How to use the SDK detector
- Get the app package: your own release build (an
.aabfromapp/build/outputs/bundle/releaseor an.apk), or an APK you have the right to inspect. - Drop it on the box above. A typical app takes a second or two.
- See the SDKs by category, with versions where the app records them, and send them to the Data safety generator or the privacy policy generator.
What it finds
| Category | Examples |
|---|---|
| Framework | Flutter, React Native, Expo, Unity, Unreal, Godot, .NET MAUI, Cordova, Capacitor, Jetpack Compose |
| Advertising | AdMob, AppLovin MAX, Unity Ads, LevelPlay (ironSource), Meta Audience Network, Liftoff, Mintegral, Pangle, InMobi, Chartboost, DT Exchange, Moloco |
| Analytics & attribution | Firebase Analytics, Mixpanel, Amplitude, Facebook App Events, AppsFlyer, Adjust, Branch, Singular |
| Crash reporting | Crashlytics, Sentry, Bugsnag, Instabug, Datadog |
| Payments | Google Play Billing, RevenueCat, Stripe, Adapty, Superwall |
| Push, sign-in, backend | Firebase Cloud Messaging, OneSignal, Braze, Firebase Auth, Sign in with Google, Firestore, Supabase |
It also shows the app's package name, version, minimum and target Android version, permissions, native libraries and the AdMob app ID.
Ad SDKs and app-ads.txt
When the app is on Google Play, the detector reads the developer's app-ads.txt and compares it with the ad SDKs inside: a network whose SDK is in the app but has no line, a network with only RESELLER lines where your own account needs a DIRECT one, and whether the AdMob publisher ID is listed. Only the package name and the publisher ID are sent for this check, never the file.
No app file? Paste a Google Play or App Store link, a package name or a developer website to see the ad networks in app-ads.txt: the networks the developer has its own account with, and the resellers. This works for iPhone apps too. app-ads.txt covers all of a developer's apps, so it shows who the developer works with, not proof that one app uses each network.
How it works
APK and AAB files are ZIP archives. The detector reads the archive's file list, then only what it needs: the class names in the classes.dex files, the components and metadata in AndroidManifest.xml, the native libraries in lib/ and the version files libraries leave behind. Every SDK ships its own classes (for example com.applovin or io.sentry), so the class names give it away, even in apps shrunk with R8.
Limits
- Apps that encrypt their code or download it at run time can hide SDKs.
- An SDK whose classes were renamed into the app's own package isn't found.
- A library in the app isn't proof it's used: some SDKs come along as dependencies of others.
- iPhone apps' code can't be read: App Store apps are encrypted. Their ad networks can still be read from app-ads.txt.
Is my file private?
Yes. The file is read in your browser and never sent to AppPage.net or anywhere else; the app-ads.txt check only sends the package name and AdMob publisher ID. You can check it in your browser's network tab.