WHAT THE POLICIES SAY

Threema is a paid Swiss end-to-end encrypted messenger that requires no phone number or email address -- users are identified by a random Threema ID -- and whose business model is direct payment rather than data monetisation. Messages are deleted from its Swiss-operated servers immediately after delivery, connection information is not logged, and its standing transparency report shows that under Swiss law it can provide authorities only an ID's creation date, last-login date, and opt-in linkage hashes: 2,746 requests received since 2014. In January 2023 ETH Zurich researchers published seven attacks against Threema's then-current protocol; Threema had already shipped its successor protocol Ibex, the researchers stated they believed all discovered vulnerabilities were mitigated by the patches, and Cure53 audits of the apps in 2020 and the desktop client in 2024 found no high-risk or critical vulnerabilities.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

8 ON FILE

COLLECTION

Threema's privacy page states that no phone number or email address is required to use the service, that the user's random Threema ID keeps them anonymous to both communication partners and Threema, that messages are deleted from its servers immediately after delivery, that connection information is not logged, and that group memberships remain solely on the user's devices.

threema.com ↗

[2026-06-30] · COLLECTION

Threema's transparency report, updated 2026-06-30, states that under Swiss law the data it can provide to authorities is limited to the date (without time) of a Threema ID's creation, the date of its most recent login, and -- only where the user opted to link them -- hashes of a phone number or email address and a push token for third-party push services.

threema.com ↗

OWNERSHIP TRANSPARENCY

Threema states that as a Swiss company it develops exclusively in Switzerland and operates redundant server infrastructure there, and that it is not subject to the US CLOUD Act.

threema.com ↗

[2026-06-30] · SHARING

Threema's transparency report discloses the volume of authority requests it has received: 2,746 total since 2014 through 2026-06-30, with 423 requests in 2025 of which 402 resulted in data being provided, and 306 requests in 2024 of which 288 resulted in data being provided -- the providable data being limited to the minimal set the report enumerates.

threema.com ↗

TRACK RECORD

Threema's code-audit documentation states it is regularly subjected to comprehensive audits by recognised security experts, including a Cure53 audit of the mobile apps in October 2020 and of the new desktop app in January 2024, with the audits revealing no high-risk or critical vulnerabilities in Threema's Android and iOS apps and Threema Safe.

threema.com ↗

TRACK RECORD

Threema's statement on the ETH Zurich findings says the presented findings have been addressed or no longer apply to its current communication protocol Ibex, released in late November 2022, and that none of them ever had any considerable real-world impact; the ETH researchers stated they believe all the vulnerabilities they discovered were mitigated by Threema's patches while cautioning they did not audit Ibex in detail.

threema.ch ↗

[2023-01-09] · TRACK RECORD

In January 2023, researchers from ETH Zurich's Applied Cryptography Group (Paterson, Scarlata, Truong) published an analysis presenting seven attacks against Threema's then-current communication protocol across three threat models, covering potential key recovery, message deletion, authentication failures, and server spoofing; the work was presented at USENIX Security 2023.

breakingthe3ma.app ↗

TRACKING TECH

Threema's privacy page states that it consistently refrains from advertising and tracking individual users, and that its business model is based on direct payments instead of data trading, keeping communication ad-free; optional contact synchronisation uses cryptographic hashes to protect the address book.

threema.com ↗

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7