Nearly 60% of Telegram Mini Apps contact at least one third party they never disclosed to the user, according to a new analysis of 278 working apps published on 13 August as an arXiv preprint S¹. Zero of the 278 offered a consent or opt-out mechanism S¹. The finding lands at a moment when Telegram's Mini App ecosystem is expanding rapidly as a lightweight alternative to native app stores, and it raises a question every user should be asking: if the privacy policy doesn't mention the third party receiving your data, what exactly is the policy protecting you from?

My read: This is the first systematic privacy audit of Telegram Mini Apps I've seen, and the numbers are stark enough to take seriously even before peer review. What jumps out is the 59.4% undisclosed-contact rate combined with 78.8% relying on Telegram's default policy. Most developers aren't even writing their own privacy terms. They're inheriting a platform default and then quietly sending data elsewhere. I'd hold off calling this a confirmed legal violation, because the paper measures third-party contact, not verified sensitive-data exfiltration. But the architectural capability is there, and the disclosure gap is real.

How Mini Apps work, and where the gap opens

Telegram Mini Apps are web applications embedded inside the Telegram client S¹. They run inside a WebView, the same browser engine technology that powers in-app browsers, which gives them two things at once: platform-provided context (your Telegram user ID, language, theme) and standard web capabilities including unrestricted outbound networking S¹. That second part is the hinge. Unrestricted outbound networking means a Mini App can make HTTP requests to any server on the internet, beyond Telegram's infrastructure.

Telegram's rules allow Mini App developers to either write their own app-specific privacy policy or fall back on a platform-provided default S¹. The researchers found that 78.8% of the apps they tested chose the default, meaning four out of five never drafted a custom policy describing what their app actually does with user data S¹.

What TeleGapper actually measured

The research team, led by Luca Ferrari at IMT School for Advanced Studies Lucca with Mariano Ceccato, built a tool called TeleGapper P². It works as a black-box dynamic analysis framework: it runs each Mini App, captures the network traffic in real time, identifies which third-party servers the app contacts, and then compares those observed data flows against what the app's privacy policy actually discloses S¹.

The team collected 278 working Mini Apps from tApps Center, a community-driven catalogue S¹. This is a sample of convenience, not a random draw from Telegram's full ecosystem, so the numbers describe these 278 apps specifically rather than the platform as a whole. With that caveat, the findings are consistent and pointed.

Telegram Mini App privacy findings (278 apps tested)

The 59.4% figure means that 165 of the 278 apps contacted at least one third-party server that appeared nowhere in their privacy documentation S¹. The paper describes this as a substantial transparency and compliance gap in what the authors call a widely used yet understudied ecosystem S¹.

Why the architecture makes this hard to police

The core problem is structural. A Mini App running in a WebView has the same networking freedom as any ordinary web page loaded in a browser. There is no sandbox restricting outbound traffic to a whitelist of domains. Telegram provides the platform context, but once the app is running, the network calls happen inside the WebView and outside Telegram's direct control.

This is not unique to Telegram. The same tension exists in any super-app or mini-program platform where third-party code runs inside a host application. But Telegram's default-policy option creates an additional layer of ambiguity. When 78.8% of apps inherit the platform default rather than writing their own terms, users reading that default policy are getting a generic description that may bear no relationship to what the specific app in front of them actually does S¹.

TeleGapper applies this principle to Mini Apps: measure the traffic, compare it to the policy, and count the mismatches.

What to do about it

If you run a business that builds or commissions a Telegram Mini App, the practical takeaway is straightforward: write your own privacy policy and list every third party your app contacts. Inheriting the platform default is not a compliance strategy. A small fintech that launches a Mini App for customer support, for instance, might integrate an analytics SDK and a payment gateway. Both are third parties. If neither appears in the app's privacy policy, the app would land in the 59.4% bucket the moment TeleGapper or any similar tool runs against it.

For users, the options are limited. There is no in-client indicator that a Mini App is contacting undisclosed servers. The only practical check this week is to open Telegram's Mini App settings before launching one and look for a custom privacy policy link. If the app relies on the platform default, treat it the way you would any web page with no published privacy terms: assume it may share data with parties you cannot see.

What we don't know yet

The paper is an arXiv preprint and has not been peer-reviewed S¹. The methodology and quantitative findings have not been independently validated. The sample of 278 apps comes from a single community catalogue, tApps Center, which Telegram itself does not operate or endorse, so the results may not represent the broader Mini App ecosystem S¹.

The findings establish that these apps contact undisclosed third parties, but the paper does not confirm that specific sensitive user data was exfiltrated. The architectural capability exists, given the unrestricted outbound networking, but capability and confirmed transmission are different evidence thresholds. The paper's authors describe a transparency and compliance gap, not a verified data breach S¹.

The next signal: the paper is listed under the journal Computers and Security P², which suggests it may be heading toward formal peer review. If it passes review and the methodology holds, the 59.4% figure becomes a citable benchmark for Mini App privacy. We'll check the published version against these preprint numbers when it appears.

If this kind of breakdown is useful, subscribe for the next one.

Sources: S1 — TeleGapper: On the (un)reliability of Privacy Policies in Telegram Min · P2 — TeleGapper: On the (un)reliability of Privacy Policies in Telegram Min · P3 — MiniAppBench/miniappbench · P4 — Telegram-Mini-Apps/tma.js · P5 — Open-Privacy-Policy-Taxonomy/oppt

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.