Encrypted Does Not Mean Private
WhatsApp messages are end-to-end encrypted. That means the content of your texts, photos, and voice notes is scrambled on your phone and only unscrambled on the phone of the person you sent them to. Nobody sitting in between, not WhatsApp, not Meta, not your internet service provider, not the government, can read what you typed. This is real encryption. It uses the Signal Protocol, which is open-source and has been reviewed by independent cryptographers. On the encryption of message content alone, WhatsApp does a good job. Credit where it is due.
But encryption and privacy are not the same thing.
WhatsApp cannot read your messages. It can, however, see who you messaged. It knows when you sent the message, how long your conversation lasted, which device you used, your IP address when you sent it, your phone number, the phone numbers of everyone in your contact list including people who do not use WhatsApp, your profile photo, your status, your group memberships, how often you open the app, and your usage patterns. All of that is metadata. WhatsApp collects it and shares it with Meta, the parent company that also owns Facebook and Instagram. Meta uses this data to build advertising profiles. They do not need to read your messages. The metadata alone tells them plenty.
Think about what metadata reveals without reading a single word of content. You messaged a cancer hospital at 10 in the morning. You called a lawyer at 11. You sent a long message to your family group at noon. By 2 PM you were on the phone with a life insurance agent. Nobody read anything. The pattern told the whole story.
Former NSA director Michael Hayden said it publicly: “We kill people based on metadata.” That was about government surveillance, not advertising, but the principle holds. Metadata is powerful. Companies know this. Meta collects it in enormous quantities through WhatsApp, and the 2021 privacy policy update that caused a brief panic in India confirmed that WhatsApp shares user metadata with other Meta properties. The panic faded. The data sharing did not.
Now look at Telegram.
Regular Telegram chats are not end-to-end encrypted. This is not a technicality or a fine-print caveat. The default chat mode on Telegram uses what is called server-client encryption, which means your messages are encrypted between your phone and Telegram's servers, but Telegram itself can read them. Every text, every photo, every file you share in a regular Telegram chat or in any Telegram group sits on Telegram's cloud servers in a form the company has access to. This includes every group chat. There is no option for end-to-end encryption in Telegram groups. Not a hidden one. Not a paid one. It does not exist.
Telegram does have a feature called Secret Chats. These are end-to-end encrypted. But Secret Chats have to be started manually through a separate menu option, they only work between two people, they only exist on the specific device where you started them, and they are not available for group conversations. Most Telegram users in India have never opened a Secret Chat. Many do not know the feature exists. The regular chat screen, the one everyone uses, is not end-to-end encrypted.
The encryption protocol Telegram uses is called MTProto. It was built in-house by Telegram's team rather than using the widely reviewed Signal Protocol or any other established standard. The cryptography research community has repeatedly flagged concerns about building your own encryption protocol instead of using one that thousands of researchers have tested. No independent, published security audit of MTProto exists. That does not automatically mean it is broken, but it means we are trusting Telegram's internal team instead of trusting open, peer-reviewed work. For something handling the private messages of hundreds of millions of people, that is a shaky foundation.
Then there is Signal.
Signal collects almost nothing. When the FBI served Signal with a grand jury subpoena in 2021, the company handed over exactly two data points: the date the account was created and the date the account last connected to Signal's servers. No message content. No contacts. No group memberships. No IP addresses. No profile information. Signal could not hand over data it never collected. The subpoena response is publicly available online. Go read it. It is one page long.
Three apps. Three very different relationships with your data. One cannot read your messages but watches everything around them. One can read your messages and stores them on its own servers. One cannot read your messages and does not store anything about you at all.
Signal vs WhatsApp vs Telegram: Stripped Down
Signal. Built by the Signal Foundation, a non-profit. No advertising revenue. No investors demanding growth metrics. No corporate parent company trying to turn your conversations into money. The Signal Protocol encrypts every text, call, video call, group message, file transfer, and even your profile name. Disappearing messages let you set a timer after which messages auto-delete on both sides of the conversation. Sealed sender hides the identity of who sent a message even from Signal's own servers. Call relay routes your voice and video calls through Signal's servers so the person you are calling never sees your IP address.
Signal has stickers, reactions, group video calls, stories, and a desktop app that syncs with your phone. It is not missing features. The interface is clean and fast. I tested it side by side with WhatsApp for three months, and the app itself never felt like a downgrade in terms of how it works day to day.
The catch is adoption.
During the WhatsApp privacy policy controversy in January 2021, millions of Indians downloaded Signal. For about two weeks, it felt like the switch was actually happening. Then everyone went back to WhatsApp. Your family group is on WhatsApp. Your office group is on WhatsApp. Your building maintenance committee, your kid's school parent group, your local kirana delivery person. All on WhatsApp. Signal cannot solve this. No amount of better encryption changes the fact that a messaging app is only useful if the people you want to talk to are on it.
But that does not make Signal pointless. Even if only four or five people in your life use it, those can be the people who matter most. Your spouse, your closest friend, your accountant, your doctor. The conversations you would genuinely not want a corporation to profile. Move those to Signal and leave the everyday coordination on WhatsApp. That split is practical, and it protects the conversations that actually need protecting.
WhatsApp. End-to-end encryption on message content using the Signal Protocol. Genuinely strong encryption. But Meta collects your phone number, your contact list (including people who do not use WhatsApp), your profile photo, your device information, your IP address, your location data, your usage patterns, your interaction metadata, and your transaction data if you use WhatsApp Pay. This data gets shared with Meta and used for advertising across Facebook and Instagram. If you have ever wondered why you see an ad on Instagram for something you only discussed on WhatsApp, metadata correlation is likely the answer. Meta denies reading message content for ads, and the encryption means they technically cannot. But they have enough data around the messages to make eerily accurate guesses.
