Messengers
Telegram privacy rating
Cloud-based messenger with large groups, public channels and bots. Regular chats and groups are stored on Telegram's servers with client-server encryption; only optional one-to-one secret chats are end-to-end encrypted.
Summary
Telegram scores 44 out of 100 (grade D) on the messengers criteria. It meets 1 of 8 criteria: no trackers or telemetry. It partly meets open source, no ads or data sales, end-to-end encrypted by default and no phone number needed. It does not meet independent audit, metadata protection and decentralized. It is based in the United Arab Emirates: Not in the Five, Nine or Fourteen Eyes.
Score 44 out of 100. How scoring works
Criteria
-
Partial
Open source Weight 3 of 3
Is all the source code needed to run the product public?
The apps are open source (the Android app is GPL-2.0); the server is closed source.
-
Yes
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
Exodus finds no trackers in the Android app, and the privacy policy states cookies are not used for profiling or advertising.
-
Partial
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Sponsored messages appear in large public channels, bots and search, and by default are based only on the channel topic or search terms rather than user data.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit is published.
-
Partial
End-to-end encrypted by default Weight 3 of 3
Are all chats, including groups, end-to-end encrypted by default?
Only secret chats, which must be started manually and do not support groups, are end-to-end encrypted; cloud chats and groups use client-server encryption.
-
Partial
No phone number needed Weight 2 of 3
Can an account be created without a phone number?
A phone number is required to sign up, but it can be hidden from everyone and contacts can be reached by username.
-
No
Metadata protection Weight 2 of 3
Does the service minimize who-talks-to-whom metadata (for example sealed sender or no user identifiers)?
The server stores cloud chats and sees who talks to whom.
-
No
Decentralized Weight 1 of 3
Can people run their own server or talk peer to peer?
One central service; the server code is not published.