Privacy
Sweep looks at sensitive things, so this page is blunt.
What the checkup reads
All of this is read on your phone, from Android itself, when you run the checkup. None of it leaves the phone: the app has no internet permission, so Android will not let it send anything, ever.
- The installed apps. For each one: its name, whether it is a system app, whether it has an icon, when it was installed and last updated, what it was installed from, and a fingerprint of the certificate it was signed with.
- Which sensitive permissions each app holds right now (microphone, camera, location, text messages, call history, contacts, calendar, phone state, notifications), and whether it asks for usage access, drawing over other apps, installing apps or access to all files.
- Which apps start at boot, and which declare long background services for location, the camera, the microphone, screen capture or calls.
- Device admin apps and the powers each one declares.
- Accessibility services that are turned on, and what Android says each one can do.
- Apps with notification access.
- The keyboards that are turned on, and which one is in use.
- Certificate authorities a person added to the phone.
- Apps that can run a VPN, and the always-on VPN setting.
- Which apps handle text messages, calls and the assistant.
- Whether there is a device owner, a profile owner or a work profile.
- Whether USB debugging, wireless debugging or developer options are on.
- Which apps are exempt from battery optimization.
- Sweep's own permission list, so the results can show you it has no internet access.
When Android keeps one of these from ordinary apps, or a read fails, the results list it under what could not be checked, with the reason. It is reported as unknown, not as nothing found.
What it keeps
- Results are never stored. Leave the results screen and they are gone; there is no history, no log, no file.
- No accounts, no analytics, no cookies. One preference is kept: your language. On Android 9 there is one more: a yes or no for whether you have seen the note about Android 9 security updates.
- The stalkerware list ships inside the app (from Echap's public CC-BY dataset) and is never fetched at runtime.
- The Leave fast button switches instantly to an ordinary weather page and clears whatever the checkup found. In the Android app, it also removes Sweep from your recent apps list; a website or an iPhone app cannot do that, so it opens the weather page over itself instead, which is the strongest exit either can offer.
Questions: Munzzyy1@proton.me