Technical Audit of Personal Data Processing on GDPR Audit

FluffyChat Matrix Messenger

Wed, 21 Oct 2026 00:00:00 +0000

SDK (1)

SDK	Владелец	Страна	Назначение	Классов
Firebase Cloud Messaging	Google LLC	США (вне ЕЭЗ)	push-уведомления	14

Чувствительные разрешения (9)

примерная геолокация — android.permission.ACCESS_COARSE_LOCATION
точная геолокация — android.permission.ACCESS_FINE_LOCATION
камера — android.permission.CAMERA
фоновая служба: микрофон — android.permission.FOREGROUND_SERVICE_MICROPHONE
файлы на устройстве — android.permission.READ_EXTERNAL_STORAGE
микрофон — android.permission.RECORD_AUDIO
запись файлов на устройство — android.permission.WRITE_EXTERNAL_STORAGE
биометрия (отпечаток, лицо) — android.permission.USE_BIOMETRIC
отпечаток пальца — android.permission.USE_FINGERPRINT

Все разрешения из манифеста (46)

android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.BLUETOOTH
android.permission.CAMERA
android.permission.DISABLE_KEYGUARD
android.permission.FOREGROUND_SERVICE
android.permission.FOREGROUND_SERVICE_CAMERA
android.permission.FOREGROUND_SERVICE_DATA_SYNC
android.permission.FOREGROUND_SERVICE_MICROPHONE
android.permission.FOREGROUND_SERVICE_PHONE_CALL
android.permission.FOREGROUND_SERVICE_SHORT_SERVICE
android.permission.INTERNET
android.permission.MANAGE_OWN_CALLS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.POST_NOTIFICATIONS
android.permission.READ_APP_BADGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECORD_AUDIO
android.permission.TURN_SCREEN_ON
android.permission.USE_BIOMETRIC
android.permission.USE_FINGERPRINT
android.permission.USE_FULL_SCREEN_INTENT
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_EXTERNAL_STORAGE
chat.fluffy.fluffychat.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
chat.fluffy.fluffychat.PERMISSION_CALL
com.anddoes.launcher.permission.UPDATE_COUNT
com.google.android.c2dm.permission.RECEIVE
com.htc.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.UPDATE_SHORTCUT
com.huawei.android.launcher.permission.CHANGE_BADGE
com.huawei.android.launcher.permission.READ_SETTINGS
com.huawei.android.launcher.permission.WRITE_SETTINGS
com.majeur.launcher.permission.UPDATE_BADGE
com.oppo.launcher.permission.READ_SETTINGS
com.oppo.launcher.permission.WRITE_SETTINGS
com.sec.android.provider.badge.permission.READ
com.sec.android.provider.badge.permission.WRITE
com.sonyericsson.home.permission.BROADCAST_BADGE
com.sonymobile.home.permission.PROVIDER_INSERT_BADGE
me.everything.badger.permission.BADGE_COUNT_READ
me.everything.badger.permission.BADGE_COUNT_WRITE

Сформировано: https://gdpru.eu/apk-check/

Who tracks when you open an email

Wed, 21 Oct 2026 00:00:00 +0000

Almost every marketing email contains an invisible image one pixel in size. When you open the email, your mail app loads it from the sender’s server — and the sender learns that the email was read, when, on which device and roughly where. Your email address is often embedded in the address of that image.

Here you can check any email: which platform sent it, whether it contains open-tracking pixels, whose they are, and whether the email tracks which links you click.

Who tracks when you open an email

Wed, 21 Oct 2026 00:00:00 +0000

Here you can check any email: which platform sent it, whether it contains open-tracking pixels, whose they are, and whether the email tracks which links you click.

abishkking

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. An independent developer(video downloader, music player, period tracker). We have no information about a company behind them — the dossier shows only what the apps themselves reveal.

What is at stake. We found: 42 third-party SDKs in 3 apps, 33 of them for advertising and analytics.

0websites analysed

3apps

42SDKs in its apps

33of them advertising & analytics

Apps

In RuStore, the developer declares no collected data at all for 2 of these apps.

