F-Droid
Nine devices, nine verified scans, zero known tracker SDK signatures. F-Droid, the free-software app store, is the only app in this batch where the DEX scan comes back empty against our full signature database - no analytics, no crash reporting SDK, no push vendor, nothing. Its permissions are store machinery: installing and deleting apps, checking every installed package for updates, Bluetooth and NFC for the offline app-swap feature, and coarse location only because older Android versions tie it to Bluetooth scanning. This page exists as a baseline: this is what the bytecode of an app with no data business looks like.
Read from the bytecode.
A store that installs software on your phone holds real power, and F-Droid earns it the auditable way: reproducible builds, public source, and a binary that carries no telemetry vendor at all. The trade-off is on the other side - you leave Play Protect's review ecosystem and trust F-Droid's build and signing infrastructure instead. The bytecode says that trust is not being spent on tracking you.
This is static analysis of the APK bytecode installed on real devices: it proves which SDK classes and manifest permissions ship in the app, not what the app transmits at runtime. Traffic analysis is a different measurement.
Hidden inside the code.
What it asks for.
Installing and removing apps - the core function of an app store
Sees all installed apps - needed for update checks
Full storage access - for the offline APK swap between devices
In the manifest only because older Android versions tie it to Bluetooth scanning - not a location feature
Keep reading.
How to Check If an Android App Is Safe Before Installing
Before you install any Android app, here is how to check if it is safe: permissions, trackers, developer reputation, and...
The Privacy-First App Stack: What I Actually Use Instead of the Defaults
Real alternatives to tracker-heavy apps tested over 18 months. Specific recommendations for messaging, email, maps, and ...
Similar risk profiles.
Scan F-Droid yourself.
Get the full report on your device - with real-time DEX analysis, permission auditing, and breach monitoring. Free, no account needed.