# Matrix privacy rating

Open standard and federated network for real-time chat and calls, with end-to-end encryption through the Olm and Megolm protocols. Anyone can run a homeserver, and many clients such as Element support it.

## Summary

Matrix scores 58 out of 100 (grade D) on the messengers criteria. It meets 4 of 8 criteria: open source, no ads or data sales, no phone number needed and decentralized. It partly meets independent audit and end-to-end encrypted by default. It does not meet no trackers or telemetry and metadata protection. It is based in the United Kingdom: Five Eyes member; GDPR-style data protection law; CLOUD Act data access agreement with the US.

- Website: https://matrix.org
- Source code: https://github.com/matrix-org/matrix-spec
- License: Apache-2.0
- Jurisdiction: United Kingdom. Five Eyes member. GDPR-style data protection law. CLOUD Act data access agreement with the US.
- Home page trackers: Plausible (cookieless analytics)
- Category: [Messengers](https://privacyratings.com/messengers/)
- Grade: D (58/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | Apache-2.0. | https://github.com/matrix-org/matrix-spec/blob/main/LICENSE |
| No trackers or telemetry | No | The matrix.org homeserver sends account usage analytics to PostHog, and the website uses hosted Plausible analytics. | https://matrix.org/legal/privacy-notice/ |
| No ads or data sales | Yes | The non-profit Matrix.org Foundation is funded by donations and organisational memberships, with no ads. | https://matrix.org/support/ |
| Independent audit | Partial | A full Least Authority audit of the vodozemac encryption library is public but is older than three years. | https://matrix.org/media/Least%20Authority%20-%20Matrix%20vodozemac%20Final%20Audit%20Report.pdf |
| End-to-end encrypted by default | Partial | Encryption is an optional room setting in the protocol; major clients enable it for private chats, but public rooms are unencrypted. | https://spec.matrix.org/latest/client-server-api/#end-to-end-encryption |
| No phone number needed | Yes | No phone number is needed; on the matrix.org homeserver a verified phone number is optional. | https://matrix.org/legal/privacy-notice/ |
| Metadata protection | No | Homeservers see room membership, senders and timestamps, and share them with every server in a room. |  |
| Decentralized | Yes | Federated protocol; anyone can run a homeserver. | https://spec.matrix.org/latest/ |

Source: https://privacyratings.com/messengers/matrix/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/messengers/matrix.md