Privacy policy

Last changed 8 October 2026. What the site and its Android app know, why, for how long, who else touches it, and what you can ask for. This policy covers the website apkreport.com and the APKreport app for Android, from Google Play or from this site.

The short version

An APK is not personal data. It is the same file for everyone with that version of the app and carries none of your messages, photos, accounts or app data. What the site keeps about you is small: an account if you make one, which phones you checked and when, what you sent, the mail we sent you, and the ordinary server logs. The Android app reads the list of apps on your phone only after you agree to it, and the list stays yours. Nothing is sold and nothing is used for advertising. There are no analytics or advertising cookies.

What is processed, and why

What	Why	Legal basis
Application files you upload or your browser reads off a phone, and the facts read from them (permissions, libraries, signing, packaging, strings, a score).	To produce the report, which is the service. The file is kept for as long as your plan says so it can be read again or decompiled; the facts stay as a record of that build of the app.	Performance of a contract (the check you asked for); our legitimate interest in keeping a corpus of facts about public apps.
About your phone: model, firmware version, security patch level, a serial number, and which apps it carried at each check.	So a phone checked twice is one phone, its firmware updates are told apart, and two checks can be compared. The serial is shown only as its last three characters, and never on a public report in full. The list of apps you send can say something about you - which bank, which dating app, which clinic - so you choose what to send, and it is tied to your account only for your own history and comparisons.	Performance of a contract; your consent, given by choosing what to send.
The names of installed apps, when you ask the app to show only what the site has not seen yet.	The app sends package names and version numbers - with the store that installed each app and the fingerprint of the key it is signed with - and the site answers which of them it has on file, at which version, with what score, and whether one is a known stalkerware or not the app it looks like. A question, tied to no phone, kept nowhere. The app asks as its list of apps opens, once you have let it read the list (see The Android app).	Your consent, which the app asks for before it first reads the list.
Your account: e-mail address, name if your sign-in provides one, the sign-in method, the plan, and the times you signed in and were last seen.	To sign you in, to apply your plan's limits, and to reach you about your account. Passwords are handled by Google's Firebase Authentication and never reach this site.	Performance of a contract.
What you sent and used: which builds your account sent, how many apps and decompilations per day, what is in your vault, which reports you shared by link and how often each link was opened.	To count your plan, to show you your own history, and to let you revoke a link.	Performance of a contract.
Payment: which plan you bought and when, and the invoice details you gave (name, address, VAT number).	To bill you and keep the accounts the law requires. The card itself is handled by Paddle, our reseller; we never see the number.	Performance of a contract; a legal obligation (accounting and tax records).
Mail: the address a mail went to, its kind and the time.	So the same news is not sent twice, and so a reset or confirmation link can be traced if it fails. The mail about a finished check is optional and is switched off on your profile.	Performance of a contract for sign-in mail; your consent for the optional mail.
Server and security logs: the network address a request came from, the page or call, the time, the browser's description of itself, and the result.	To keep the site up, to find faults, to stop abuse, and to enforce the per-address limits.	Our legitimate interest in the security and operation of the site.

We do not make decisions about you by automated means that have legal or similar effects on you. The score is an automated assessment of an application file, not of a person.

The Android app

The APKreport app for Android, from Google Play or from this site, checks the apps on the phone it runs on. It signs in to the same account as the site, and what it sends is kept as this policy says.

• The list of apps on the phone, asked for first. The app reads which apps are installed: each one's name, package name, version and size, the store that installed it and the key it is signed with. It asks you before it first reads the list; until you agree, it reads none of it and sends nothing about it. It needs the list to show you your apps and their scores, and to ask the site which of them it has on file (the question above, kept nowhere).
• The list stays yours. The list of every app on the phone goes to the site only if you turn on "List every app with each check". It is then kept with that phone's checks, seen only by you - on Team and Business, by your team - and by the site's administrators, and deleted with the phone or the account. It is never on a public page, never sold or shared, and not used for advertising.
• The files of the apps you choose. The app sends the installation files (APKs) of the apps you pick, to check them or to keep them in your vault. On a paid plan it also sends, by itself, the file of an app you install or update that the site has not checked yet, and tells you its score; the app's Settings turn that off, under Check and backup. An APK you open with the app or share to it - sent to you in a chat, downloaded - goes up only when you tap Check, to be checked before you install it; the app itself never installs it. Beyond what this list names, the app reads nothing on the phone: not your contacts, messages, photos or location, and nothing the apps keep inside.
• When you last opened each app, only if you allow Usage access in Android's settings: read on the phone to show you the apps you don't use, and sent nowhere.
• About the phone: its model, maker, Android version and security patch, and, in place of the serial number that Android keeps from apps, the identifier Android gives this app on this phone.
• When the app crashes, it sends what went wrong - the error, the app's and Android's versions and the phone's model - with nothing that names you.
• A backup to a file stays where you save it: the app writes the files of the apps you choose into a file you pick, and sends nothing of it. Putting an app back goes through Android's own installer, which asks you first.

The app from Google Play sells nothing. It shows no prices and takes no payments: a plan is bought only on the website, and the app shows the plan your account has. Google Play delivers and updates that app under Google's own terms and privacy policy, and shows us install numbers and the app's crashes, with nothing that names you. Uninstalling the app removes what it keeps on the phone, but not your account: how to delete that is at apkreport.com/delete-account.

