Legal
Privacy Policy
Last updated: August 9, 2026
Summary
Universal Installer ("the app") is an Android package manager that installs APK, APKS, XAPK, and APKM files on your device. There are no accounts and no advertising, and we never sell or share your personal data.
There are two builds of the app, and they differ in exactly one respect:
- The Google Play build reports anonymous statistics about how installs go, and crash reports, through Google Firebase.
- The GitHub build reports nothing. It contains no analytics or crash-reporting code at all.
Both builds are open source, so you can verify every statement on this page by reading the code.
Data we collect
From the GitHub build: nothing. It creates no account, transmits no usage statistics, and reports no crashes. Everything it needs to operate stays on your device.
From the Google Play build, two things are sent to Google Firebase:
- Install statistics. When an install starts and when it finishes, we record which install method was used (the standard Android installer, Shizuku, root, or Dhizuku), whether it succeeded, failed, or was cancelled, the category of error if it failed, and how many package files were involved.
- Crash reports.When the app crashes or recovers from an error, we receive the stack trace, your device model and Android version, the app version, and the app's own warning and error log lines leading up to it.
We never record what you install. No package names, app names, file names, or file paths are sent — not in statistics, not in crash reports. What we are trying to learn is which install methods work and where they fail, and that requires none of it.
Firebase additionally assigns a random per-installation identifier and collects standard technical information such as device model, operating system version, app version, coarse country, and language. It is not linked to a name, email, or account, because the app has none. Deleting and reinstalling the app resets the identifier.
Firebase, and how to avoid it
The Google Play build uses Firebase Analytics and Firebase Crashlytics, which are operated by Google. Data sent to them is handled under Google's Firebase privacy and security policy. Because Firebase Analytics is included, the Play build also declares Android's advertising ID permission. The app shows no ads and runs no ad campaigns.
If you would rather send nothing at all, install the build published on GitHub Releases. It is the same app, built from the same source, with the Firebase libraries left out entirely rather than merely switched off.
Data stored on your device
The app stores the following information locally, in Android's private app storage, and never uploads it:
- Installation history (package names, status, timestamps).
- Your app preferences, including theme and installer options.
- Your VirusTotal API key, if you choose to enable VirusTotal scanning.
Clearing the app's storage from Android system settings removes this data.
Network access
The app's core functionality — reading, inspecting, and installing package files — works entirely offline. Beyond the Firebase reporting described above, which applies to the Google Play build only, network access is used for the following optional features, and only when you explicitly trigger them:
- VirusTotal scanning.If you provide a VirusTotal API key and ask the app to scan a file, the file's hash (and, if needed, the file itself) is sent to the VirusTotal API using your key. This feature is disabled by default.
- LAN file sharing. The built-in file server runs on your local network only, and only while you have it switched on.
When you use VirusTotal, your request is subject to VirusTotal's own privacy policy. We have no control over or access to the data VirusTotal receives.
Android permissions
The app requests only the permissions it needs to install and manage packages, including permission to read storage (to access APK files you select), permission to install other apps, and permission to query installed packages. None of them is used for advertising.
The Google Play build additionally declares the advertising ID permission, which the Firebase Analytics library brings with it. The GitHub build does not declare it.
Shizuku
If you opt in to Shizuku mode, the app communicates with the Shizuku service on your device to perform silent installs and related operations. This happens entirely on-device; no data leaves your phone as part of Shizuku integration.
Children's privacy
The app is not directed at children and does not knowingly collect personal information from anyone, including children under 13. Nothing it reports identifies a person.
Changes to this policy
If the privacy practices of the app change, this page will be updated and the "Last updated" date above revised. Material changes will also be noted in release notes on GitHub.
Contact
Questions about this policy can be sent by email: