AppXpose

What is AppXpose?

AppXpose is a handheld investigation tool for the apps on your phone. The average Android app ships with around seven third-party tracker SDKs baked into its bytecode. AppXpose lists every installed app, unpacks the chosen APK directly on the device, matches its classes against a curated set of 270+ tracker signatures, and then lets Claude turn the findings into a readable report: a 0-100 risk score, who made the app, where the data goes, what the permissions really mean, and what changed since the last scan. Every result lands in a local App Index so you can compare all your apps in one place. GUARD, the paid tier, keeps watching afterwards with five alert types, from data breaches to newly added trackers.

The problem we set out to solve.

Privacy claims are easy to make and impossible for a normal user to verify. Play Store data-safety labels are self-declared, permission dialogs say nothing about which SDKs actually run inside an app, and the tools that do look inside an APK are built for security researchers, not for someone standing in a store deciding whether to install a banking app. We wanted a scanner that works on the phone itself, never uploads the app, stays honest about what is deterministic and what is AI, and keeps learning without waiting for an app update. On top of that it had to survive real-world abuse: scraped signature databases, spoofed premium claims, and quota bypasses.

How we built it.

The app is Kotlin with Jetpack Compose, Hilt, and three Room databases. DEX extraction runs in parallel on-device; class names are matched against signatures sourced from Exodus Privacy plus our own community discovery pipeline, with transitive SDK dependencies deduplicated so the count reflects distinct trackers. Only the results, HMAC-signed and without personal data, go to a Cloudflare Worker backed by D1. There a deterministic pre-score is computed, then Claude Haiku generates the score breakdown, developer profile, paywall analysis, and explanations, cached for 30 days per package. Suspicious unknown classes are reported anonymously; once the same prefix shows up in enough packages on enough devices, it is auto-confirmed and synced to every phone by a daily worker. Five detection systems are live on top: MalwareBazaar and Koodous hash checks, CertNet and community hash verification for repackaged APKs, and an on-device integrity checker for hooking, root tools, and packers. Billing runs on Google Play with server-verified purchases, retention and upgrade offers, an affiliate program with install-referrer attribution, and a Glance home-screen widget. The whole thing ships in English, German, Spanish, and Portuguese.

Where we are today.

AppXpose is live on Google Play at version 7.4 with over 500 commits across app and backend. Free users get five scans a week, GUARD costs €9.99 a month or €49.99 a year and adds breach alerts, tracker-change alerts, and the full App Index. The signature set has grown past 270 entries, largely from community scans, and the aggregated scan corpus now feeds two ML models in training. Next up: the replay of scan history over time and surfacing the ML baselines in the UI.