Cloud backups are the other major problem. If you back up your WhatsApp chats to Google Drive, as most Android users in India do, that backup sits on Google's servers without end-to-end encryption unless you specifically turned on the encrypted backup option. WhatsApp added this feature, but it is not on by default. Most people never touch it. That means your entire message history, every conversation you thought was encrypted, is sitting in plain readable form on Google's cloud. Apple iCloud has the same issue for iPhone users unless the encrypted backup toggle is active. Go check yours right now. Settings, then Chats, then Chat Backup, then End-to-end Encrypted Backup. If it says off, your encrypted messages have been sitting unencrypted on someone else's server this whole time.
WhatsApp Pay adds another layer. Your UPI transactions through WhatsApp generate financial data that flows through Meta's systems. Your bank, the amount, the date, the recipient. For payments, standalone UPI apps like Google Pay, PhonePe, or your bank's own app keep your financial data separate from your messaging profile. Mixing your chat metadata with your payment data in one company's hands gives that company a remarkably detailed picture of your life.
Telegram. The worst option of the three for private conversations. Regular chats are not end-to-end encrypted. Period. Group chats are not end-to-end encrypted. Period. There is no option to make them so. Telegram uses its own proprietary MTProto protocol, which has not undergone an independent published security audit. If you share your Aadhaar number, PAN card details, bank statements, medical reports, or any sensitive document in a Telegram group, Telegram has a copy on its servers.
Where Telegram does well is everything that is not private messaging. Broadcasting to large audiences through channels. Sharing files up to 2 GB. Running groups of up to 200,000 members. A bot system that lets developers build useful tools inside the platform. Cloud sync that keeps your messages available on every device you log into. For news channels, community groups, content distribution, and conversations where privacy is not a factor, Telegram is excellent. It is a great public platform. It is a terrible private one.
I use all three. WhatsApp for everyday coordination because that is where everyone is. Signal for anything I want to keep between me and the other person. Telegram for following news channels and tech communities. Each app has a specific job. The mistake is using one app for everything and assuming it handles all of those jobs equally well.
Group chats make the differences between these three apps even more obvious. Signal groups are fully end-to-end encrypted, with encrypted member lists, disappearing messages, and admin controls. WhatsApp groups encrypt message content but still collect metadata on every member and every message timestamp, all of which feeds back to Meta. Telegram groups have zero end-to-end encryption. Not optional. Not hidden behind a setting. It does not exist for groups. If your housing society WhatsApp group has ever shared members' Aadhaar details or bank account numbers, that metadata is now in Meta's systems. If it happened on Telegram, the actual documents are on Telegram's servers in readable form. Neither of those is good. Signal handles both cases correctly.
Just Switch Already
Nobody is saying delete WhatsApp. Five hundred million Indians use it. Your employer probably mandates it. Your kid's school sends homework on it. Deleting WhatsApp in India is like refusing to use cash. Technically possible, practically absurd.
But you can stop using WhatsApp for the conversations that actually matter.
Install Signal. Download it from the Play Store or App Store. Set it up with your phone number. It takes ninety seconds. Not figuratively. I timed it. Ninety seconds from opening the Play Store to sending a first message. Send a message to one person you trust. Tell them why you installed it. Ask them to install it too. If even three or four people in your life move their most private conversations to Signal, you have meaningfully improved your privacy without changing your daily routine.
While you are at it, fix your WhatsApp settings. Turn on encrypted backups. Settings, Chats, Chat Backup, End-to-end Encrypted Backup. Pick a password you will remember. This single action closes the biggest hole in WhatsApp's security and takes about one minute. Then go to Settings, Privacy. Hide your last seen from everyone or restrict it to contacts. Turn off read receipts if you do not need them. Under Groups, set it to My Contacts so strangers cannot add you to random groups.
Stop sharing sensitive documents on Telegram. Bank statements, tax returns, salary slips, medical reports, Aadhaar and PAN scans, passwords. None of these belong in a regular Telegram chat. If you have been sharing these things in Telegram groups, consider that Telegram has had access to every single one of those files. Move anything sensitive to Signal.
For payments, stop using WhatsApp Pay if you care about keeping your financial data separate from your messaging profile. Google Pay, PhonePe, Paytm, or your bank's own UPI app all handle payments without linking your transaction history to a company that also reads your contact list and monitors your messaging patterns. A few seconds of inconvenience per transaction is a small price for keeping those data streams apart.
Split your apps by what they do well. WhatsApp is for daily coordination. The family group, the office group, the building maintenance group, the delivery updates. It works for this. Signal is for anything personal, anything sensitive, anything you would not want a corporation cataloguing. Telegram is for public communities, news channels, following creators, and conversations where privacy is not a concern. Each app in its lane.
I know the counterargument. “I have nothing to hide.” Fine. Go post your last hundred WhatsApp messages on Twitter. Share your chat with your spouse publicly. Read your messages to your doctor out loud at a dinner party. If that makes you uncomfortable, you do have something to hide. Everyone does. Privacy is not about secrecy. Privacy is about control over who knows what about you. Right now, if you use only WhatsApp, that control sits with Meta. If you use only Telegram for private conversations, that control sits with Telegram. Signal gives it back to you.
The people who say they cannot get anyone to switch are right that it is hard. I spent two months trying to get my extended family in Jaipur to install Signal. My parents did it. My sister did it. My uncle said he would and never did. My cousin asked what was wrong with WhatsApp and stopped responding when I tried to explain. That is fine. I moved my most private conversations to Signal with the four people who did switch, and I kept using WhatsApp for everything else. The goal is not to convert the world. The goal is to have one app where your conversations are genuinely private, even if only a few people are on it with you.
Signal is free. Takes ninety seconds to install. Do it.
Comments (0)