Blocks submissionGoogle Play

An app that lets one person see another's location or activity is not a monitoring app, or is a lawful one

The question The app shares location or activity between people. Who installs it, who controls the sharing, and can the person being seen stop it at any time and see that it is happening? If the watched person installs it on their own phone, chooses what to share and is told each time, it is not a monitoring app. If someone else installs it on their phone or the sharing cannot be seen or stopped by them, it is stalkerware unless exclusively for parents over children or employers over employees, marketed only as that, flagged IsMonitoringTool, with a persistent notification, a unique icon and the monitoring disclosed in the description. State which case and why, from the listing and the app's own screens.

A person or a model answers it from the app's texts and screens; the answer is kept only while the facts it saw are unchanged.

Applies when capability:location; listing:\b(track|monitor|locat|where (is|are)|find my|family|child|kid|employee|partner|spouse)

Checked from built, not yet uploaded, on a test track, submitted and in review, published

The rule, in our words

• Malware: No code, including third-party SDKs, that puts the user, their data or the device at risk: no backdoors, billing fraud, elevated-privilege abuse, phishing, ransomware, malicious rooting, spam, spyware, trojans, hostile downloaders, riskware or denial of service. Spyware includes any SDK that sends data off the device in a way the user would not expect or without adequate notice and consent. Stalkerware: an app that collects personal or sensitive data and transmits it to another party for monitoring is allowed only when exclusively designed and marketed for parents monitoring their children or enterprises monitoring employees; it may never track any other person, such as a spouse, even with consent and a persistent notification. Such apps must give prominent disclosure and obtain consent under the User Data policy, carry the IsMonitoringTool manifest flag, never present as a spying or secret-surveillance tool, never hide or cloak tracking, show a persistent notification and a unique icon whenever running, disclose the monitoring in the Play store description, never link to or enable non-compliant functionality (such as an outside APK), and comply with local law.
• User Data: Be transparent about all user data handling and comply with applicable privacy law; you are responsible for third-party SDKs and AI integrations in the app. Personal and sensitive data (including device location) must be limited to app functionality the user reasonably expects, transmitted with modern cryptography such as HTTPS, requested via runtime permissions, and never sold. Where collection may not be expected (for example background collection), show a prominent in-app disclosure in the normal flow (not only in a policy, not bundled with unrelated text) describing the data and its use, immediately before any consent or runtime permission request; consent must be a clear affirmative action obtained before collection, and backing out or auto-dismissing messages do not count. If Google asks, you must within 2 weeks show evidence that an SDK collecting data by default meets these rules. Persistent device identifiers may not be linked to other personal data or resettable IDs except for telephony or enterprise device management. Every app needs an accurate Data safety section consistent with its privacy policy, and a privacy policy linked in Play Console and in the app, at a public non-PDF URL, labelled as such, naming the developer or app with a contact, and covering data types, sharing, security, retention and deletion. Apps with account creation must offer account deletion in-app and via a web link entered in Play Console, deleting all associated data (freezing does not count), with any retention disclosed. App Set ID may not be used for ads. EU/UK/Swiss personal data from Google must be handled under the Data Privacy Framework terms, with immediate notice to Google if you cannot comply.

Okkok never stores the stores' text. Each item above is our paraphrase, and the link is the page it rests on, verified unchanged by fingerprint on every run.

The other store

• Google adds the web-link requirement; Apple adds the ban on call/email/support-only flows and explicitly covers auto-created guest accounts. "Freezing does not count" (Google) equals "deactivating is insufficient" (Apple). partial
• Google names transport encryption; Apple says only "appropriate security measures". google-stricter
• Apple requires an on-screen or audible recording indicator; Google requires the disclosure dialog but no live indicator (except for stalkerware under the Malware policy). partial
• Google requires the policy URL to be public, non-PDF and to name the developer with a contact, and bans selling data; Apple requires consent even for anonymous data, requires the policy to confirm third parties give equal protection, and bans making paid features depend on granting data access. partial

Check your app

pip install git+https://github.com/petresandu-cloud/okkok
okkok audit path/to/app

The report names this rule as google.not-stalkerware and says what to do, who does it, where, and how it knows.