Skip to content
SafetyScorer

Safety scores

Apps

We score apps on five factors. Privacy (how much data the app collects and shares, from App Store labels and privacy policies) and security (encryption, breaches, account protection) count for 30% each. Transparency and user control, and exposure to scams, harmful content and risks to children, count for 15% each. Privacy fines and regulatory orders make up the last 10%. Every page lists its sources and the settings worth changing.

All rated apps

  1. #1 of 61

    Signal

    Signal is the most private mainstream messenger we score. Everything is end-to-end encrypted by default and the company can hand over almost nothing to police. The main risk is phishing that tricks you into giving away your account.

    Score 92, grade A

  2. #2 of 61

    Threema

    Threema is one of the most private messengers available. You can use it without a phone number or email, all chats and calls are end-to-end encrypted, and the apps are open source and audited. The trade-offs are a one-off price, a smaller user base and new private equity owners since 2026.

    Score 90, grade A

  3. #3 of 61

    Bitwarden

    Bitwarden is a safe password manager for most people. Vaults are encrypted on your device, the apps are open source and audited yearly, and no vault breach has been reported. A 2026 study showed what a hacked Bitwarden server could do, and a malicious copy of its command-line tool briefly sat on npm.

    Score 88, grade A

  4. #4 of 61

    1Password

    1Password is a safe password manager for most people. Vaults are encrypted on your device with your account password plus a 128-bit Secret Key, and no vault breach has been reported. It collects more app analytics than Bitwarden, the code is not open source and exports are unencrypted.

    Score 86, grade A

  5. #5 of 61

    DuckDuckGo

    DuckDuckGo's search and browser app is a strong privacy choice. It does not store searches with your IP address, blocks most third-party trackers and collects nothing it links to you. Its ads come from Microsoft, which kept a tracking exception until 2022, and as a browser it cannot shield you from every scam site.

    Score 85, grade A

  6. #6 of 61

    Proton Mail

    Proton Mail is one of the most private email services we score. Stored mail is encrypted with keys Proton does not hold, and the app has no ads or trackers. The limits are metadata and Swiss law. Subject lines are not end-to-end encrypted, and Proton has handed an IP address and a recovery email to police.

    Score 85, grade A

  7. #7 of 61

    Brave

    Brave is one of the most private mainstream browsers. It blocks ads and trackers by default, Apple's label shows no data linked to you, and its Leo AI does not keep your chats. The catches are past slips, such as affiliate codes in 2020 and a Tor leak in 2021, and crypto features most people do not need.

    Score 81, grade B

  8. #8 of 61

    NordVPN

    NordVPN is a safe VPN for hiding your traffic from your network and internet provider. Its no-logs claim has passed six independent assessments since 2018. It loses points for a 2018 server breach it disclosed 18 months later, an app that links a user ID to its own marketing, and US lawsuits over automatic renewals.

    Score 79, grade B

  9. #9 of 61

    Zoom

    Zoom is a reasonably safe choice today. The security problems that led to an FTC order in 2020 have mostly been fixed and end-to-end encryption is available, but it is off by default. The main risk in 2026 is fake Zoom invitations and "updates" that install remote-access malware.

    Score 71, grade B

  10. #10 of 61

    Netflix

    Netflix is one of the safer mainstream apps, with no strangers, almost no user content and solid controls for children. The weak points are ad plans that target viewers with outside data, a €4.75 million Dutch GDPR fine, and constant phishing emails that copy Netflix.

    Score 67, grade C

  11. #11 of 61

    WhatsApp

    WhatsApp protects what you say with strong end-to-end encryption, but Meta collects a lot about who you are, who you talk to and how you use the app. Scam messages and account hijacking are the risks most users will actually meet.

    Score 67, grade C

  12. #12 of 61

    Slack

    Slack is a safe enough tool for work chat with a clean regulatory record. Messages are not end-to-end encrypted, your employer controls and can export them, and Slack trains its non-generative AI models on customer data unless the workspace owner opts out by email.

    Score 65, grade C

  13. #13 of 61

    Microsoft Teams

    Teams is a reasonable choice for work chat and meetings. It does not track you for ads, but chats are not end-to-end encrypted, your employer can read and keep them, and criminals now use Teams calls posing as IT support to break into companies.

    Score 63, grade C

  14. #14 of 61

    Gmail

    Gmail is one of the safer email services against hacking and phishing, with strong spam filters and sign-in protection. The weaker side is privacy. Emails are not end-to-end encrypted, the app shares data for advertising, and France fined Google €325 million in 2025 for showing ads between emails without consent.