ALDI Nord

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. ALDI Nord is a German grocery discount chain (northern Germany, Belgium, France, Luxembourg and other countries). Its apps are built by the contractor medienfabrik Gütersloh.

What is at stake. Grocery purchases reveal household size, habits, diet and income; a loyalty card ties every purchase to one person. We found: 51 third-party SDKs in 4 apps, 38 of them for advertising and analytics.

0websites analysed

4apps

51SDKs in its apps

38of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
ALDI België be.aldi.android 5.14.0-2609101013	Firebase Cloud MessagingFirebase CrashlyticsGoogle Firebase AnalyticsironSourceUnity AdsAdjustAppLovinAppsFlyerChartboostMeta (Facebook) SDKSingularUsercentrics of which advertising & analytics: 9 SDKs from non-EEA companies: 10	6	—
ALDI France fr.aldi.android 5.14.0-2609101013	Firebase Cloud MessagingFirebase CrashlyticsGoogle Firebase AnalyticsironSourceUnity AdsAdjustAppLovinAppsFlyerChartboostMeta (Facebook) SDKSingularUsercentrics of which advertising & analytics: 9 SDKs from non-EEA companies: 10	6	—
ALDI Luxemburg lu.aldi.android 5.13.1-2607301229	Firebase Cloud MessagingFirebase CrashlyticsFirebase Remote Config / A/B TestingGoogle Firebase AnalyticsironSourceUnity AdsAdjustAdobe Experience Platform Mobile SDKAppLovinAppsFlyerChartboostMeta (Facebook) SDKSalesforce Marketing Cloud MobilePushSingularUsercentrics of which advertising & analytics: 11 SDKs from non-EEA companies: 13	6	—
ALDI Nord de.aldiNord.android 5.14.0-2609101013	Firebase Cloud MessagingFirebase CrashlyticsGoogle Firebase AnalyticsironSourceUnity AdsAdjustAppLovinAppsFlyerChartboostMeta (Facebook) SDKSingularUsercentrics of which advertising & analytics: 9 SDKs from non-EEA companies: 10	6	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

ALDI Süd

Tue, 20 Oct 2026 19:37:30 +0300

What is at stake. Grocery purchases reveal household size, habits, diet and income; a loyalty card ties every purchase to one person. We found: 15 third-party SDKs in 5 apps, 2 of them for advertising and analytics.

0websites analysed

5apps

15SDKs in its apps

2of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
ALDI Ireland de.apptiv.business.android.aldi_ie 9.2635.0	Firebase Cloud MessagingFirebase CrashlyticsOneTrust SDKs from non-EEA companies: 3	3	—
ALDI Magyarország de.apptiv.business.android.aldi_hu 9.2635.0	Firebase Cloud MessagingFirebase Remote Config / A/B TestingAdobe Experience Platform Mobile SDKOneTrust of which advertising & analytics: 1 SDKs from non-EEA companies: 4	3	—
ALDI SÜD de.apptiv.business.android.aldi_de 9.2635.0	Firebase Cloud MessagingOneTrust SDKs from non-EEA companies: 2	3	—
HOFER de.apptiv.business.android.aldi_at 9.2635.0	Firebase Cloud MessagingOneTrust SDKs from non-EEA companies: 2	3	—
HOFER Slovenija de.apptiv.business.android.aldi_si 9.2634.0	Firebase Cloud MessagingFirebase Remote Config / A/B TestingAdobe Experience Platform Mobile SDKOneTrust of which advertising & analytics: 1 SDKs from non-EEA companies: 4	3	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

Alexela

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. Alexela is an Estonian fuel and energy company: a filling-station network across Estonia plus electricity and gas for households. The app is for paying and collecting bonuses at its stations.

What is at stake. A fuel-station app knows the car, where and when it is refuelled and how it is paid for. We found: 5 trackers on 1 website; 2 third-party SDKs in 1 app, 1 of them for advertising and analytics.

Alibaba

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. Alibaba Group is a Chinese internet company: the 1688 wholesale platform, the Alibaba.com B2B marketplace, the Xianyu (Goofish) second-hand market and the DingTalk work messenger.

What is at stake. A marketplace or classifieds site sees what a person searches for, buys and sells, their address and messages with sellers. We found: 26 third-party SDKs in 5 apps, 9 of them for advertising and analytics.

0websites analysed

5apps

26SDKs in its apps

9of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
1688 com.alibaba.wireless 12.8.1.0	Huawei Push KitHuawei AppGallery ConnectWeChat OpenSDKXiaomi Mi Push SDKs from non-EEA companies: 4	20	—
Alibaba.com - B2B marketplace com.alibaba.intl.android.apps.poseidon 26.35.2	Firebase Cloud MessagingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDK of which advertising & analytics: 2 SDKs from non-EEA companies: 4	14	1 types
Goofish - Selling & Buying com.igoofish.fleamarket4Android 1.6.7	Firebase Cloud MessagingFirebase In-App MessagingFirebase Remote Config / A/B TestingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKWeChat OpenSDK of which advertising & analytics: 3 SDKs from non-EEA companies: 7	18	—
钉钉 DingTalk com.alibaba.android.rimet 8.3.41	Firebase Cloud MessagingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKHuawei Push KitXiaomi Mi Push of which advertising & analytics: 2 SDKs from non-EEA companies: 6	25	—
闲鱼 Xianyu com.taobao.idlefish 7.27.96.3	Firebase Cloud MessagingGoogle Firebase AnalyticsPangleHuawei Push KitXiaomi Mi Push of which advertising & analytics: 2 SDKs from non-EEA companies: 5	21	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

Amazon

Tue, 20 Oct 2026 19:37:30 +0300

What is at stake. A marketplace or classifieds site sees what a person searches for, buys and sells, their address and messages with sellers. We found: 17 third-party SDKs in 5 apps, 7 of them for advertising and analytics.

0websites analysed

5apps

17SDKs in its apps

7of them advertising & analytics

Apps

In RuStore, the developer declares no collected data at all for 1 of these apps.

ANSA

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. ANSA (Agenzia Nazionale Stampa Associata) is Italy’s main news agency, a cooperative of Italian newspaper publishers. Its website and app are a news feed for the general public.

What is at stake. A news and media service sees what a person reads, watches and listens to — enough to build a picture of their interests and views. We found: 5 trackers on 1 website; 9 third-party SDKs in 1 app, 5 of them for advertising and analytics.

Antena TV Group

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. Antena TV Group is a private Romanian TV group: the Antena 1 channel, the AntenaPLAY streaming service and the Lajumate.ro classifieds site.

What is at stake. A news and media service sees what a person reads, watches and listens to — enough to build a picture of their interests and views. We found: 28 third-party SDKs in 3 apps, 12 of them for advertising and analytics.

0websites analysed

3apps

28SDKs in its apps

12of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
Antena 1 ro.a1.app 1.3.1	Firebase Cloud MessagingFirebase CrashlyticsFirebase Performance MonitoringFirebase Remote Config / A/B TestingGoogle AdMobGoogle Firebase AnalyticsGoogle IMA SDKGoogle User Messaging PlatformMeta (Facebook) Login / ShareMeta (Facebook) SDK of which advertising & analytics: 4 SDKs from non-EEA companies: 10	6	—
AntenaPLAY ro.antenaplay.app 4.1.74	Firebase Cloud MessagingFirebase CrashlyticsFirebase Remote Config / A/B TestingGoogle Firebase AnalyticsGoogle IMA SDKMeta (Facebook) Login / ShareMeta (Facebook) SDKIAB Open Measurement SDKOneTrust of which advertising & analytics: 4 SDKs from non-EEA companies: 9	5	—
Lajumate.ro ro.lajumate 2.9.8	Firebase Cloud MessagingFirebase Remote Config / A/B TestingGoogle AdMobGoogle AnalyticsGoogle Firebase AnalyticsGoogle Tag ManagerGoogle User Messaging PlatformMeta (Facebook) Login / ShareMeta (Facebook) SDK of which advertising & analytics: 4 SDKs from non-EEA companies: 9	11	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

BabyBus (Sinyee)

Tue, 20 Oct 2026 19:37:30 +0300

What is at stake. A news and media service sees what a person reads, watches and listens to — enough to build a picture of their interests and views. We found: 20 third-party SDKs in 3 apps, 17 of them for advertising and analytics.

