How to keep a record of a suspicious app (for an advocate or the police)

Before you change anything

What is worth recording

An advocate, a lawyer or the police will usually find these details useful:

• The app’s name and package name. The package name is the app’s unique ID, such as com.example.app. It appears on the app’s App info page on many phones, and in Applore.
• When it was installed and last updated. Shown on the App info page on many phones, and in Applore.
• Where it came from. An app store, a file, or another app.
• What access it holds. Accessibility, notification access, device admin, and permissions such as location, microphone or messages.
• Whether it has an icon. Note if it does not appear in your app drawer.
• The date and time you found it, and anything that happened around the install date, such as someone else having the phone.
• Other signs. Messages, remarks or behaviour that suggested someone knew things they should not.

Safety while recording

• Assume the phone may be watched. A monitoring app with accessibility access may see what is on the screen, including your notes. Where you can, write notes on another device or on paper.
• Keep copies off the phone. Send the record to a trusted email address that the other person cannot access, or to a phone or computer that is not this one.
• Applore’s safety screens cannot be screenshotted. They are hidden from screenshots and the Recents preview by design. Use Applore’s report instead, or photograph the screen with another device.
• Take your time. If you need to stop, Applore’s Quick exit leaves the app in one tap and removes it from Recents.

Creating a report with Applore

When Applore flags an app in Needs your review, you can create a report from its safety steps:

The report is created on your phone. Nothing is uploaded, and Applore never receives it. It includes:

• App: name, package, version, whether it is still installed, who installed it, first installed and last updated dates, and its signing certificate fingerprints
• Finding: warning level, status, matched indicator family if any, and when Applore first flagged and last checked it
• Why it was flagged: each warning sign in plain words
• This phone: device, Android version, Applore version, and when the report was created, in UTC and local time
• Help: where to find support

The PDF is easy to read. The JSON data file holds the same information in a form that technical specialists can use. Each report states that a flag is not proof that someone is monitoring you, and that not being flagged does not mean no monitoring app is installed. How sharing works is described in the privacy policy.

Keeping a record without Applore

Menu names differ between phone makers and Android versions.

Add a short note with the date and what you saw. How to check an Android phone for stalkerware lists every screen worth looking at.

Who to give it to

• A domestic abuse or tech safety advocate can help you understand what the record shows and plan next steps.
• A helpline can point you to local services. Support hotlines lists where to start.
• The police or a lawyer, if you choose to report. Rules on what counts as evidence, and how it should be collected, differ by country. Ask them what they need before you remove the app.

What Applore cannot do

Applore’s report records what Applore saw on the phone. It is not a legal document, and Applore cannot say whether it will be accepted anywhere. How Applore’s check works explains what a flag means.

Get support

The Applore app includes support contacts for India, the United States and the United Kingdom, plus global options. If you live somewhere else, search for a domestic abuse helpline in your country. If you are in immediate danger, contact your local emergency number.

When you are ready to decide about the app, read before you remove a suspicious app. More guides are on the safety hub.