DeepSeek App: A Closer Look at Its Privacy Posture

On January 10, 2025, a Chinese developer launched DeepSeek, an AI app quickly gaining popularity. In just a few days, it dethroned ChatGPT on the Google Play Store and Apple’s App Store, becoming the top AI app on the platform.

However, alongside its rise, privacy experts have flagged some serious concerns. They’re worried about how much data DeepSeek gathers and whether it shares that data with servers in China. Beyond these privacy issues, there are questions about how the app handles alignment and censorship.

This post is the first of a two-part series. In this post, we will dig into DeepSeek’s Android app privacy posture. In part two, we will compare it with three other well-known AI apps: ChatGPT, Claude, and Perplexity. We’ll use Privado’s Mobile App Scanning product to analyze each app (APK or xAPK) to determine which SDKs they use, which permissions they require, and where user data actually goes during normal app usage.

Our main goal is to look beyond the privacy policy and discover what’s happening under the hood. From experience, we know that privacy policies can be worded too generally, covering almost anything that might happen in the future, or too narrowly, omitting actual data sharing that occurs. To avoid any guesswork, we rely on real-world evidence rather than policy statements alone.

‍

How We Rate a Mobile App’s Privacy Posture

We’ll measure each app’s privacy posture based on the following criteria:

1. Permissions
   Which permissions does the app request (e.g., location, microphone, camera), and what does that let the app do?
2. SDKs
   Which third-party software kits (e.g., analytics or advertising SDKs) are built into the app, and what data do they typically collect?
3. Data Collected
   What actual user or device data is the app sending—whether it’s personal info, usage patterns, or location data?
4. Third Parties
   Which other entities (e.g., ad networks, analytics providers) receive user data, as seen in the app’s network traffic?
5. Cross-Border Flows
   Does the app send data to countries outside the user’s home region? (This matters for compliance and regulatory concerns.)
6. Privacy Policy Disclosure Mismatch
   Does the privacy policy match what we observe in real life? Are there any gaps or surprises between the policy and actual data practices?

DeepSeek App

DeepSeek’s privacy policy is broadly written and covers all possible data collection, including sensitive data types like keystrokes. In reality, we found that DeepSeek actually collects less data than is declared in their privacy policy; however, there are clear data flows to China. 

The app asks for eight permissions, including a sensitive permission for Camera. It collects data like unique IDs (iid, aid), device details (model, OS), location (time zone), language, and user inputs like prompts or chat history. This data is shared with big players like Google (US) and ByteDance (China). The app also uses SDKs from Google, Tencent, and ByteDance for authentication, analytics, and marketing purposes

‍

Permissions

• Total permissions: 8
• Sensitive permissions: 1

‍

SDKs

DeepSeek app embeds SDKs from Google, Tencent, Bytedance and transfers data to third parties based out of China.

‍

Data Collected

Deep Seek collects unique identifiers, device identifiers, device details(model name, OS), user input - prompts, text, audio, image data which is transferred to China both internally and to third parties. 

‍

Third Parties

DeepSeek integrates with 4 third parties including volces.com(Volcengine by Bytedance) and fengkongcloud.com(by ishumei.com) where data is shared to China.

In the network traffic analysis of the DeepSeek app, you can see some profiling related to calls:

1. https://chat.deepseek.com/api/v0/ip_to_country_code - Possible Coarse Location detection
2. https://apmplus.volces.com/monitor/collect/c/cloudcontrol/get?sdk_version=400&update_version_code=38&uid={redacted}&device_id={redacted}&os=Android&os_api=35&version_code=38&channel=release_envOnline&device_platform=android&aid={redacted} - Telemetry
3. https://fp-it.fengkongcloud.com/deviceprofile/v4 - Device profiling

Privacy Policy Disclosure Mismatch

‍

The main privacy concerns with DeepSeek are data flows to China - both to their own servers and third-party SDKs integrated into the application. At this point, the privacy policy is broadly written, and the concerns around keystrokes were not found in our tests. Having said that, as more features are added, there is a possibility that excessive data collection can happen in the future.

Methodology

Privado's Mobile App Scanning product simulates a user’s journey on the app from multiple locations. To test DeepSeek, all tests were conducted from California, and the latest app on Playstore as of Jan 27, 2025, was installed on the phone. The analysis was done purely for research purposes to uncover privacy practices of DeepSeek app.