    Score 62, grade C

  15. #15 of 61

    Duolingo

    Duolingo is a safe app for learning, with almost no stranger contact and careful limits for children under 13. The catch is data, not content. The free version is paid for by ad networks that track you, profiles are public by default, and a 2023 scrape tied 2.6 million email addresses to user profiles.

    Score 61, grade C

  16. #16 of 61

    Airbnb

    Booking through Airbnb is reasonably safe if you keep every message and payment inside the app. Its data record is cleaner than most travel and shopping apps, but scams that pull guests off the platform are common, and regulators in Spain and Australia have penalised it over listings and prices.

    Score 60, grade C

  17. #17 of 61

    Claude

    Claude is reasonable for everyday questions, but it is not a private notebook. Anthropic trains on consumer chats unless you opt out, keeps them up to five years when training is on, and signs you in only through Google or an emailed link. Shared chats turned up on Google in July 2026.

    Score 60, grade C

  18. #18 of 61

    Google Gemini

    Gemini sits on Google's strong account security and does not use your chats for ads. The trade-off is retention. Chats train Google's models unless you turn activity off, and conversations picked for human review are kept for up to three years, even if you delete them.

    Score 60, grade C

  19. #19 of 61

    Google Maps

    Google Maps is safe to use and far more private than it was in 2023, now that location history is off by default and stored on your device. It still links searches and location to your Google account for advertising, Google has paid large settlements over location tracking, and fake listings are a scam route.

    Score 60, grade C

  20. #20 of 61

    PhonePe

    PhonePe is a reasonable way to make UPI payments in India. Your money stays in your bank and every payment needs your UPI PIN. The catches are wide data collection for marketing and lending, UPI scams that move money instantly with no buyer protection, and RBI penalties over wallet rules in 2019 and 2025.

    Score 59, grade C

  21. #21 of 61

    Microsoft Copilot

    Copilot is a reasonable choice for everyday questions. Since August 2026 Microsoft says the new app does not train its models on your chats, but the app tracks you for advertising, ads can be personalised with your conversations, and a one-click data-theft flaw took eight months to fix.

    Score 58, grade C

  22. #22 of 61

    Spotify

    Spotify is a safe app for listening, and the main risks are modest. Free accounts are profiled for advertising, Swedish courts have upheld a SEK 58 million GDPR fine over how Spotify answers data requests, and the new Messages feature and open podcast uploads bring some content most music apps never had.

    Score 58, grade C

  23. #23 of 61

    ChatGPT

    ChatGPT is secure enough for everyday questions, but it is not a private diary. OpenAI stores your chats, uses them for training by default, shows ads to free users in the US, and faces lawsuits claiming it failed vulnerable teenagers.

    Score 57, grade C

  24. #24 of 61

    Fortnite

    Fortnite is a reasonable choice for older children if a parent sets it up. Epic's controls for chat, spending and time are among the best in gaming, but they exist because the FTC found that open voice chat and trick purchases harmed children, and Epic paid $520 million in 2022.

    Score 57, grade C

  25. #25 of 61

    Perplexity

    Perplexity is a reasonable way to look things up, with an easy training opt-out and incognito mode. Searches train its models by default, the app can link your precise location to you, and its Comet browser, which can act inside your accounts, has been tricked by instructions hidden in web pages.

    Score 57, grade C

  26. #26 of 61

    Discord

    Discord is a middling choice. It collects less for advertising than most social apps, but text messages are not end-to-end encrypted, a vendor breach exposed about 70,000 government ID photos in 2025, and open servers expose children to adults and harmful content.

    Score 56, grade C

  27. #27 of 61

    PayPal

    PayPal is a reasonable way to pay online stores, because goods and services payments carry Purchase Protection. The catches are a 2022 breach that led to a $2 million New York penalty, default sharing of shopping data with merchants since 2024, and scams that push people into unprotected Friends and Family payments.

    Score 55, grade C

  28. #28 of 61

    Pinterest

    Pinterest is fairly safe for adults, with optional two-factor login and no privacy fines. The weak points are ad tracking that is on by default and a record of recommending harmful content to teenagers, which led to stricter teen settings after a UK inquest and a 2023 NBC News investigation.

    Score 55, grade C

  29. #29 of 61

    Roblox

    Roblox's privacy and security are about average for a big app. Its weakness is child safety. Adults have used the platform to reach children, which led to more than 170 federal lawsuits and several state cases, and face-based age checks for chat only arrived in January 2026.

    Score 55, grade C

  30. #30 of 61

    Hinge

    Hinge collects less data for advertising than most dating apps and has no major fine or breach on record. Its weak spot is what happens after a user is reported. A 2025 investigation and a lawsuit by six women allege that a man reported to Hinge for rape kept using its apps for years.

