Questions, answered

Apple requires every developer to declare what data their app collects and how it is used. The declaration is on the app's App Store page, in groups: data used to track you, data linked to you, data not linked to you, and data not collected. privacybench reads those declarations and turns each one into a score.

No. Labels are self-declarations. Apple does not audit them, and neither do we. A low score can mean an app collects little, or that its developer declared little. A high score means an app declares a lot of collection, not that it was caught doing anything.

Every distinct data type an app declares counts once per group, multiplied by the group's weight: tracking ×10, linked ×4, not linked ×1.5. The sum is scaled against the most a label could ever declare, to a number from 0 to 100. Higher means more declared collection. methodology page.

Data used to follow a person across other companies' apps and websites is the most consequential declaration a developer can make. The weights are judgements, not measurements, which is why they are published.

Each app page shows when it was last captured. Earlier captures are kept, so a label that changed shows up as a change.

One: the US App Store, so scores stay comparable. Labels can differ between storefronts. A separate comparison never changes an app's score.

Either it is not in the catalog yet, or its label could not be read. An unreadable label is never scored as zero. The app is tracked but left out of the ranking, because a failed read is not evidence that it collects nothing.

Not yet. Google Play Data Safety declarations are collected for research only. They are not in any plan, in the API or in the iOS score.

The public score page and a name search need no account. The ranking, filters and full report need one, and a paid plan for the whole directory. This page, pricing, the terms and the privacy policy stay public.

We ask Google for your name and email so we can create the account. We never see your Google password and cannot open anything else in that account. privacy policy.

Yes. Email us from the address on the account and we will delete it, its sessions and its API keys. [email protected].

The pricing page lists each plan: the filtered directory, CSV, the API, a watchlist, and on Business a change feed and webhooks. pricing page.

Lemon Squeezy is the merchant of record. It takes payment, calculates sales tax and VAT, and issues invoices. Card details go to Lemon Squeezy, never to us.

From your account page, open Manage billing and cancel there. You keep paid access until the end of the period you already paid for.

Not once a paid period has started. The site opens immediately, and CSV, alerts and the API open with the first payment; a copy of that data cannot be taken back. Cancel any time so the next period is not charged. A right the law does not let us waive still applies. terms.

Yes, per account per UTC day. Every key on the account, and calls from a signed-in browser, share one daily allowance. The numbers are on the API reference. API reference.

No. privacybench is an independent project. Apple, App Store and Google Play are trademarks of their owners. The data comes from public endpoints.

The score comes only from what the developer declared. When a label is updated, the next capture picks it up and the score follows. If a label was read incorrectly, write with the app's link and we will re-check it.