What My Phone Knows privacy policy
Last updated September 22, 2026
Short version: everything the app works out about your phone stays on your phone. There is no account and no server. The one thing that goes online is the ad at the bottom of the first screen, and only after you tap for it.
What this covers
This is the policy for What My Phone Knows, the Android app made by Pettigrew Lab LLC. On Google Play it is com.pettigrewlab.wmpk.
The web site has its own policy, because a web page and an app do different things and collect different things. If you came here from a browser, that is the one you want.
What the app reads, and where it stays
Three kinds of thing: the signals your phone hands out about itself, the code inside the apps in your launcher, and, if you start it, a short capture of where your phone tries to connect.
All of it is worked out on the phone and stays there. None of it is uploaded, because there is nowhere to upload it to. No account, no sign-in, no server on our end.
The scan, and the list it matches against
The scan reads the code inside the apps that have an icon in your launcher and looks for tracking libraries it recognizes. It matches against a catalogue of 405 of them, compiled by Exodus Privacy.
That catalogue ships inside the app and updates when the app updates. Nothing is fetched to run a scan, and no app name and no result ever leaves your phone.
What the app saves on your phone
Three things. Which version of each app it already scanned, so it does not redo the slow part every time. Whether you have seen the opening screen. And your answer to the ad consent form.
That is the whole list. “Clear what this app remembered” in About throws away all three.
The ads, which are the one thing that goes online
There is an ad at the bottom of the first screen, and it is the only part of the app that uses the internet. Nothing loads until you tap for it. Open the app and never scroll that far, and it opens no connection at all.
The ads come from Google AdMob, under publisher ID pub-8430769261731805.
Through Google’s Mobile Ads SDK, Google collects your advertising ID, an approximate location worked out from your IP address, how you interact with the ad, and diagnostics about how the request went. It goes over an encrypted connection, and it goes to Google. The app never receives any of it and never stores it.
The Data safety section of the Play listing says the same thing in Play’s own words: advertising ID, approximate location, app interactions and diagnostics, collected and shared with Google for advertising, analytics and fraud prevention.
What the app asks permission for
Four things: internet access, network status, the advertising ID, and a wake lock, which keeps the phone from sleeping while a request finishes. All four are there for the ad. There is a fifth with this app’s own name on it that Android generates for any app registering a receiver while it runs, and it grants nothing to anybody.
No location, no contacts, no storage, no camera, no microphone. The app does not ask for them, so it cannot get them.
You do not have to take that on faith. Run `aapt dump permissions` against the APK and the list is the list. The app’s build fails if a library adds anything beyond it.
Listen, and why it sends nothing
Listen uses Android’s VpnService to receive your phone’s own traffic for sixty seconds, so the app can show you where things were trying to go. That is a pipe that ends inside the app: it forwards nothing, opens no connection of its own, and sends nothing off the phone.
Nothing gets out while it is running, which is also why the results are addresses rather than names. A connection that never finishes opening never gets to say where it was headed.
If you are in the EEA, the UK or Switzerland
You get a consent message before any personalized ad loads. It is Google’s own, certified for the job, and it names the companies asking. Some US states get it too.
Saying no is a real answer and the app carries on without ads. You can change the answer whenever you like with “Change your ad consent” in the app.
Your advertising ID
It is the one identifier in any of this that follows you, and it belongs to Android rather than to us. On most phones it is in Settings, under Privacy, then Ads. Newer versions let you delete it outright instead of resetting it, which stops personalized ads across every app on the phone rather than only this one.
Google My Ad Center, where you can see and change what Google has on file
What we do not do with any of it
We do not sell your personal information and never have. We are not in a position to: the ad data goes to Google, not to us, and there is no account here to attach it to.
There is no profile of you on our side, because there is no side. Nothing is built, kept or handed on.
Children
The app is written for adults, and we do not knowingly collect anything from a child.
Deleting your data
There is no account to delete, because there was never one to make. “Clear what this app remembered” in About wipes the three things listed above, and uninstalling the app removes everything it saved.
The advertising ID is the phone’s rather than the app’s, so that one is the Android setting above.
If you email us
Then we have your email address and whatever you wrote, and we keep it as long as it takes to answer you. It does not go on a list.
If this changes
The date at the top changes with it. If a future version sends something new, this page says so before that version ships, rather than after somebody finds out.
Questions
Email pettigrewlabllc@gmail.com.