    Score 54, grade D

  31. #31 of 61

    YouTube

    YouTube is one of the safer big platforms on security, thanks to Google's account protection, and it has no private messaging to worry about. The risks are what the recommendation feed shows children, scam ads and fake livestreams, and the amount of viewing data Google uses for advertising.

    Score 54, grade D

  32. #32 of 61

    Amazon

    Your Amazon account and card are well protected, and a breach of customer accounts is not the main risk. The weak points are how much data Amazon collects, a record of US orders over Prime, Alexa and Ring, and the scammers who pretend to be Amazon.

    Score 53, grade D

  33. #33 of 61

    CapCut

    CapCut is a low-risk editor in terms of strangers and scams, because it is a tool rather than a social network. The privacy terms are the problem. ByteDance takes a perpetual licence to what you upload, collects clips even before you save them, and faces a US class action over face and voice data.

    Score 53, grade D

  34. #34 of 61

    Truecaller

    Truecaller is good at what users want, flagging spam and scam calls. The privacy cost falls partly on other people, since its caller ID shows names for numbers whose owners never joined. Sweden's regulator closed a GDPR case in 2025 without action, but scraped Truecaller data has been offered for sale.

    Score 53, grade D

  35. #35 of 61

    Telegram

    Telegram is not the private messenger many people think it is. Only optional one-to-one secret chats are end-to-end encrypted, public groups are full of scams, and the company now shares IP addresses and phone numbers with police on valid requests.

    Score 52, grade D

  36. #36 of 61

    Bumble

    Bumble has some of the better safety tools among dating apps, including optional ID verification, automatic blurring of nude photos and AI that hunts fake accounts. Its privacy is weak, though. Its own App Store label lists location, contact details and sensitive info used for tracking or third-party advertising.

    Score 50, grade D

  37. #37 of 61

    Snapchat

    Snapchat's disappearing messages and encrypted Snaps give it a better privacy design than most social apps, but it tracks users for advertising and faces a growing number of state lawsuits that accuse it of failing to protect children from sextortion and drug dealers.

    Score 50, grade D

  38. #38 of 61

    Tinder

    Tinder has become safer to use since Face Check video selfies became mandatory for new users in many countries, but it collects sensitive data, shares identifiers for ad tracking, and faces a proposed Irish GDPR fine. The biggest risk is still the person on the other side of the chat.

    Score 50, grade D

  39. #39 of 61

    Reddit

    Reddit lets you use a pseudonym and tracks less than Instagram or X, but everything you post publicly is licensed to AI companies, moderation depends on volunteers, and the UK privacy regulator fined it £14.47 million in 2026 for letting under-13s in without age checks.

    Score 49, grade D

  40. #40 of 61

    LinkedIn

    LinkedIn is useful and mostly free of the harassment found on other social apps, but it uses your profile and activity for ads and AI training by default, was fined €310 million in Ireland, and is a favourite hunting ground for fake recruiters, including North Korean hacking groups.

    Score 48, grade D

  41. #41 of 61

    Venmo

    Venmo works well for paying people you know. Its weak points are privacy and scams. Payments from new accounts may be public by default, the FTC found in 2018 that Venmo misled users about privacy and security, and personal payments sent to a scammer have no Purchase Protection.

    Score 48, grade D

  42. #42 of 61

    Cash App

    Cash App collects less for advertising than most payment apps, and its App Store label shows no cross-app tracking. Its weak point is fraud. The CFPB found in 2025 that Block mishandled fraud and unauthorized transfers, and state regulators and attorneys general have added penalties since.

    Score 47, grade D

  43. #43 of 61

    Facebook Messenger

    Messenger now encrypts personal chats and calls end to end, so Meta cannot read them. Everything around the messages is another matter. Apple's label lists precise location, contacts and browsing history linked to you for advertising, and Meta has a long record of privacy fines.

    Score 47, grade D

  44. #44 of 61

    Life360

    Life360 shows families where everyone is, which means a company holds your children's location around the clock. It sold precise location data to brokers until 2022, still earns about 7% of revenue from data insights, had two data exposures in 2024, and its Tile trackers have known stalking weaknesses.

    Score 46, grade D

  45. #45 of 61

    Threads

    Threads runs on your Instagram account and collects the same 14 categories of data, now for ads in every market. Its DMs are not end-to-end encrypted. It is calmer than X, teen accounts are private by default, and it has no regulatory penalties of its own so far.

    Score 46, grade D

  46. #46 of 61

    Uber

    Almost every Uber trip ends without a safety report, and the app's trip-sharing and PIN tools help. Its data record is weak, though, from paying hackers to hide a 2016 breach to a €290 million Dutch GDPR fine in 2024, and thousands of passengers have sued over sexual assaults by drivers.

