The better question is what you can check instead of trusting, and Telegram is built so that the answer is: quite a lot. The source code, the protocol and the API are all open, and the apps support verifiable builds.
What is open to inspection
- Client source code. The applications are published, so what the app does with your messages can be read rather than assumed.
- The protocol. MTProto is specified publicly and has been examined by outside researchers.
- The API. Anyone can build a client and see exactly what the service exposes.
Verifiable builds close the remaining gap
Publishing source code proves nothing on its own if the binary in the app store was built from something else. Verifiable builds let independent experts confirm that the code published on GitHub is the exact same code used to build the apps distributed through the App Store and Google Play. That is the step most open-source claims skip, and it is the one that turns "you can read our code" into a statement about the software you are actually running.
Where security researchers should write
Telegram invites audits and accepts findings at security@telegram.org. An organisation that publishes an address for people trying to break its product is making a different kind of commitment from one that does not.
What is still a matter of trust
Server-side behaviour cannot be verified from outside, which is why cloud chats and Secret Chats are a genuine choice rather than a formality. If you want a conversation whose privacy does not depend on any promise about a server, use a Secret Chat: it is end to end, and the keys never leave the two devices.
Updated