0websites analysed

3apps

20SDKs in its apps

17of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
Baby Panda's School Bus com.sinyee.babybus.taxi 9.88.15.00	none	5	—
Kalliu Game World: Life Story com.sinyee.babybus.gameworld.design.home.friends.fun.life.story 8.76.33.00	Firebase CrashlyticsFirebase Remote Config / A/B TestingGoogle AdMobGoogle Firebase AnalyticsGoogle User Messaging PlatformironSourceTapjoyUnity AdsYandex Mobile AdsYandex Mobile Ads (monetization)AppLovinPangleChartboostFyber (Digital Turbine)IAB Open Measurement SDKInMobiVungle (Liftoff)Meta Audience NetworkMintegralmyTarget of which advertising & analytics: 17 SDKs from non-EEA companies: 20	0	—
Little Panda's Restaurant com.sinyee.babybus.restaurant 9.81.00.02	none	6	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

Barbora

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. Barbora is an online grocery store with home delivery in the Baltic states, part of the Lithuanian retail group Maxima.

What is at stake. Grocery purchases reveal household size, habits, diet and income; a loyalty card ties every purchase to one person. We found: 5 trackers on 1 website; 7 third-party SDKs in 1 app, 3 of them for advertising and analytics.

1websites analysed

1apps

7SDKs in its apps

3of them advertising & analytics

5trackers on its websites

Domains: barbora.ee

BBC

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. The BBC is the British public broadcaster funded by the licence fee: BBC iPlayer, BBC News, BBC Sounds and BBC Weather.

What is at stake. A news and media service sees what a person reads, watches and listens to — enough to build a picture of their interests and views. We found: 26 third-party SDKs in 4 apps, 12 of them for advertising and analytics.

0websites analysed

4apps

26SDKs in its apps

12of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
BBC iPlayer bbc.iplayer.android 5.74.0.38112	Firebase Cloud MessagingFirebase CrashlyticsAirshipAmazon Device MessagingAppsFlyerHuawei Ads Kit of which advertising & analytics: 3 SDKs from non-EEA companies: 6	6	—
BBC News bbc.mobile.news.uk 9.19.0.32015	Firebase Cloud MessagingFirebase CrashlyticsFirebase Remote Config / A/B TestingAirshipAmazon Device MessagingAppsFlyerHuawei Ads Kit of which advertising & analytics: 3 SDKs from non-EEA companies: 7	5	—
BBC Sounds com.bbc.sounds 2.61.0.28265	Firebase Cloud MessagingFirebase CrashlyticsAirshipAmazon Device MessagingAppsFlyerHuawei Ads Kit of which advertising & analytics: 3 SDKs from non-EEA companies: 6	5	—
BBC Weather bbc.mobile.weather 5.23.0	Firebase Cloud MessagingFirebase CrashlyticsFirebase Remote Config / A/B TestingAirshipAmazon Device MessagingAppsFlyerHuawei Ads Kit of which advertising & analytics: 3 SDKs from non-EEA companies: 7	9	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

Belastingdienst

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. Belastingdienst is the Dutch Tax and Customs Administration, part of the Ministry of Finance. The dossier also includes other Dutch government services signed with the same key: the DigiD login, the Berichtenbox mailbox and rijksoverheid.nl.

What is at stake. A tax authority knows almost everything about a person: income, employer, family, property. We found: 3 trackers on 2 websites; 16 third-party SDKs in 7 apps, 4 of them for advertising and analytics.

BIGO

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. BIGO Technology is a Singapore-based company behind the Bigo Live streaming platform and the Likee short-video network.

What is at stake. A telecom operator or digital service sees who a person talks to, where their phone is and what they use online. We found: 46 third-party SDKs in 3 apps, 26 of them for advertising and analytics.

