Privacy Policy
What PrivacyBrew reads, and why
PrivacyBrew reads information Android already exposes about your installed apps — their names, permissions, and optionally when they were last used — and displays it in plain language, entirely on your device. It requests exactly two permissions:
QUERY_ALL_PACKAGES — lets PrivacyBrew list your installed apps and read their already-granted permissions via Android's PackageManager. By default this is a plain metadata read: just each app's name and permissions — the same information Android's own Settings app can show you.
One additional feature, Deep Tracker Scan (Settings → Advanced), is fully opt-in and off by default, and uses this same permission to go further: with your explicit consent, it reads the actual installed code of other apps directly from your device's storage, to detect tracker/ad SDKs invisible to the metadata-only method above. This never runs automatically or in the background — only when you enable it and tap "Scan Now." The only thing kept is a small list of detected SDK names per app; none of the other app's actual code, resources, or any other data is copied, stored, or sent anywhere.
PACKAGE_USAGE_STATS (optional, off by default) — powers two opt-in features: showing when you last opened each app, and, for the privacy quiz, how much time you spend in apps (your total time in social media apps over the last 7 days). Android requires granting this explicitly in system Settings, and you can revoke it at any time; every other part of the app works the same without it. Read on-device only, never transmitted.
Device Checkup (Home screen) doesn't use either permission above — it reads a small number of device-wide security settings directly from Android, the same way any app can check whether your screen lock is set up: whether your lock screen shows message previews, whether your device has a secure lock screen set up at all, and which accessibility services (if any) are currently enabled. This is read fresh every time you open the Home tab, never stored, and never transmitted — it only ever appears if something is actually worth a look, and disappears again once you fix it.
PrivacyBrew does not request INTERNET, location, camera, microphone, contacts, storage, or anything else — there was no legitimate use for any of them, so we didn't ask.
What PrivacyBrew doesn't do
- No account or sign-in — nothing to register for, nothing tied to your identity.
- No analytics, telemetry, or crash reporting. No third-party SDK reports back to us or anyone else.
- No advertising — no ad SDKs, no ad IDs used, no targeting.
- No off-device data storage. Most screens are
recomputed live from Android's current state every time you open them. A
few small things are kept locally on your device so the app doesn't lose
useful context between opens:
- UI preferences — theme, text size, and whether you've dismissed the intro or tab tour
- Privacy quiz state — whether you took or skipped the first quiz, the date of the last quiz, whether the weekly quiz is on, the date each question was last asked (so it does not come back for 6 weeks), and for some phone questions the last value, so a later quiz can show "Last time / Now" (a number of apps, the screen timeout, the security update age in months, or whether a setting was on). No app names, no screen time, and no answers or scores are kept
- Access notices you've dismissed, so a reviewed item doesn't keep reappearing (Settings → Dismissed Access)
- A snapshot of each app's last-seen permissions, used only to flag what's new since your last visit
- Up to 90 days of daily tracker/sensitive-permission totals, used only for the Home screen trend line
- If you tell PrivacyBrew you've reset your Android Advertising ID (Settings): the self-reported date, just so PrivacyBrew can remind you it's been a while — the reset itself always happens in Android's own system Settings, never inside PrivacyBrew
- If you tell PrivacyBrew you've submitted a California DROP request or a request to one of the individual data-broker sites in the Opt-Out tab: the self-reported submission date (and, optionally for DROP, your own tracking ID) — the request itself always happens on that broker's or California's own site, never inside PrivacyBrew, and is never verified automatically, only self-reported by you
- If you've enabled the opt-in Deep Tracker Scan feature (off by default): a cache of which tracker SDKs were found in each scanned app's actual code, per app version, so an unchanged app isn't re-scanned every time — turning the feature off stops it being used immediately, and "Clear cached results" deletes it entirely
External links
A few places in the app open an external link when you tap it — for example, a data broker's opt-out page, or an app's Play Store "Data safety" listing. Nothing is fetched automatically; it opens in your browser or the Play Store app, under that site's own privacy policy, and PrivacyBrew never reads or stores anything from it.
This website
Everything above describes the PrivacyBrew Android app. This website (privacybrew.app) is a separate, static, script-free page: it doesn't use cookies, analytics, or tracking pixels of any kind. It's hosted on GitHub Pages, which — like any web host — automatically logs basic connection data (e.g. IP address, browser type, request timestamp) as part of serving the page; we don't control or access those logs beyond what GitHub's own hosting infrastructure retains. See GitHub Pages' documentation for details on that infrastructure-level logging.
Data retention
PrivacyBrew keeps no logs, databases, or files on our servers — we don't have any. The on-device items listed above stay only on your device, only until you clear the app's data or uninstall it, at which point 100% of it is gone.
Children's privacy
PrivacyBrew isn't directed at children and doesn't knowingly collect information from anyone, children included — it doesn't collect information from anyone at all.
Changes to this policy
If a future update changes what data is read or how, we'll update this page and the in-app version with a new effective date before that change ships.
Browser Privacy Check (this website)
The Browser Privacy Check page runs entirely in your browser. Its results are shown only to you and are never sent to PrivacyBrew; this website has no analytics and stores nothing about you.
To test third-party cookies, the page loads a small test page from
privacybrew.github.io, a separate site we run on GitHub
Pages, which sets a temporary test cookie (deleted right away) and reports
only "allowed", "kept separate" or "blocked" back to the page. Like any
website, GitHub's servers see the request.
Two optional tests run only if you start them, after a warning: the tracker-blocking test tries to load scripts from Google, Meta and Microsoft (they see the request, without cookies), and the IP leak test asks a public Google server to report your IP address back to your browser. Neither result is sent to PrivacyBrew.
The autofill test shows what your browser's autofill would hand to a form, including boxes you can't see. Anything it fills in stays on the page, is shown only to you, is never sent or saved, and is cleared when you tap Clear or leave the page.
The page also checks, without asking, if your device has a camera and a microphone, and if this website has access to your location, camera, microphone or notifications. The optional location test asks your permission first. Your location is shown only to you and is never sent to PrivacyBrew. Your browser can use its own location service to find it.
Browser extension
The PrivacyBrew browser extension runs entirely in your browser. It has no account and no analytics, and it never sends your browsing data to PrivacyBrew or anyone else.
It works only on websites (http and https), not on files on your computer. To block trackers and ads and to build its report card, it looks at the web addresses that each page requests. It compares them with tracker and ad lists that ship inside the extension. The report for a page is kept in your browser only while that page is open. It stores only website names and paths, never the tracking IDs in a web address.
Your settings (for example, websites where you turned off blocking) are stored in your browser. When you turn it on, the extension sends "do not sell or share my data" (Global Privacy Control) or "do not track" to the websites that you visit, and it answers cookie pop-ups for you. It never selects "Accept all".
Feedback form
The feedback page shows a form run by Tally (tally.so), a form service based in the EU. Tally receives what you type and, like any website, sees your IP address and browser. We use the answers only to improve PrivacyBrew. Your email is optional; add it only if you want a reply.
If you open the page from the PrivacyBrew extension, it can also send the extension version and your browser name, if you leave that box ticked. It never sends the address of the page you were on. We keep feedback until we no longer need it, and you can ask us to delete yours at any time.
Contact
Questions about this policy: privacybrew@protonmail.com