Forenzi — Privacy Policy
Forenzi is published by Ennes Labs. This privacy policy describes how the Forenzi Android application handles information. It is a supplement to the Ennes Labs general privacy policy, which covers the principles behind every product we ship.
Short version
Forenzi collects no personal data. It contains no analytics, no advertising, no tracking, and no third-party SDKs that report on you. There is no account and no Ennes Labs server, so there is nowhere for your information to be sent even in principle. Everything the app finds stays on your phone unless you explicitly share it out. Forenzi is free, with no ads and nothing to buy.
Why this policy matters more than most
Forenzi is built for people who may be monitored by someone close to them. That makes the usual reassurances inadequate: a security app that quietly transmits a list of your installed apps, or that requires an account tied to an email address an abuser controls, could expose the very person it claims to protect.
So the design rule is not "we handle your data carefully." It is that the data never leaves the device, and there is no server to receive it if it did.
What Forenzi does and does not do
What Forenzi does:
- Reads the list of applications installed on your device, along with each one's permissions, install source, signing certificate and metadata, and compares them on your phone against indicators of compromise published by independent security researchers.
- Reads device configuration that stalkerware depends on — enabled accessibility services, notification listeners, active device administrators, VPN state and developer settings.
- Parses an Android bug report, but only one you generate yourself and explicitly share into the app. It is extracted to private app storage, analysed, and deleted as soon as analysis finishes.
- Reads an Android Intrusion Log export, if you choose a file and hand it to the app. Android writes that log itself; Forenzi only interprets it.
- Computes fingerprints of installed application files, on demand, to compare against published samples. The files are read; nothing is copied anywhere.
- Writes evidence reports to private app storage when you ask for one, so you have a timestamped record you can keep or show to someone. Reports stay on the device until you share them yourself.
- Downloads updated indicator files directly from the researchers' own public repositories when you tap Update indicators, and at no other time.
What Forenzi does not do:
- Collect, transmit, or store personal information of any kind.
- Require an account, an email address, a sign-in, or any form of registration.
- Use advertising identifiers, analytics, crash reporting services, or telemetry of any kind.
- Communicate with any Ennes Labs server. No such server exists for this app.
- Use third-party SDKs that collect data on our behalf.
- Transmit your list of installed apps, your scan results, your evidence reports, your bug report, or your intrusion log — to us or to anyone else.
- Remove anything silently. Every uninstall goes through Android's own confirmation dialog, which only you can approve.
- Phone home to verify anything. Once installed, it runs offline indefinitely.
Information Forenzi processes locally
To do its job, Forenzi works with the following information on your device only:
- Installed application inventory — package names, versions, permissions, install source, signing certificates and manifest metadata. Read at scan time, analysed in memory, never transmitted.
- Device configuration — enabled accessibility services, notification listeners, device administrators, VPN state, developer options and verified-boot state.
- App usage and network totals — if, and only if, you grant usage access for the optional Activity Monitor. Revoking the permission stops it immediately.
- Bug reports you share in — extracted to private storage, parsed, then deleted when the scan completes.
- Intrusion log exports you select — read from the file you pick and analysed in memory.
- Scan results and evidence reports — stored in private app storage that no other application can read.
- Crash diagnostics — if the app crashes, the stack trace is written to private app storage so you can read it in Diagnostics. It is never sent anywhere, and you can clear it at any time.
You can clear scan history and crash logs from inside the app. Uninstalling Forenzi removes all of it immediately, including every evidence report.
Network access
Forenzi makes network requests for exactly one purpose: downloading updated indicator files when you tap Update indicators. Those requests go directly to the public repositories of the organisations that publish the data, in the same way opening their page in a browser would. No request is proxied through an Ennes Labs server, because no such server exists for this app.
Nothing about you, your device, or your scan results is sent with those requests. They are ordinary requests for a public static file.
If you never tap Update indicators, Forenzi never uses the network at all. The indicator set shipped inside the app works offline.