0websites analysed

3apps

46SDKs in its apps

26of them advertising & analytics

1own SDKs in others' apps

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
Bigo Live sg.bigo.live.rustore 6.54.1	Firebase Cloud MessagingFirebase Remote Config / A/B TestingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKAppTracerVK SDK / VK IDAppLovinAppsFlyerSentry of which advertising & analytics: 4 SDKs from non-EEA companies: 10	27	8 types
Bigo Live - Live Streaming App sg.bigo.live 6.54.3	Firebase Cloud MessagingFirebase Remote Config / A/B TestingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKAppLovinAppsFlyerSentryVK SDK / VK ID of which advertising & analytics: 4 SDKs from non-EEA companies: 9	27	—
Likee - Short Video Community video.like 5.66.0	Firebase Cloud MessagingFirebase Remote Config / A/B TestingGoogle AdMobGoogle Firebase AnalyticsGoogle User Messaging PlatformAppTracermyTargetmyTrackerVK SDK / VK IDMeta (Facebook) Login / ShareMeta (Facebook) SDKMeta Audience NetworkYandex AppMetricaYandex Mobile AdsYandex Mobile Ads (monetization)Huawei Ads KitHuawei Push KitironSourceUnity AdsAppLovinAppsFlyerFyber (Digital Turbine)Huawei AppGallery ConnectIAB Open Measurement SDKVungle (Liftoff)MintegralXiaomi Mi Push of which advertising & analytics: 18 SDKs from non-EEA companies: 27	24	—

Its SDKs inside other apps

SDK	In how many of our app cards
BIGO Ads	104

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

Bikram-Agarwal

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. An independent developer. We have no information about a company behind them — the dossier shows only what the apps themselves reveal.

What is at stake. We found: no third-party SDKs in 3 apps.

0websites analysed

3apps

0SDKs in its apps

0of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
FilePipe: Auto Files Organizer dev.bikram.filepipe.gh 3.11.3	none	1	—
ObtainX dev.bikram.obtainx 2.21.0	none	7	—
Remember: Notes & Reminders dev.bikram.remember.gh 1.10.0	none	2	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

BNP Paribas Fortis

Tue, 20 Oct 2026 19:37:30 +0300

What is at stake. A bank or payment service sees income, spending, debts and who a person exchanges money with — the flow of money shows almost a whole life. We found: 9 third-party SDKs in 3 apps, 3 of them for advertising and analytics.

0websites analysed

3apps

9SDKs in its apps

3of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
BNP Paribas Fortis Easy Banking com.bnpp.easybanking 40.65.10	Firebase Cloud MessagingFirebase CrashlyticsGoogle Firebase Analytics of which advertising & analytics: 1 SDKs from non-EEA companies: 3	11	—
Fintro Easy Banking com.bnpp.easybanking.fintro 40.65.10	Firebase Cloud MessagingFirebase CrashlyticsGoogle Firebase Analytics of which advertising & analytics: 1 SDKs from non-EEA companies: 3	11	—
Hello Bank Belgium com.bnpp.hellobank 40.64.5	Firebase Cloud MessagingFirebase CrashlyticsGoogle Firebase Analytics of which advertising & analytics: 1 SDKs from non-EEA companies: 3	11	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

BNT

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. BNT (Bulgarian National Television) is Bulgaria’s public broadcaster, funded mainly from the state budget. Its website and the BNT News app carry news and live TV.

What is at stake. A news and media service sees what a person reads, watches and listens to — enough to build a picture of their interests and views. We found: 7 trackers on 1 website; 6 third-party SDKs in 1 app, 1 of them for advertising and analytics.

ByteDance

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. ByteDance is a Chinese internet company, the owner of TikTok and Lemon8.

What is at stake. A telecom operator or digital service sees who a person talks to, where their phone is and what they use online. We found: 60 third-party SDKs in 11 apps, 30 of them for advertising and analytics.

