Sweep

about

description

"Is something on my phone watching me" is a normal question with a hard answer. Sweep checks the places surveillance software actually lives: * Installed apps against a public, maintained stalkerware list (Echap's indicators, bundled, matched by package name and signing certificate so renamed copies still match). * Device admin apps and the powers they declare, such as locking or wiping the phone. * Accessibility services that are turned on, and what Android says each one can do, like reading the screen or seeing what you type. * Apps with notification access. * Which sensitive permissions each app holds right now: microphone, camera, location, text messages, call history, contacts and more. * Apps that start at boot or declare background services for location, the camera or the microphone. * Keyboards, certificate authorities a person added, VPN apps and the always-on VPN setting. * The default text message app, dialer and assistant, device and profile owners, and whether a work profile exists. * USB and wireless debugging, developer options, and battery optimization exemptions. * Apps with no launcher icon, and apps installed from outside any store, with when they arrived and what installed them. Every result opens with how many of these Sweep could actually read, and lists what it could not read and why. Each finding is explained in words. Sweep never says "you are safe": it says "these specific checks found nothing", and means exactly that. Matches lead with do-not-confront guidance and advocate hotlines, because removing stalkerware can escalate a dangerous situation. One permission (listing installed apps, which is the checkup itself) and no internet permission, so what Sweep sees cannot leave your phone. Results are never stored. A Leave fast button sits on every screen. Runs on Android 9 and newer, with Android System WebView 87 or newer. Android 9 has had no security fixes since January 2022, so on a phone that old the checkup tells you less: spyware that got in through an unpatched hole might not show up as an app. Beta: offered to domain organizations for review. Treat Sweep as one tool, not an authority.

publisher

78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d

first seen

2026-10-12T07:33:11.397507+00:00

last event

2026-10-03 17:26 UTC

install

zapstore.dev or any Zapstore-compatible client

topics

#security

source & build

repository

https://github.com/munzzyy/sweep

arch flags

android-arm64-v8a

manifest

missing

releases (kind 30063)

1 release indexed; latest 0.7.2.

assets & verification

Every app, release and asset event is schnorr-verified (NIP-01 id + signature) before it enters the catalog, and assets are content-addressed by sha256. We subscribe read-only to the catalog relay — never write to it.

0.7.2 — sweep-0.7.2.apk

sha256

88407d9bbf94248d420d5466587ae070aec638f4702d80e31e97ebde9f9fde1d

size

0.9 MB

archs

android-arm64-v8a

version code

702

apk cert sha256

10319fc7dd916baa9e6e2e49a2323fa1b3ea395d50d36c4b966086e67b7e12e8

download

sweep-0.7.2.apk

Showing the newest 1 asset descriptor; the full set is in /api/apps/78ce6faa…