Permissions
Forenzi requests ten permissions. Each one is listed here with the reason it exists:
QUERY_ALL_PACKAGES— to see the applications installed on the device. A scanner that can only see some apps cannot find the one that is hiding. Google lists antivirus and security applications as an accepted use of this permission.INTERNET— to download indicator updates when you ask for them.ACCESS_NETWORK_STATE— to check for connectivity before attempting a download, and to detect whether a VPN is active.PACKAGE_USAGE_STATS— optional, and off until you grant it in Android Settings. Powers the Activity Monitor, which shows which apps have been running and moving data.REQUEST_DELETE_PACKAGES— to open Android's uninstall dialog when you choose to remove something. Forenzi cannot complete an uninstall on its own; the system asks you.FOREGROUND_SERVICEandFOREGROUND_SERVICE_SPECIAL_USE— for optional real-time protection, which watches for newly installed applications. Android requires a visible notification while this runs, which is the correct behaviour: a security tool should not be invisible.RECEIVE_BOOT_COMPLETED— to restore real-time protection after a restart, if you turned it on.POST_NOTIFICATIONS— to tell you when a scan finds something.VIBRATE— for alert feedback.
Forenzi does not request access to your contacts, camera, microphone, location, calendar, SMS, call history, photos, or files outside the ones you explicitly hand it.
Evidence reports
Forenzi can generate a timestamped record of what a scan found, including which researcher published each matched indicator, so you have something concrete to keep or show to an advocate or a lawyer.
These reports are written to private app storage and are never uploaded. They are append-only: Forenzi does not overwrite or delete an earlier report when it writes a new one. Each report carries a SHA-256 fingerprint of its own contents, so anyone holding a copy can verify it has not been altered since it was created.
A report leaves your device only when you share it yourself, through Android's share sheet, to a destination you choose. If you believe your phone is being monitored, be aware that what you send from it may be visible to whoever is monitoring it — the app says this on screen before you share.
Where the indicators come from
Forenzi does not invent its own threat list. It matches against indicator sets published openly by security researchers, and names the source of every match it reports:
- Amnesty International Security Lab — licensed CC BY 2.0.
- ECHAP (Échap) — stalkerware indicators, licensed CC BY 4.0.
- The Mobile Verification Toolkit project — MIT License, Copyright (c) 2022 MVT.
- ISDi, from the Cornell Tech / NYU Clinic to End Tech Abuse — the dual-use application list, MIT License, Copyright (c) 2018 Cornell University.
Forenzi is an independent application. It is not affiliated with, endorsed by, or supported by any of these organisations.
What Forenzi cannot tell you
Forenzi detects what researchers have already documented publicly. It cannot detect novel or unpublished spyware, it cannot inspect encrypted network traffic, and it cannot see inside another application's private data — Android permits no application to do those things. A clean result means nothing known matched. It is not proof that a device is clean.
Forenzi is also an application installed on the phone, which means anything already monitoring that phone can see that you installed it. Researchers who work with people experiencing this use a laptop connected by cable for exactly that reason. If you think the person monitoring you would react badly to seeing this app, that approach is safer, and an advocate can help you reach it.
Ownership, updates, and support
- Forenzi is free. There is no purchase, no subscription, no advertising and no in-app payment of any kind.
- Updates and fixes are included for as long as Ennes Labs maintains the application.
- Support questions can be sent to info@enneslabs.com at any point in the application's lifetime.
- The application does not contact any licensing server. Once installed, it runs offline indefinitely.
Children's privacy
Forenzi does not knowingly collect any information from anyone, including children under 13. Because no information is collected, there is no possibility of inadvertently collecting children's information.
Changes to this policy
If we ever change how Forenzi handles information, this policy will be updated and the change will be announced in the app's release notes. Material changes will require your explicit opt-in.
Contact
Questions about this policy can be sent to info@enneslabs.com.
If you are in immediate danger, or you believe someone is monitoring you against your will, the Coalition Against Stalkerware keeps a directory of advocates who help with exactly this: stopstalkerware.org.
Ennes Labs · enneslabs.com