# Security & Privacy Scorecard

## Telegram

## What This Means for You

Your phone contacts are sent to and stored on Telegram's servers when you enable contact sync, and two embedded video players (Vimeo and YouTube) load their code from external servers on every playback, creating a dependency on those companies' infrastructure.

## Recommendation: Acceptable with Awareness

Excellent privacy with zero tracking and encrypted chats. Two medium-risk issues with Vimeo and YouTube CDN dependencies and server-side contact storage require awareness. Generally secure for privacy-conscious users.

**Best For:** Privacy-conscious users who want a feature-rich messaging app with no third-party tracking or ads

## Key Findings

**Data Security** - 2 findings (1 low, 1 info)

**Network Security** - 3 findings (2 medium, 1 info)

**Code Safety** - 4 findings (2 low, 2 info)

**Privacy** - 3 findings (3 info)

## Privacy Concerns

### What Data is Collected

- Contact information: names and phone numbers from your address book (uploaded to Telegram's servers)
- Account information: phone number used for registration
- Message content: stored encrypted on-device and on Telegram's cloud servers
- Usage data: call metadata, channel and group interactions

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Firebase (Google) - Phone number verification for account registration only; no analytics or tracking
- Stripe - Client-side payment processing for in-app purchases; payment data goes directly to Stripe

## Understanding the Scores

**Security:** 90/100
**Privacy:** 88/100

### Security Breakdown

- **Data Security:** 96/100 - Local message database is encrypted on-device; key derivation path cannot be fully confirmed through static analysis alone
- **Network Security:** 88/100 - Strong HTTPS usage overall; Vimeo and YouTube embedded players load scripts from external servers without integrity verification
- **Code Safety:** 99/100 - No memory safety issues found; biometric app lock properly bound to device; some URL scheme validation not statically verifiable

### Privacy Breakdown

- **Data Collection:** 91/100 - No third-party tracking or advertising; contact upload to cloud servers is the primary data collection concern
- **Data Sharing:** 97/100 - Contacts shared with Telegram servers; no advertising or analytics companies receive your data
- **User Control:** 90/100 - On-device notification decryption and biometric lock give you strong control; contact sync opt-out is the main gap

## Positive Security Features

- Zero third-party analytics, advertising, or crash reporting SDKs confirmed across the entire app
- Local message history is encrypted on your device using industry-standard database encryption
- App lock uses biometric authentication (Face ID / Touch ID) with a device-bound key that is automatically invalidated if new biometric enrollments are added
- Push notification content is decrypted on your device before being displayed - the message text never passes through Apple's servers in readable form
- HLS video player uses locally-bundled code with no dependency on external servers
- No memory safety issues found across more than 353,000 analyzed functions
- Payment processing (Apple Pay) uses publicly registered merchant identifiers only - no payment credentials or private keys are stored in the app

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Contact Sync Transparency**
   Users should be clearly informed before contact upload begins that their full address book - including contacts who are not Telegram users and have not consented - will be stored on Telegram's servers. A granular opt-in per sync event would give users meaningful control.

2. **Third-Party Script Integrity**
   The Vimeo and YouTube embedded players load code from those companies' servers each time a video plays. Users sharing sensitive video links in chats should be aware that playback creates a connection to those external servers.

### Security Enhancements

1. **Embedded Video Player Scripts**
   Adding integrity verification for the Vimeo and YouTube player scripts would ensure that the code loaded from those CDNs has not been altered in transit, reducing the risk of tampered scripts running inside the app.

2. **Custom URL Scheme Validation**
   The tonsite:// URL scheme, used for TON-based website links, should include explicit input validation to prevent maliciously crafted links from opening unintended content in the in-app browser.

## Technical Context

**App Type:** Encrypted messaging, voice/video calls, channels and groups - high privacy sensitivity
**Classes Analyzed:** 353,108
**Third-Party Services:** 2 (Firebase Phone Verification, Stripe Payments)
**Context Tags:** social, contacts, voip, payments

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Telegram FZ-LLC
**Version:** 12.6.3 (Build 32738)
**Analysis Date:** 2026-04-17
**Package:** ph.telegra.Telegraph

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 12.6.3 analyzed on 2026-04-17
- May not reflect server-side security controls
- Cannot detect all runtime behaviors