Mobile Apps. One App — Dozens of Invisible Guests

You download an app. One. Simple. Say a flashlight or weather. But inside this app live other programs you did not download and about which no one asked you. This is called an SDK — Software Development Kit. A set of tools that the developer embeds in their app. Convenient for them. Invisible to you.

How it works

• The developer creates an app. To add analytics — they embed an SDK from Google Firebase. To show advertising — an SDK from Meta Audience Network. To track installs — an SDK from AppsFlyer. To analyse behaviour — an SDK from Amplitude.
• One app. Four invisible guests inside. Each with its own servers, its own data policy, its own interests. The average mobile app contains from 10 to 30 SDKs simultaneously. Popular apps — up to 50.

What these SDKs collect

• Each SDK has access to all the permissions you gave the main app.
• You gave the weather app access to geolocation — all 15 SDKs inside it also received your geolocation.
• You gave access to contacts — all the SDKs see your phone book.
• You gave access to the microphone — all the SDKs can potentially use it.
• You gave permission to one app. Dozens of companies received it.

The most widespread SDKs and who they belong to

• Google Firebase — analytics, crash reports, push notifications. Installed in billions of apps. Everything that happens in the app goes to Google’s servers.
• Meta SDK — the Facebook and Instagram advertising network. Even if you do not use Facebook — Meta receives data about your behaviour through apps where their SDK is installed.
• AppsFlyer / Adjust — tracking of marketing campaigns. They know where you came from, what you installed, how much time you spent.
• Yandex AppMetrica — the Russian analogue of Firebase. Installed in most Russian apps. The data goes to Yandex’s servers.
• AppTracer — it is precisely this SDK that was recorded in the VKontakte app. Not mentioned in VK’s Privacy Policy. It collects data about the device and sessions and sends it to external servers without notifying the user. This is documented in the technical logs and attached to the official complaint to AKI.

Why developers do this

• Money. A simple answer. Advertising SDKs pay the developer for each user. The more data the SDK collects — the more precise the targeting — the more expensive the advertising — the more money the developer receives. A free app is never free. You pay with data.

The most telling example

• Popular phone keyboards — SwiftKey, Gboard, many others. The keyboard sees absolutely everything you type. Passwords, messages, card numbers, personal correspondence. Everything. And most keyboards contain analytics SDKs that send input data to external servers. Think about this next time you enter a password.

What to do

• First — fewer apps. Each app is potentially dozens of SDKs. Delete what you do not use. Each deleted app — minus ten invisible guests.
• Second — use the web version instead of the app. A site in a browser contains trackers — but they are easier to block. An app on the phone — significantly harder. Bank, store, news — go in through the browser.
• Third — check permissions after installation. You installed an app — immediately go into the settings and revoke everything unnecessary. Leave only what the app physically cannot work without.
• Fourth — read not only the reviews but also the privacy policy. Look for the «third parties» or «partners» section. If it says «we may transfer data to partners to improve the service» — this means SDKs inside the app.
• Fifth — for Android use NetGuard. This is a firewall that shows which apps go online and blocks those you do not want to let through. You see in real time who sends data and where.

The main thing to understand

When you download an app — you do not merely install a program. You open a door into your phone for dozens of companies you have never heard of. They do not ask permission separately. They enter together with the app — quietly, imperceptibly, forever until you delete the app.

• One app. Dozens of guests. Your phone. Your choice.