How long it is kept

• Application files: for the number of days your plan says (3 without an account or on the free plan, up to 180 on Business), then deleted; files in your vault for as long as you keep them there.
• Facts and reports: indefinitely, as a record of that build, whether the app is public or not; they carry no link to you once you remove the build or your account is gone. Builds sent on a Team or Business plan are the exception: their reports are deleted with the build or the account.
• Phones and their checks: while your account exists; deleted with it.
• Account, usage, shares, mail records: while your account exists, then deleted within 30 days, except for what the accounting law requires us to keep about invoices (10 years in Serbia).
• Server logs: 30 days. Security records about a blocked address may be kept longer while the abuse lasts.
• Database backups: 30 daily copies, so anything deleted also leaves the last backup within 30 days.

What is public

Reports about apps are shown to everyone with access to the site, and a report you share by link to anyone with the link. A report names the phone's model and the last three characters of its serial number, never the whole serial, and never who sent it. A phone's own page - what it carries, what changed between checks - is yours alone: only the account that checked the phone and the site's administrators can open it. The credential-shaped strings found in an app are shown only on the site, hidden until asked for, and are not on a shared copy.

Who else processes it

We use a few providers to run the service. Each processes data only on our instructions, under a contract that binds it to confidentiality and security:

• Hetzner Online GmbH (Germany) - object storage for application files, vault files and database backups.
• Cloudflare, Inc. (USA, with EU data centres) - the network in front of the site: TLS, protection from attacks and rate limiting. On every page it also runs a bot check - a short script of its own that tells a browser from a bot - and sets a cookie for it, described under Cookies. It sees network addresses and requests in transit.
• Google LLC - Firebase Authentication for sign-in (it holds your e-mail address, password or Google identity, and sign-in events) and Google Workspace for the site's mailbox.
• Resend, Inc. (USA) - sends the mail the site sends you, and brings us what you write through the contact form; it sees the address, the subject and the message.
• Paddle.com Market Ltd (United Kingdom) - our online reseller and merchant of record for card payments, which handles your card and invoice details under its own privacy policy.

We disclose personal data to no one else, except where the law requires it or to defend the site against a claim. Nothing is sold, rented or shared for advertising.

Where it is

The site runs on our own servers and on Hetzner in Germany. We, the controller, are in Serbia, which is outside the European Economic Area and not covered by an EU adequacy decision; Serbian data protection law (Zakon o zaštiti podataka o ličnosti) mirrors the GDPR and applies to us. Providers in the United States are used under the EU standard contractual clauses or the EU-US Data Privacy Framework, as each one's contract states. Write to us for the details.

Your rights

Wherever you live, you can ask us what we hold about you, have it corrected or deleted, receive a copy in a usable form, object to processing based on our legitimate interests, and withdraw consent where consent is the basis. Most of it you can do yourself:

• See: your profile shows your account, plan, usage, phones, what you sent, your vault and your shared links.
• Take with you: your full reports export as JSON and CSV, and your apps as a backup file.
• Turn off mail: the optional mail is a switch on your profile.
• Forget a phone, remove a build: each phone and each build on your profile has its own button. A build removed leaves your list and its file is deleted when nobody else sent it; its report stays, with nothing that names you. A build sent on a Team or Business plan goes with its report and its files. A copy you keep in your vault stays there until you remove it from the vault.
• Take it all: "Download my data" on your profile gives you everything the site holds that names you, as one JSON file.
• Erase: "Erase my account" on your profile removes, at once and for good, the account here and at the sign-in provider, your phones' checks, your vault, your links, the mail records and the record of what you sent. The files of builds that only you sent are deleted; their reports stay, with nothing left saying who sent them - a report is a fact about an app, not about you. Builds sent on a Team or Business plan are erased with their reports and files (what a team member sent for the team stays with the team). The last database backup holding the data leaves within 30 days. Step by step, in the app, on the site or by mail when you cannot sign in: apkreport.com/delete-account.

For anything else, write through the contact form; we answer within a month. What you write there, with the address for the answer, is kept for a year at most. You may also complain to a supervisory authority: in Serbia the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), or the data protection authority where you live.

Cookies and storage in your browser

Two cookies, neither for analytics or advertising. The site's own keeps you signed in, for fourteen days, and is set only when you sign in. Cloudflare's, cf_clearance, is set on your first visit and lasts a year: Cloudflare runs a bot check on every page, and the cookie records that this browser passed it - it tells a browser from a bot, and does not identify you. There are no other cookies. The site also keeps a few settings in your browser's own storage - which sections of a report you folded, the billing period you chose on the pricing page, and a key your browser makes to talk to your phone over the cable - none of which is sent to us.

Security

Everything travels over HTTPS. The service runs as an unprivileged user with the operating system's protections, the database and files are reachable only from the site itself, credentials are kept out of the code, every address is rate-limited, and backups are taken daily. Access to the data is limited to the one person who runs the site. No system is perfect; if we learn of a breach that puts you at risk we tell you and, where required, the authority, without undue delay.

Children

The site is not meant for children under 16 and we do not knowingly keep an account for one. If you think a child has made an account, write to us and it will be removed.

Changes

When this policy changes, the date at the top changes with it. A change that matters to you - a new purpose, a new provider that sees your data - is announced on the site and by mail to account holders before it applies.

Who is responsible

The controller is Damir Dizdarević PR, Beograd-Zvezdara, registration number 67218540, tax number 113962279, Rade Kondića 24a, 11000 Belgrade, Serbia. Contact: the contact form. We are a small business and have not appointed a data protection officer; the form and the address above reach the person who handles these questions.