imo

Is imo safe?

imo does its main job well: free voice and video calls that keep working on slow 2G and 3G connections, which is why it is so widely used by families in South Asia, the Middle East and Africa. Its privacy and security record is much weaker. We score it 42/100, below Viber (58) and WhatsApp (67), and close to LINE (44).

Three things drive that score. imo tracks you across other apps for advertising. Its privacy policy says the usage data it collects includes the content of your messages. And it gives no technical detail about its encryption, which is opt-in for the chats where it applies.

Who is behind imo?

imo is operated by PageBites, Inc., based at 3000 El Camino Real in Palo Alto, California. In its annual report for 2025, filed with the US Securities and Exchange Commission in April 2026, JOYY Inc. lists PageBites, a Delaware company, as one of its significant subsidiaries. JOYY is a Nasdaq-listed group headquartered in Singapore, with most of its listed subsidiaries in mainland China and Hong Kong. It also runs Bigo Live and Likee.

imo's privacy policy says it stores and processes data on servers "in the United States, Asia, and other countries" and warns that those countries may not protect data as well as your home country.

Is imo end-to-end encrypted?

Not by default, as far as anyone outside the company can tell. imo's store listing names end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary among its "Chat Privacy" features, together with SecretChat, disappearing messages, screenshot blocking and Time Machine. SecretChat, launched in 2021, is opened per contact from the chat's attachment bar; messages vanish when you leave and cannot be copied, forwarded or screenshotted.

What is missing matters more. imo publishes no protocol description, no whitepaper and no independent audit, so there is no way to check what the encryption covers or how keys are handled. The privacy policy makes no end-to-end claim at all, and ordinary message history syncs to imo Cloud. The policy even says most communications on the service go over "the standard HTTP protocol" and that information sent this way "is not encrypted", while the Google Play form says data is encrypted in transit. We could not test which statement is accurate, and that uncertainty is part of the score.

imo has also had serious bugs. CVE-2022-47757, found in a late-2022 Android version, let a malicious deep link write a file that the app would later load as code. NIST rates it 9.8 out of 10. We found no public bug bounty programme for imo.

What data does imo collect?

A lot, and some of it is used for ads. Apple's privacy label lists location, contact info, identifiers, usage data and other data as "Used to Track You" across other companies' apps and websites. Photos, videos, audio and other user content are listed under analytics. If you allow background location, imo can collect it even when you are not using the app.

The privacy policy goes further:

• usage data includes who you talk to, how often, when you open messages, and "the content of the messages"
• aggregated data is used "to build language models"
• precise GPS location, plus Wi-Fi and cell tower data, is used to personalise the service and "target advertisements"
• advertising partners may collect your device's advertising ID and IP address
• your phone's address book is uploaded to connect you with friends

Google Play's data safety form tells a different story: it says imo shares no data with third parties. Under our rules, when the policy discloses more than a store label, we score the broader of the two.

Strangers, rooms and scams

imo is more than a private messenger. VoiceClub lets anyone create or join live voice rooms, with talent shows and competitions, and the policy mentions location features called Nearby and Who's Online. These put strangers in contact with users, and Apple's 13+ rating means teenagers can join. imo publishes no data on how many scam or abuse reports it handles.

Governments have also taken an interest. India blocked 14 messengers in May 2023, and media reports citing officials named imo among them, saying the companies had no Indian office and agencies could not contact them. In Russia, T-Zhurnal reports that imo was briefly blocked in 2017, and in May 2025 a Moscow magistrate fined PageBites 800,000 roubles for failing the duties Russian law sets for messaging services. Neither case is a privacy finding.

How to use imo more safely

1. Use SecretChat or a privacy chat for anything personal, and assume ordinary chats can be read by imo.
2. Deny location access in your phone settings, or allow it only while using the app.
3. On iPhone, choose "Ask App Not to Track" when imo asks.
4. Do not grant contact access unless you need imo to find friends.
5. Keep children out of VoiceClub rooms and turn off Nearby features.
6. Update the app promptly, since past flaws allowed code execution.
7. For calls that must stay private, use a messenger with audited default encryption, such as Signal.

How we scored it

Privacy (30) is imo's weakest factor: cross-app tracking, location for ads and a policy that covers message content. Security (38) reflects undocumented, opt-in end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary and a critical 2022 flaw. The regulatory record (85) is the strongest, because no data protection authority has fined imo; the Russian fine and the Indian block were about state access, not privacy. That also means nobody independent has checked its claims.