Sweep
Plain-language stalkerware checkup. On-device, nothing stored or sent
New in version 0.7.2
Shrinks the release build with R8, with an explicit keep rule for the JavaScript bridge so the WebView can still call into it.
"Is something on my phone watching me" is a normal question with a hard
answer. Sweep checks the places surveillance software actually lives:
* Installed apps against a public, maintained stalkerware list (Echap's
indicators, bundled, matched by package name and signing certificate so
renamed copies still match).
* Device admin apps and the powers they declare, such as locking or
wiping the phone.
* Accessibility services that are turned on, and what Android says each
one can do, like reading the screen or seeing what you type.
* Apps with notification access.
* Which sensitive permissions each app holds right now: microphone,
camera, location, text messages, call history, contacts and more.
* Apps that start at boot or declare background services for location,
the camera or the microphone.
* Keyboards, certificate authorities a person added, VPN apps and the
always-on VPN setting.
* The default text message app, dialer and assistant, device and profile
owners, and whether a work profile exists.
* USB and wireless debugging, developer options, and battery optimization
exemptions.
* Apps with no launcher icon, and apps installed from outside any store,
with when they arrived and what installed them.
Every result opens with how many of these Sweep could actually read, and
lists what it could not read and why. Each finding is explained in
words. Sweep never says "you are safe": it says "these specific checks
found nothing", and means exactly that. Matches lead with
do-not-confront guidance and advocate hotlines, because removing
stalkerware can escalate a dangerous situation.
One permission (listing installed apps, which is the checkup itself) and
no internet permission, so what Sweep sees cannot leave your phone.
Results are never stored. A Leave fast button sits on every screen.
Runs on Android 9 and newer, with Android System WebView 87 or newer.
Android 9 has had no security fixes since January 2022, so on a phone that
old the checkup tells you less: spyware that got in through an unpatched
hole might not show up as an app.
Beta: offered to domain organizations for review. Treat Sweep as one
tool, not an authority.
answer. Sweep checks the places surveillance software actually lives:
* Installed apps against a public, maintained stalkerware list (Echap's
indicators, bundled, matched by package name and signing certificate so
renamed copies still match).
* Device admin apps and the powers they declare, such as locking or
wiping the phone.
* Accessibility services that are turned on, and what Android says each
one can do, like reading the screen or seeing what you type.
* Apps with notification access.
* Which sensitive permissions each app holds right now: microphone,
camera, location, text messages, call history, contacts and more.
* Apps that start at boot or declare background services for location,
the camera or the microphone.
* Keyboards, certificate authorities a person added, VPN apps and the
always-on VPN setting.
* The default text message app, dialer and assistant, device and profile
owners, and whether a work profile exists.
* USB and wireless debugging, developer options, and battery optimization
exemptions.
* Apps with no launcher icon, and apps installed from outside any store,
with when they arrived and what installed them.
Every result opens with how many of these Sweep could actually read, and
lists what it could not read and why. Each finding is explained in
words. Sweep never says "you are safe": it says "these specific checks
found nothing", and means exactly that. Matches lead with
do-not-confront guidance and advocate hotlines, because removing
stalkerware can escalate a dangerous situation.
One permission (listing installed apps, which is the checkup itself) and
no internet permission, so what Sweep sees cannot leave your phone.
Results are never stored. A Leave fast button sits on every screen.
Runs on Android 9 and newer, with Android System WebView 87 or newer.
Android 9 has had no security fixes since January 2022, so on a phone that
old the checkup tells you less: spyware that got in through an unpatched
hole might not show up as an app.
Beta: offered to domain organizations for review. Treat Sweep as one
tool, not an authority.
- Author: Munzzyy
- License: GNU General Public License v3.0 or later
- Issue Tracker
- Source Code
- Changelog
- Build Metadata
- Reproducibility Status
Donate
Versions
Although APK downloads are available below to give you the choice, you should be aware that by installing that way you will not receive update notifications and it's a less secure way to download. We recommend that you install the F-Droid client and use that.
Download F-Droid-
This version requires Android 9.0 or newer.
It is built and signed by the original developer, and guaranteed to correspond to this source tarball.
Download APK 0.9 MiB PGP Signature | Build Log