0websites analysed

11apps

60SDKs in its apps

30of them advertising & analytics

1own SDKs in others' apps

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
Lemon8 - Lifestyle Community com.bd.nproject 14.9.1	Firebase Cloud MessagingGoogle AdMobGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKAppsFlyer of which advertising & analytics: 4 SDKs from non-EEA companies: 6	11	—
TikTok (Asia) com.ss.android.ugc.trill 37.5.22	Firebase Cloud MessagingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKAmazon Device MessagingAppsFlyerIAB Open Measurement SDKVK SDK / VK ID of which advertising & analytics: 4 SDKs from non-EEA companies: 8	20	—
TikTok Lite com.ss.android.ugc.tiktok.lite 47.1.4	Firebase Cloud MessagingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKAmazon Device MessagingAppsFlyerIAB Open Measurement SDKStripe of which advertising & analytics: 4 SDKs from non-EEA companies: 8	23	—
TikTok Lite - Faster TikTok com.tiktok.lite.go 47.0.52	Firebase Cloud MessagingGoogle Firebase AnalyticsAppsFlyer of which advertising & analytics: 2 SDKs from non-EEA companies: 3	17	—
TikTok Lite - Faster TikTok com.zhiliaoapp.musically.go 47.4.2	Firebase Cloud MessagingGoogle Firebase AnalyticsAppsFlyer of which advertising & analytics: 2 SDKs from non-EEA companies: 3	17	—
TikTok Pro - Events com.ss.android.ugc.tiktok.pro 47.4.3	Firebase Cloud MessagingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKAmazon Device MessagingAppsFlyerIAB Open Measurement SDKStripe of which advertising & analytics: 4 SDKs from non-EEA companies: 8	23	—
TikTok Shop Seller Center com.tiktokshop.seller 11.7.0	Firebase Cloud MessagingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKAppsFlyerVK SDK / VK ID of which advertising & analytics: 3 SDKs from non-EEA companies: 6	9	—
TikTok Studio com.ss.android.tt.creator 44.6.3	Firebase Cloud MessagingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKAmazon Device MessagingAppsFlyerIAB Open Measurement SDKStripe of which advertising & analytics: 4 SDKs from non-EEA companies: 8	20	—
今日头条 Toutiao com.ss.android.article.news 13.9.0	PangleHuawei Push KitXiaomi Mi Push of which advertising & analytics: 1 SDKs from non-EEA companies: 3	17	—
抖音 Douyin com.ss.android.ugc.aweme 38.7.0	PangleHuawei Push KitXiaomi Mi Push of which advertising & analytics: 1 SDKs from non-EEA companies: 3	25	—
飞书 Feishu com.ss.android.lark 7.70.12	Firebase Cloud MessagingGoogle Firebase AnalyticsHuawei Push KitXiaomi Mi Push of which advertising & analytics: 1 SDKs from non-EEA companies: 4	31	—

Its SDKs inside other apps

SDK	In how many of our app cards
Pangle	295

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

Chat Alternative

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. Random video-chat services — Chatruletka and OmeTV.

What is at stake. A telecom operator or digital service sees who a person talks to, where their phone is and what they use online. We found: 21 third-party SDKs in 3 apps, 6 of them for advertising and analytics.

0websites analysed

3apps

21SDKs in its apps

6of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
Chat Alternative — android app com.chatroullete.alternative 604124	Firebase Cloud MessagingFirebase CrashlyticsFirebase Remote Config / A/B TestingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKVK SDK / VK ID of which advertising & analytics: 2 SDKs from non-EEA companies: 7	9	—
Chatruletka – Video Chat com.chat.ruletka 603131	Firebase Cloud MessagingFirebase CrashlyticsFirebase Remote Config / A/B TestingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKVK SDK / VK ID of which advertising & analytics: 2 SDKs from non-EEA companies: 7	9	—
OmeTV – Video Chat Alternative omegle.tv 605116	Firebase Cloud MessagingFirebase CrashlyticsFirebase Remote Config / A/B TestingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKVK SDK / VK ID of which advertising & analytics: 2 SDKs from non-EEA companies: 7	9	1 types

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

CME

Tue, 20 Oct 2026 19:37:30 +0300

What is at stake. A news and media service sees what a person reads, watches and listens to — enough to build a picture of their interests and views. We found: 14 third-party SDKs in 3 apps, 7 of them for advertising and analytics.