    Score 46, grade D

  47. #47 of 61

    Character.AI

    Character.AI is an adult role-play app with a troubled record on teenagers. It tracks users for advertising, keeps every chat, and faces lawsuits from Kentucky and Pennsylvania. Since November 2025 under-18s can no longer chat freely with its characters.

    Score 45, grade D

  48. #48 of 61

    Grok

    Grok's app collects less than most AI apps and lets you opt out of training, but its safety record is the weakest of the big chatbots. In early 2026 it was used to make sexualised images of real people, including children, and regulators in the EU, Ireland and the UK opened investigations that are still running.

    Score 45, grade D

  49. #49 of 61

    LINE

    LINE encrypts most one-to-one and small group chats end to end by default, but Open Chat, official accounts and group calls are not covered. A 2023 breach via NAVER-linked systems exposed over 500,000 records, Japan's communications ministry has issued four rounds of guidance since 2024, and scammers use it heavily.

    Score 44, grade D

  50. #50 of 61

    KakaoTalk

    KakaoTalk is hard to avoid in South Korea and works well for everyday chat, but it is a weak choice for anything private. Normal chats are not end-to-end encrypted, an open chat data leak led to a record ₩15.1 billion privacy fine that a court upheld in 2026, and the app leans heavily on advertising.

    Score 43, grade D

  51. #51 of 61

    Temu

    Buying from Temu will not usually get you scammed, but it sits near the bottom of our list. The EU fined it €200 million in 2026 because shoppers were very likely to meet illegal products, and several US states accuse it of harvesting data, which Temu denies.

    Score 42, grade D

  52. #52 of 61

    Grindr

    Grindr holds very sensitive data, from sexual orientation to HIV status and live location, and its record with it is poor. Norway's NOK 65 million fine for sharing data with advertisers was upheld in court, and Grindr settled a UK group claim for £26 million in 2026.

    Score 41, grade D

  53. #53 of 61

    Shein

    Ordering from Shein rarely ends in outright fraud, but the app has a weak record. French regulators fined it €190 million in 2025 over cookies and fake discounts, a 2018 breach exposed 39 million accounts, and the EU opened a Digital Services Act investigation in 2026.

    Score 41, grade D

  54. #54 of 61

    TikTok

    TikTok collects a lot of data, uses it for ad tracking, and has one of the worst regulatory records on our list, including €875 million in Irish GDPR fines. For children, the feed's design and default settings are a bigger worry than the China question.

    Score 41, grade D

  55. #55 of 61

    Instagram

    Instagram has better teen protections than it did a few years ago, but Meta still collects and tracks more data than almost any app, removed its optional encrypted messages in 2026, and has lost two child-safety jury trials this year.

    Score 40, grade D

  56. #56 of 61

    Meta AI

    Meta AI is built into Facebook, Instagram, WhatsApp and its own app, and it feeds Meta's ad business. Outside the EU, UK and South Korea, what you tell it shapes your ads, with no switch to stop it. Its record with teenagers and a 2025 privacy bug add to the concerns.

    Score 38, grade F

  57. #57 of 61

    Facebook

    Facebook is not malware, and Messenger chats are now end-to-end encrypted by default. But Meta collects and tracks more data than almost any app, has the heaviest privacy fine record of any company we score, and scam ads and Marketplace fraud are part of daily use.

    Score 37, grade F

  58. #58 of 61

    X (Twitter)

    X tracks users for ads, its paid blue checkmark makes impersonation easy, and its Grok AI tool was used to create sexualised images of real people, including minors, in early 2026. It has fewer privacy fines than Meta, but its moderation record is weaker.

    Score 37, grade F

  59. #59 of 61

    WeChat

    WeChat is hard to avoid if you deal with people or businesses in China, but it is a weak choice for anything private. Chats are not end-to-end encrypted, researchers found its encryption below modern standards, and files sent between accounts outside China were scanned to build its censorship lists.

    Score 36, grade F

  60. #60 of 61

    DeepSeek

    DeepSeek's chatbot is free and capable, but everything you type is stored on servers in China. Regulators in Italy, South Korea and Berlin have acted against its data transfers, and in January 2025 researchers found a database of user chats open on the internet. Use it only for questions you would happily publish.

    Score 32, grade F

  61. #61 of 61

    Tea

    Tea promises women a safer way to check out dates, but in July 2025 it left verification photos, ID images and about a million private messages exposed. Apple removed it from the App Store in October 2025. It is still on Google Play, and a class settlement over the leaks is being finalised.

    Score 32, grade F