TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps

• URL: http://arxiv.org/abs/2608.13390v1
• Date: Thu, 13 Aug 2026 15:51:18 GMT
• Title: TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps
• Abstract summary: Telegram Mini Apps are Web applications embedded within the Telegram client.<n>Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored.<n>We present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps.
• Score: 3.345437353879255
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Telegram Mini Apps are Web applications embedded within the Telegram client, forming an ecosystem of third-party services within one of the world's most widely used messaging platforms. Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored. Unlike ecosystems such as WeChat, which rely on tightly controlled, proprietary execution frameworks, Telegram adopts a different model: Mini Apps run inside a WebView, combining platform-provided context with standard Web capabilities and unrestricted outbound networking. This enables applications to transmit sensitive information to analytics, advertising, tracking, or other third parties through ordinary Web requests, often with limited visibility. Privacy disclosures are therefore critical for transparency. Telegram allows Mini Apps either to define an application-specific privacy policy or to rely on a platform-provided default policy. While the latter reduces the developer's disclosure burden, it may lead to generic statements that do not accurately capture actual data practices of individual Mini Apps. In this paper, we present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps by capturing runtime network traffic, identifying third-party communications, and comparing observed data flows against disclosed privacy information. We evaluate 278 working Mini Apps collected from tApps Center, a community-driven catalogue for discovering third-party applications in Telegram. We find that 59.4% contact at least one undisclosed third party, 78.8% rely exclusively on Telegram's default privacy policy, and none provides a consent or opt-out mechanism. These findings expose a substantial transparency and compliance gap in a widely used yet understudied ecosystem.

Related papers

• TENET: Telegram Mini App (in)security [2.1793134762413433]
  Many Mini Apps store authentication materials, exposing users to unauthorized access, impersonation, and financial exploitation.<n>We present TENET, a purpose-built auditing tool whose design decisions are grounded in the structural properties of the secrets targeted.<n>We propose mitigation measures and best practices for both Telegram platform developers and third-party Mini App creators.
  arXiv  Detail & Related papers  (2026-08-18T08:59:03Z)
• What's on Your Mind? Exploring Privacy of Mental Health Apps [19.866264316153547]
  We present a comprehensive analysis of 25 popular Android mental health and life-coaching apps.<n>Every app embeds at least one tracker SDK that its privacy policy does not name.<n> 68% of apps fail to disclose at least half of the trackers detected in their APKs.
  arXiv  Detail & Related papers  (2026-05-03T18:42:08Z)
• Do Phone-Use Agents Respect Your Privacy? [97.81424230136075]
  We introduce MyPhoneBench, a verifiable evaluation framework for privacy behavior in mobile agents.<n>We operationalize privacy-respecting phone use as permissioned access, minimal disclosure, and user-controlled memory through a minimal privacy contract.<n>Across five frontier models on 10 mobile apps and 300 tasks, we find that task success, privacy-compliant task completion, and later-session use of saved preferences are distinct capabilities.
  arXiv  Detail & Related papers  (2026-04-01T14:50:50Z)
• An Empirical Comparison of Security and Privacy Characteristics of Android Messaging Apps [2.4890815871172736]
  Mobile messaging apps are a fundamental communication infrastructure, used by billions of people every day to share information, including sensitive data.<n>Security and Privacy are thus critical concerns for such applications.<n>We present a methodology for comparing implementation characteristics of messaging applications.
  arXiv  Detail & Related papers  (2026-03-31T12:27:28Z)
• PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Action [54.11479432110771]
  PrivacyLens is a novel framework designed to extend privacy-sensitive seeds into expressive vignettes and further into agent trajectories.<n>We instantiate PrivacyLens with a collection of privacy norms grounded in privacy literature and crowdsourced seeds.<n>State-of-the-art LMs, like GPT-4 and Llama-3-70B, leak sensitive information in 25.68% and 38.69% of cases, even when prompted with privacy-enhancing instructions.
  arXiv  Detail & Related papers  (2024-08-29T17:58:38Z)
• Utilizing Large LanguageModels to Detect Privacy Leaks in Mini-App Code [19.7220607313348]
  Mini-applications, commonly referred to as mini-apps, are compact software programs embedded within larger applications or platforms. This paper investigates the potential of employing Large Language Models (LLMs) to detect privacy breaches within WeChat Mini Programs.
  arXiv  Detail & Related papers  (2024-02-12T01:55:40Z)
• MiniScope: Automated UI Exploration and Privacy Inconsistency Detection of MiniApps via Two-phase Iterative Hybrid Analysis [14.835715789786137]
  MiniApps, operating within larger SuperApps, have revolutionized user experiences by offering a wide range of services without the need for individual app downloads.<n>Despite existing privacy regulations and platform guidelines, there is a lack of effective mechanisms to safeguard user privacy fully.<n>We introduce MiniScope, a novel two-phase hybrid analysis approach, specifically designed for the MiniApp environment.
  arXiv  Detail & Related papers  (2024-01-06T13:54:36Z)
• Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theory [82.7042006247124]
  We show that even the most capable AI models reveal private information in contexts that humans would not, 39% and 57% of the time, respectively. Our work underscores the immediate need to explore novel inference-time privacy-preserving approaches, based on reasoning and theory of mind.
  arXiv  Detail & Related papers  (2023-10-27T04:15:30Z)
• TGDataset: Collecting and Exploring the Largest Telegram Channels Dataset [57.2282378772772]
  This paper presents the TGDataset, a new dataset that includes 120,979 Telegram channels and over 400 million messages.<n>We analyze the languages spoken within our dataset and the topic covered by English channels.<n>In addition to the raw dataset, we released the scripts we used to analyze the dataset and the list of channels belonging to the network of a new conspiracy theory called Sabmyk.
  arXiv  Detail & Related papers  (2023-03-09T15:42:38Z)
• SPAct: Self-supervised Privacy Preservation for Action Recognition [73.79886509500409]
  Existing approaches for mitigating privacy leakage in action recognition require privacy labels along with the action labels from the video dataset. Recent developments of self-supervised learning (SSL) have unleashed the untapped potential of the unlabeled data. We present a novel training framework which removes privacy information from input video in a self-supervised manner without requiring privacy labels.
  arXiv  Detail & Related papers  (2022-03-29T02:56:40Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.