# Threema privacy rating

Paid end-to-end encrypted messenger from Switzerland that works with a random Threema ID instead of a phone number. The apps are open source; the server is proprietary.

## Summary

Threema scores 83 out of 100 (grade B) on the messengers criteria. It meets 5 of 8 criteria: no trackers or telemetry, no ads or data sales, independent audit, end-to-end encrypted by default and no phone number needed. It partly meets open source, metadata protection and decentralized. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law.

- Website: https://threema.com
- Source code: https://github.com/threema-ch
- Jurisdiction: Switzerland. Not in the Five, Nine or Fourteen Eyes. GDPR-style data protection law.
- Home page trackers: none found
- Category: [Messengers](https://privacyratings.com/messengers/)
- Grade: B (83/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | The apps are AGPL-3.0; the server is closed source. | https://github.com/threema-ch/threema-android/blob/main/LICENSE.txt |
| No trackers or telemetry | Yes | Threema states it refrains from advertising and tracking users; the website uses only a first-party affiliate cookie. | https://threema.com/en/why-threema/privacy |
| No ads or data sales | Yes | Funded by app purchases and business licenses, with no ads or data trading. | https://threema.com/en/why-threema/privacy |
| Independent audit | Yes | Cure53 published a full audit report of the desktop app. | https://threema.com/assets/6-resources/audits/3ma-03-report.v3.pdf |
| End-to-end encrypted by default | Yes | All messages, media, calls and group data are end-to-end encrypted. | https://threema.com/en/why-threema/security |
| No phone number needed | Yes | No phone number or email address is required; accounts use a random Threema ID. | https://threema.com/en/why-threema/privacy |
| Metadata protection | Partial | Group memberships stay on devices and messages are deleted after delivery, but the server routes messages by sender and recipient ID. | https://threema.com/en/why-threema/privacy |
| Decentralized | Partial | Organizations can self-host with Threema OnPrem, but servers do not federate. | https://threema.com/en/products/onprem |

Source: https://privacyratings.com/messengers/threema/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/messengers/threema.md