An astrology app asks for access to your contacts. You want your horoscope. You tap Allow.
That tap just handed over the names, phone numbers, and email addresses of everyone in your phonebook. Your family, your colleagues, your doctor. It all went to a company you’ve never heard of. The astrology app didn’t need your contacts to read your birth chart. It needed them because contacts are valuable, and someone will pay for them.
How do free apps sell your data? They embed advertising and analytics SDKs, small code packages from third-party firms that do the collecting. The SDK gathers your location, contacts, and device identifiers, then packages and sells them to data brokers. The worst offenders are loan apps, astrology apps, photo editors, and utility apps. This is the business model behind almost every free app on your phone.
The real business model of free apps
Building an app costs money. Developers pay for servers, engineers, and marketing. If the app is free and has no subscription, the money has to come from somewhere.
It comes from data.
Free apps embed advertising and analytics SDKs — small code packages from third-party companies that do the actual data collection. The developer plugs in an SDK, agrees to the terms, and gets a revenue share. The SDK company does the rest: collecting behavioral data, location history, device identifiers, and contact lists, then packaging and selling this to data brokers and advertisers.
Several of the largest players in this ecosystem are Indian or operate prominently in India. InMobi, founded in Bangalore, is one of the world’s biggest mobile advertising networks. MoEngage and CleverTap are Mumbai-based customer engagement platforms used by thousands of Indian apps. ironSource (now part of Unity) powers monetization for Indian mobile game developers.
When you install a free app, you’re often installing four or five of these SDKs at the same time. Each one is collecting data. None of them are the company whose name is on the app.
Which app categories are worst
Not all apps are equally invasive. Some categories have business models that make data collection especially aggressive.
Loan apps are the worst offenders. Dozens of instant loan apps ask for Aadhaar number, PAN, contact list access, SMS read permissions, and location. All of it is justified as KYC (Know Your Customer) requirements. Some of this is legitimate. Most of it is not. A loan app does not need to read every SMS on your phone to verify your identity. It needs your bank statements. The excess data (your contacts, location history, and call logs) gets retained and sold long after your loan is repaid.
Astrology apps have become notorious for permissions that make no logical sense. An app that shows you your daily horoscope has no conceivable use for your contact list. Yet many request it. Why? Contacts are a high-value data category because they map real social graphs.
Photo editing and filter apps request storage access to do their job — that part is legitimate. The problem is that broad storage access on Android lets an app read far more than the photo you’re trying to edit. Documents, screenshots, downloaded files, other images. Apps that exceed what they need for their core function are worth treating with suspicion.
Utility apps — flashlight apps, phone cleaner apps, battery optimizer apps — are the classic trap. They perform a trivial function that Android does natively anyway, and they use that tiny footprint to request permissions that make no sense. A flashlight app asking for your location is not optimizing your torch. It’s collecting a data point to sell.
What the permissions actually mean
Android permission dialogs are written to sound harmless. Here’s what they actually do.
Contacts — access to your entire phonebook, not just your own number. Every name, every phone number, every email address your contacts have ever given you. This maps your social graph and exposes people who never agreed to anything.
Location (precise) — your GPS coordinates, accurate to a few metres. This can be sold to location data brokers who build movement profiles: where you live, where you work, which hospital you visited, which political rallies you attended.
Storage / Media — read access to files on your device, including photos, downloaded documents, and screenshots. This is broader than it sounds.
Phone (read phone state) — access to your IMEI number (the unique hardware identifier for your device), your carrier, and your call state. Your IMEI doesn’t change when you change SIM cards. It’s a permanent tracking identifier that follows your physical device.
Every one of these permissions has a legitimate use in the right context. The question is whether the app you’re granting it to actually needs it.
How to audit your own apps
Google added a Data safety section to every app’s Play Store listing in 2022. Open the Play Store, find any app, scroll down, and you’ll see what data the developer says is collected — broken down by data type and whether it’s shared with third parties.
It’s self-reported, which means it’s only as honest as the developer. But it’s still useful. If a flashlight app’s Data safety section shows it collects “Location — precise” and shares it with third parties for “Advertising or marketing,” that’s the developer admitting it in writing.
For a more honest view, go to Android Settings > Privacy > Permission manager. This shows you every app on your phone sorted by permission, not the other way around. Open “Location” and you’ll see every app that has ever been granted location access. Open “Contacts” and you’ll see who can read your phonebook.
Revoke anything that surprises you. The app will still work for its core function in most cases.
The Indian regulatory gap
The DPDPA requires companies to get meaningful consent before collecting personal data. In principle, every app that collects your location or contacts needs valid consent under Indian law.
In practice, the rules around what counts as valid consent for app permissions are still being written. MeitY has flagged specific apps — particularly Chinese-origin apps — and removed some from Indian app stores. But enforcement against the broader SDK ecosystem, which operates across thousands of apps simultaneously, is minimal.
The law is real. The enforcement is not yet. That means the work of protecting your data has to start with you, not with regulators.
What actually helps
Deny unnecessary permissions when you install an app. Read the permission dialog — it takes ten seconds. Ask yourself whether this app could possibly need this access to do what it claims to do.
For location specifically, Android gives you three choices: Allow all the time, Allow only while using the app, and Don’t allow. “Allow only while using” is almost always the right choice. It means the app can see your location when you have it open, but not when it’s running in the background.
Delete apps you don’t use. An app you installed two years ago and opened once still has the permissions you granted it, still runs background processes, and still collects data.
Before installing a new app, open its Play Store listing and read the Data safety section. If a utility app claims to collect device identifiers and share them with advertisers, install something else.
For a broader set of tools, including secondary phone numbers and email aliases that limit what apps collect in the first place, see email aliases and phone masks. The location and identifier data these apps leak often ends up on people-search and aggregator sites like Spokeo and Acxiom, which you can then request removal from.
Frequently asked questions
Which free apps sell the most data? Loan apps, astrology apps, photo editors, and utility apps (flashlights, cleaners, battery savers) are the most aggressive. Each requests permissions well beyond what its core function needs.
How do I check what an app collects? Open the app’s Play Store listing and read the Data safety section, then go to Android Settings > Privacy > Permission manager to see every app sorted by permission. Revoke anything that surprises you.
Does deleting an app stop it selling my data? It stops new collection, but data already sold has already left. Deleting unused apps still matters: an app you installed once keeps its granted permissions and can keep collecting until you remove it.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.