Signal
Signal is the reference point people measure other messengers against, so here is what the bytecode actually says: 8 verified scans on 8 devices, consistent from version 8.7 through 8.19, find three Google SDKs - Firebase, Google Sign-In classes, and Google Maps. Zero advertising, attribution, or third-party analytics SDKs. The Firebase presence is the documented FCM push transport: on Play Store builds, Google delivers an empty wake-up ping and the encrypted message is fetched from Signal servers. Maps powers the location-sharing feature. The extensive permission list (camera, microphone, contacts) maps one-to-one onto messenger features you invoke yourself.
Read from the bytecode.
The presence of Google classes in Signal is not a contradiction of its privacy model - message content is end-to-end encrypted before any of this code touches anything, and FCM only tells the app to wake up. If your threat model excludes Google entirely, the Play build does depend on these components; Signal offers a website APK using its own push. For everyone else: this is what a messenger looks like when nobody is monetizing your attention.
This is static analysis of the APK bytecode installed on real devices: it proves which SDK classes and manifest permissions ship in the app, not what the app transmits at runtime. Traffic analysis is a different measurement.
Hidden inside the code.
What it asks for.
Contact discovery to find Signal users - expected, matching runs hashed
Calls, voice notes, photos - core features, active only when you use them
Location sharing in chats - only when you trigger it yourself
Keep reading.
The messaging app exodus nobody saw coming
WhatsApp lost 25 million users in one week after a single policy change. Here's where they went and why it matters for y...
The Privacy-First App Stack: What I Actually Use Instead of the Defaults
Real alternatives to tracker-heavy apps tested over 18 months. Specific recommendations for messaging, email, maps, and ...
Similar risk profiles.
Scan Signal yourself.
Get the full report on your device - with real-time DEX analysis, permission auditing, and breach monitoring. Free, no account needed.