---
source: ~/DuckDuckGo/apple-browsers.git/main/.cursor/rules/privacy-security.mdc
confidence: 0.9
namespace: work
last_synced: 2026-04-28
alwaysApply: true
---

# Privacy & Security Guidelines

## Core Principles

### Privacy by Design
- Never collect or transmit user data without explicit consent
- All features must have privacy implications documented
- Default to the most private option
- Implement data minimization - only collect what's absolutely necessary

### Secure Storage
**Example:** See [secure-storage.swift](privacy-security/secure-storage.swift)

## Data Handling

### User Data Classification
1. **Sensitive Data**: Passwords, credentials, personal information
   - Must use Keychain or encrypted storage
   - Never log or transmit in plain text
   - Clear on app logout/uninstall

2. **Private Data**: Browsing history, bookmarks, settings
   - Store locally only
   - Implement proper data clearing
   - Respect fireproofing settings

3. **Anonymous Data**: Crash reports, usage statistics
   - Only collect with user consent
   - Strip all identifying information
   - Use differential privacy where applicable

### Network Security
**Example:** See [network-security.swift](privacy-security/network-security.swift)

## Content Blocking

### Tracker Protection
**Example:** See [tracker-protection.swift](privacy-security/tracker-protection.swift)

### Cookie Management
**Example:** See [cookie-management.swift](privacy-security/cookie-management.swift)

## Authentication & Authorization

### Biometric Authentication
**Example:** See [biometric-authentication.swift](privacy-security/biometric-authentication.swift)

### Credential Management
**Example:** See [credential-management.swift](privacy-security/credential-management.swift)

## Error Handling

### Secure Error Messages
**Example:** See [secure-error-messages.swift](privacy-security/secure-error-messages.swift)

## Code Security

### Input Validation
**Example:** See [input-validation.swift](privacy-security/input-validation.swift)

### Secure Defaults
**Example:** See [secure-defaults.swift](privacy-security/secure-defaults.swift)

## Testing Security

### Security Test Cases
**Example:** See [security-test-cases.swift](privacy-security/security-test-cases.swift)

## Review Checklist

Before committing code, ensure:
- [ ] No hardcoded secrets or API keys
- [ ] All user data is properly classified and protected
- [ ] Network requests use HTTPS
- [ ] Input validation is implemented
- [ ] Error messages don't leak sensitive information
- [ ] Logging doesn't include PII
- [ ] Data clearing mechanisms are tested
- [ ] Privacy impact has been assessed