information: If you choose to donate, payment details are processed by Adyen.

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Wikimedia Foundation - First-party analytics and encyclopedia services
- hCaptcha - Bot protection verification during login and account-related actions
- Adyen - Payment processing for optional in-app donations

## Understanding the Scores

**Security:** 97/100
**Privacy:** 100/100

### Security Breakdown

- **Data Security:** 100/100 - Sensitive information is handled securely throughout the app.
- **Network Security:** 100/100 - All connections enforce secure HTTPS with no insecure exceptions permitted anywhere in the app.
- **Code Safety:** 97/100 - Strong coding practices throughout, with a developer testing panel included in the production build as a low-severity item.

### Privacy Breakdown

- **Data Collection:** 100/100 - Data collection is minimal and limited to first-party Wikimedia analytics, with user consent requested at onboarding.
- **Data Sharing:** 100/100 - No data is shared with advertising networks or commercial tracking services.
- **User Control:** 100/100 - Users are presented with a clear analytics consent choice during initial setup.

## Positive Security Features

- All network connections use secure HTTPS with no insecure exceptions anywhere in the app
- No advertising, tracking, attribution, or commercial analytics SDKs present
- First-party analytics only, sent to Wikimedia's own servers with user consent collected at onboarding
- Article content display is isolated from native app capabilities, limiting the impact of content-based attacks
- No advertising identifier or cross-app tracking framework in use

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Analytics Consent Gating Confirmation**
   Confirming that all analytics data transmission is fully gated on the consent choice made during onboarding would provide additional transparency to users.

2. **Privacy Manifest**
   Adding an app privacy manifest could make the App Store privacy label more complete.

### Security Enhancements

1. **Developer Testing Panel**
   The production binary includes a developer testing panel that exposes toggles for certain app behaviors. Removing or restricting access to these tools in production releases would align with standard software release practices.

## Technical Context

**App Type:** Reference and encyclopedia
**Classes Analyzed:** 0
**Third-Party Services:** 13 identified
**Context Tags:** location, donations

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Wikimedia Foundation
**Version:** 8.2.0 (Build 6087)
**Analysis Date:** 2026-06-21
**Package:** org.wikimedia.wikipedia

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 8.2.0 analyzed on 2026-06-21
- May not reflect server-side security controls
- Cannot detect all runtime behaviors