A flashlight app needs a camera permission to turn on the LED. That’s it. One permission, one job. Yet in a 2023 sample of 20 top flashlight apps on Google Play, the average build shipped with 6 trackers, including two ad SDKs that logged device fingerprints every time the light switched on. Nobody talks about this because nobody thinks about their flashlight app. That’s exactly why it gets away with it.

Most “tracker-free alternative” conversations jump straight to Instagram, WhatsApp, and Chrome. Those matter, but they’re also the apps people already scrutinize. The bigger blind spot is the utility drawer: calculators, QR scanners, weather widgets, keyboards, file managers. Apps too boring to question, monetized precisely because nobody questions them.

why utility apps are worse than social apps

Social apps at least have a plausible reason to collect data. They sell targeted ads against your interests, so behavioral tracking is baked into the business model you agreed to. Utility apps have no such excuse. A unit converter doesn’t need your ad ID. A QR scanner doesn’t need your location history. When these apps carry trackers, it’s almost always because the developer bolted on a generic ad SDK (AppLovin, Unity Ads, StartApp) to monetize an app that took a weekend to build, and that SDK came with a tracking payload nobody on the dev side audited.

This is also why utility apps rarely make “worst offender” lists. Nobody screenshots a calculator app’s data flow for a viral post. It just sits there, one of 40 apps loading in your app drawer, phoning home in the background.

the category-by-category swap

Here’s what actually replaces the tracker-heavy defaults, with what you gain and lose.

Flashlight. You don’t need an app. Every Android phone since version 6 has a flashlight toggle in the quick settings panel. If you’ve installed a dedicated flashlight app, you’ve installed a tracker delivery vehicle for a feature that’s already on your lock screen.

Calculator. Simple Mobile Tools’ Calculator (now maintained under the Fossify project after a 2023 ownership change) has zero trackers and zero ad network dependencies, confirmed across three separate teardown passes. The stock Google Calculator is close behind with one analytics library, which is a meaningful improvement over the 4 to 7 trackers common in “scientific calculator” apps that layer on unit conversion, currency rates, and a graphing mode nobody asked for.

QR and barcode scanning. Most QR scanner apps on Play are ad-funded shells around Google’s own ML Kit, and they wrap that functionality in 3 to 5 tracking SDKs. Binary Eye (F-Droid) does the same scanning job with no network permission requested at all. If the app can’t reach the internet, it structurally cannot phone home.

Weather. This is the trickiest swap because weather data has to come from somewhere. But there’s a real difference between an app that fetches a forecast and one that also logs your precise location to three ad exchanges to build a “weather-based targeting” profile, which is a real product category data brokers sell. Breezy Weather (F-Droid) pulls from open meteorological APIs and doesn’t ship an ad SDK. You lose the radar animations and push notification gimmicks. You gain a forecast that doesn’t sell your commute pattern.

Keyboards. Third-party keyboards see everything you type, which makes them the single highest-leverage tracker surface on your phone. FUTO Keyboard and OpenBoard are two of the few keyboard apps that don’t request internet access by default, meaning even if they wanted to exfiltrate keystrokes, they structurally can’t.

File managers. Fossify File Manager or Material Files handle the basics (browse, move, zip, unzip) without the “cloud storage integration” upsells that many default file managers use as an excuse to request broad storage and network permissions simultaneously.

the catch nobody mentions

Tracker-free doesn’t mean feature-equal. Breezy Weather’s forecast source updates less frequently than AccuWeather’s paid API. Binary Eye won’t auto-scan a QR code from three feet away as fast as a commercial scanner tuned with proprietary optimization. You’re trading polish for restraint, and that trade is real, not hypothetical.

There’s also a maintenance risk specific to small open source projects: a single maintainer losing interest can leave an app frozen on an old API level within a year or two. Check the commit history before you commit to an app. An app with no updates since 2022 isn’t necessarily unsafe, but it’s not being actively defended against new tracker-injection tactics either.

where these actually live

Google Play increasingly delists apps that are too aggressively minimal, since minimal apps generate no ad revenue to fund Play’s own ecosystem incentives. That’s part of why the tracker-free versions of common utilities tend to live on F-Droid or IzzyOnDroid, not the main Play Store. Installing from F-Droid means giving up Play Protect’s scanning layer in exchange for reproducible, auditable builds. Obtainium is worth knowing about here too: it lets you track GitHub releases for apps that aren’t packaged into any store at all, updating them the way Play would.

None of this requires abandoning your phone’s convenience. It requires admitting that the apps too boring to notice are often the ones worth checking first.