Botim

Is Botim safe?

Botim is safe enough for ordinary family calls, but it is not a private messenger. We score it 45/100, between imo (42) and Viber (58), and well below WhatsApp (67).

For millions of people in the UAE, Botim is simply how they call home: WhatsApp voice and video calls are blocked there, and Botim is one of the few internet calling apps that work without a VPN. That gives it a captive audience. What it does with that audience is the problem. It tracks users across other apps for ads, shares precise location with advertisers, and backs its encryption claims with nothing anyone can check.

Who runs Botim?

Botim is owned by Astra Tech, an Abu Dhabi company set up in 2022. Astra Tech says it bought Botim in January 2023, after raising US$500 million in a round led by G42, the Abu Dhabi AI and cloud group. It also owns the payments business PayBy and Botim Finance, which received a finance company licence from the UAE central bank in July 2024. Astra Tech claims more than 150 million users in 155 countries.

That ownership shapes the app. Botim is no longer just a calling app: it offers a wallet, international transfers, a prepaid card, bill payments, loans through CashNow, and help with visas, ID renewals and national bonds. The privacy policy covering all of this is written for a regulated payments company, and it barely mentions messages or calls at all.

Is Botim encrypted?

Botim's website says messages, voice notes and media are "fully encrypted", and its Google Play listing ends with the word "Encrypted." Neither says end-to-end, and Botim publishes no protocol description, whitepaper or independent audit.

The one outside test we found points the other way. In January 2025 the digital rights group SMEX ran a forensic analysis of calling apps promoted in the UAE and Saudi Arabia. It found that Botim's data "is only encrypted while being transmitted over the internet", which is ordinary transport encryption, rated the app's overall risk at 14 out of 22 ("High"), and said VirusTotal linked some of the app's contacted addresses to sources flagged as malicious.

Two further points matter. Botim's terms describe the company as "only acting as a repository of data" for your messages, which suggests it holds them. And the same terms forbid users from probing or testing its systems, while we found no bug bounty programme on HackerOne or Bugcrowd. So nobody outside the company can check its security in the open.

The privacy policy adds that Astra Tech may disclose data in response to "governmental requests" and to public authorities for "national security or law enforcement" purposes. SMEX points out that the UAE's 2021 data protection law does not apply to the public sector.

What data does Botim collect?

More than a calling app needs, and some of it goes to advertisers. Apple's privacy label lists identifiers used to track you across other companies' apps and websites, and coarse location, device ID, usage data and advertising data used for third-party advertising. Linked to your identity are your phone number, contacts, payment details, purchase history, fitness data and user content.

Google Play's form goes further on location: it says Botim shares both approximate and precise location with third parties for advertising or marketing. The policy itself allows behavioural advertising through Astra Tech's own and third-party cookies, and lets advertisers collect your IP address and device identifiers.

Retention is long. Because Botim is now a payments platform, the policy keeps "all documents and records" for at least five years after you close your account. You can ask for erasure, but the policy lets the company refuse where it needs the data for legal duties, which covers most of what a wallet produces.

Scams and children

Botim has no public rooms or stranger search, which keeps it calmer than imo or Telegram. The risk comes from its wallet. You can send money straight from a chat, which is exactly what impersonation scams need: a message from a "relative" on a new number asking for an urgent transfer. Botim publishes no figures on scam reports or account removals.

The age rules do not line up. Apple rates the app 4+ and Google Play rates it Everyone in the US, but Astra Tech's privacy policy says every user must be at least 18 and that it does not knowingly collect data from under-18s. The terms set 18, or 21 for some services, for the wallet, card and loans.

How to use Botim more safely

1. Use Botim for everyday calls only. For anything sensitive, use an app with audited end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, such as Signal, where it works.
2. Set location access to "Never" or "While Using", and choose "Ask App Not to Track" on iPhone.
3. Do not give Botim your contacts unless you need it to find people.
4. Never send money from a chat because of a message alone. Call the person on a number you already know first.
5. Keep wallet balances low, and withdraw them before you ask to close the account.
6. Do not set up the wallet for a child's account; the wallet terms bar under-18s.

How we scored it

Privacy (35) and security (38) carry the score down: cross-app tracking, precise location shared for ads and encryption claims with no published proof. Scams and harmful content (55) benefits from Botim's closed design, but loses points for in-chat payments and a 4+ store rating on an adults-only service. The regulatory record (85) is clean, though no data protection authority has examined the app.