0websites analysed

3apps

14SDKs in its apps

7of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
btvnovinite.bg com.cme.newsreader.btvnews.bg 3.1.5	Firebase Cloud MessagingGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKMicrosoft Clarity of which advertising & analytics: 3 SDKs from non-EEA companies: 5 records screen and taps	8	—
Stirile ProTV com.cme.newsreader.stirileprotv.ro 4.5.0	Firebase Cloud MessagingFirebase CrashlyticsGoogle AdMobGoogle Firebase AnalyticsGoogle IMA SDK of which advertising & analytics: 3 SDKs from non-EEA companies: 5	4	—
TN.cz com.cme.newsreader.tn.cz 3.3.30 - google	Firebase Cloud MessagingFirebase CrashlyticsFirebase Remote Config / A/B TestingGoogle Firebase Analytics of which advertising & analytics: 1 SDKs from non-EEA companies: 4	3	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

Crédit Mutuel

Tue, 20 Oct 2026 19:37:30 +0300

0websites analysed

3apps

9SDKs in its apps

6of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
Beobank com.beobank_prod.bad V13.6.2.03529	Firebase Cloud MessagingGoogle Firebase AnalyticsHuawei Ads Kit of which advertising & analytics: 2 SDKs from non-EEA companies: 3	3	—
CIC com.cic_prod.bad V13.9.3.03529	Firebase Cloud MessagingGoogle Firebase AnalyticsHuawei Ads Kit of which advertising & analytics: 2 SDKs from non-EEA companies: 3	4	—
Crédit Mutuel com.cm_prod.bad V13.18.0.03529	Firebase Cloud MessagingGoogle Firebase AnalyticsHuawei Ads Kit of which advertising & analytics: 2 SDKs from non-EEA companies: 3	4	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

Daft Media Limited

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. An Irish classifieds company: Daft.ie (property) and Adverts.ie (private ads). The app of the news site TheJournal.ie is signed with the same key.

What is at stake. A marketplace or classifieds site sees what a person searches for, buys and sells, their address and messages with sellers. We found: 27 third-party SDKs in 3 apps, 12 of them for advertising and analytics.

0websites analysed

3apps

27SDKs in its apps

12of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
Adverts.ie com.distilledmedia.adverts 1.91.5	Firebase Cloud MessagingFirebase CrashlyticsFirebase Performance MonitoringGoogle AdMobGoogle AnalyticsGoogle Firebase AnalyticsMeta (Facebook) Login / ShareMeta (Facebook) SDKDidomi of which advertising & analytics: 4 SDKs from non-EEA companies: 8	9	—
Daft.ie com.daft.ie 10.1.0	Firebase Cloud MessagingFirebase CrashlyticsFirebase In-App MessagingFirebase Performance MonitoringFirebase Remote Config / A/B TestingGoogle AdMobGoogle Firebase AnalyticsGoogle reCAPTCHAGoogle User Messaging PlatformAppsFlyerDidomi of which advertising & analytics: 4 SDKs from non-EEA companies: 10	8	—
TheJournal.ie com.distilledmedia.thejournal 6.11.2	Firebase Cloud MessagingFirebase CrashlyticsGoogle AdMobGoogle Firebase AnalyticsGoogle IMA SDKMeta (Facebook) Login / ShareMeta (Facebook) SDK of which advertising & analytics: 4 SDKs from non-EEA companies: 7	8	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

Delfi

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. Delfi is one of Estonia’s largest news portals, owned by the media group Ekspress Grupp, which also owns the weekly Eesti Ekspress.

What is at stake. A news and media service sees what a person reads, watches and listens to — enough to build a picture of their interests and views. We found: 11 trackers on 1 website; 21 third-party SDKs in 3 apps, 6 of them for advertising and analytics.

Digitaliseringsstyrelsen

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. Digitaliseringsstyrelsen is the Danish Agency for Digital Government. It runs state digital infrastructure: Digital Post (official mail from authorities), the digital driving licence (Kørekort) and the health insurance card (Sundhedskortet).

What is at stake. Government services handle data people cannot avoid giving: personal ID code, address, family, dealings with public bodies. Opting out is usually not possible. We found: 1 tracker on 1 website; 6 third-party SDKs in 3 apps, 2 of them for advertising and analytics.

DocMorris N.V.

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. DocMorris is an online pharmacy operating from the Netherlands for customers in Germany: prescription and over-the-counter medicines, e-prescriptions.

What is at stake. Health services process health data — a special category under GDPR (Art. 9) with stricter rules than ordinary personal data. We found: 5 trackers on 1 website; 11 third-party SDKs in 1 app, 3 of them for advertising and analytics.

1websites analysed

1apps

11SDKs in its apps

3of them advertising & analytics

5trackers on its websites

Domains: docmorris.de · names: DocMorris N.V.

DPG Media

Tue, 20 Oct 2026 19:37:30 +0300

What is at stake. A news and media service sees what a person reads, watches and listens to — enough to build a picture of their interests and views. We found: 35 third-party SDKs in 3 apps, 18 of them for advertising and analytics.

0websites analysed

3apps

35SDKs in its apps

18of them advertising & analytics

Apps

App	Embedded SDKs	Sensitive perms	Declared in RuStore
AD be.persgroep.android.news.mobilead 9.22.0	Firebase Cloud MessagingFirebase CrashlyticsFirebase In-App MessagingFirebase Performance MonitoringFirebase Remote Config / A/B TestingGoogle AdMobGoogle Firebase AnalyticsGoogle IMA SDKGoogle Tag ManagerMeta (Facebook) Login / ShareMeta (Facebook) SDKHuawei Ads Kit of which advertising & analytics: 6 SDKs from non-EEA companies: 12	9	—
De Morgen be.persgroep.android.news.mobiledm 7.52.0	Firebase Cloud MessagingFirebase CrashlyticsFirebase Performance MonitoringGoogle AdMobGoogle Firebase AnalyticsGoogle IMA SDKGoogle Tag ManagerGoogle User Messaging PlatformHuawei Ads KitIAB Open Measurement SDKMeta (Facebook) SDK of which advertising & analytics: 6 SDKs from non-EEA companies: 11 records screen and taps	10	—
HLN.be be.persgroep.android.news.mobilehln 9.22.0	Firebase Cloud MessagingFirebase CrashlyticsFirebase In-App MessagingFirebase Performance MonitoringFirebase Remote Config / A/B TestingGoogle AdMobGoogle Firebase AnalyticsGoogle IMA SDKGoogle Tag ManagerMeta (Facebook) Login / ShareMeta (Facebook) SDKHuawei Ads Kit of which advertising & analytics: 6 SDKs from non-EEA companies: 12	9	—

A website and an app are treated as one company when the developer domain (from RuStore or the package name) or the signing certificate matches. Built automatically on 2026-10-20.

eBay, Inc

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. Kleinanzeigen (Germany), Kijiji (Canada) and Bilbasen (Denmark) are classifieds sites formerly owned by eBay; the business passed to Adevinta in 2021. The apps are still signed with eBay’s key.

What is at stake. A marketplace or classifieds site sees what a person searches for, buys and sells, their address and messages with sellers. We found: 37 third-party SDKs in 3 apps, 20 of them for advertising and analytics.

Ecolines

Tue, 20 Oct 2026 19:37:30 +0300

Who they are. Ecolines is an international bus carrier based in Riga, running routes between the Baltic states and Eastern and Western Europe.

What is at stake. A carrier or travel service knows who travels where, when and with whom — often passport details too. We found: 7 trackers on 1 website; 1 third-party SDK in 1 app, 1 of them for advertising and analytics.

1websites analysed

1apps

1SDKs in its apps

1of them advertising & analytics

7trackers on its websites

Domains: ecolines.net