Privacy Policy

App: Play Integrity Monitor
Developer: ByteBuddies
Last updated: 2026-10-18

Summary

Play Integrity Monitor has no accounts or advertising and does not sell data. Normal checks send a random installation ID and diagnostic request data to our backend. An optional crowdsourcing preview, off by default, collects pseudonymous setup observations after explicit consent. Hashed IDs and keybox fingerprints can link observations; they are not anonymous data. Google Cloud hosts and processes backend data as described below.

1. What the app does

Play Integrity Monitor calls the Google Play Integrity API on your behalf to determine whether your device currently satisfies the criteria that Google Wallet and similar apps use when deciding to allow contactless payments. The result is displayed on your device and stored locally so you can see how it has changed over time.

2. Data stored on your device

The following is stored in the app's private storage. Android backup may include ordinary settings/history, but excludes the local identity study store. It is never shared with advertisers, analytics providers, or any service other than the app's own backend (described in section 3).

What	Why	How long
Random install ID	A UUID generated at first launch, used to apply per-installation rate limits on the backend. It is not linked to your Google account, Android ID, or any other identifier. You can reset it by clearing app data.	Until you clear app data or uninstall
Check history	Timestamp, result status, trigger type, device integrity verdict flags, and the raw JSON response for each completed check	90 days (older entries are deleted automatically)
Local identity study state	Initial composite certificate-chain fingerprint, initial probe outcome, consent/targeting claim, current local probe and up to eight pending setup observations. Stored separately in Android storage excluded from backup and device transfer. The initial fingerprint is never sent by the study.	Until app data is cleared or the app is uninstalled; opting out clears current/pending observations and consent, while retaining the local initial comparison
App preferences	Auto-check on/off, check schedule times, notification preference, quota counters, last-check timestamps, and server config cache	Until you clear app data or uninstall

The app does not store:

Your name, email address, or any account credentials
Your location
Your contacts, calendar, photos, or any media
Advertising identifiers (GAID)
Device identifiers such as IMEI or MAC address

3. Data sent to the app's backend

Each integrity check sends one HTTPS request to the app's backend server (integrity-autocheck-backend-*.run.app), which is operated by ByteBuddies on Google Cloud Run.

The request contains:

Field	What it is
Encrypted Play Integrity token	An opaque token issued by Google's Play Integrity API. The backend sends it to Google for decoding; the raw token is not stored.
Request hash	A non-reversible hash of the request context. Used to bind the token to this specific request and detect replays.
Install ID	The random UUID described in section 2.
Trigger	What started the check (e.g., `manual`, `periodic`, `boot`).
Client timestamp	The time the check was initiated, used to verify token freshness.
App version	Version code and version name of Play Integrity Monitor.
Google Wallet version	Version of Google Wallet on your device, if installed. Sent as a diagnostic aid.
Play Services version	Version of Google Play Services on your device.
Play Store version	Version of Google Play Store on your device.

The backend returns a compact decision (ready, likely_blocked, unknown, error) plus the verdict labels from the Play Integrity API. The backend does not return, and the app does not transmit, your Google account identity, location, contacts, or any personal identifiers beyond the install ID.

What the backend retains

The backend uses Cloud Firestore to enforce per-installation rate limits. For each install ID it stores:

A hash of the install ID (the raw UUID is not stored)
Daily request count
Timestamp of the most recent request
Error counters

The backend does not store the raw integrity token, the full decrypted verdict payload, or any account identifiers. Operational request logs contain request IDs, a hash of the installation ID, compact verdicts/reasons and app/service versions. These are pseudonymous diagnostics, not anonymous aggregate counts. Ordinary application logs currently use a 30-day Cloud Logging retention period.

Optional crowdsourcing setup study

Participation requires accepting the disclosure and claiming that spoofing is configured for this app with the same keybox used for Play Integrity. A local probe is compared with the first observation taken when this feature was first launched. This does not prove spoofing: the initial identity may already be spoofed, and native certificates can rotate.

With a supported normal Integrity check, the opted-in app can send:

A random observation ID, consent/schema versions and self-reported targeting claim.
Setup-confirmation, manual-recheck or normal-check phase.
Changed, unchanged, no-baseline or probe-failed result.
Initial/current certificate-chain depths, a coarse initial-observation age range and a generic probe-error category.
Android SDK version. The check also supplies the sending app version and the usual random installation ID; analytics retain its hash together with the Device/Strong verdict summary.

These setup analytics never include the initial/current certificate fingerprint, raw certificates, private keys, certificate serial numbers or device model/build fingerprint. No Firebase Analytics or other analytics SDK is added. Events are queued locally and sent with normal checks; the study does not request extra Play Integrity checks. Opting out clears queued observations and stops future sending. Already collected study events remain until ordinary log expiry, currently 30 days.

The consent also describes future shared-keybox monitoring: once available, the current reported keybox fingerprint and installation ID may accompany normal verdicts to associate installs. That group-upload capability is not enabled in the current preview. Its active membership window is 48 hours without a check and failure evidence one hour; these windows do not shorten analytics log retention. No certificates or private keys will be uploaded. Immediate membership deletion and published rollout details must be completed before enabling that capability.

4. Third-party services

Service	Purpose	Privacy information
Google Play Integrity API	Issues the encrypted integrity token that the backend decodes	Google Privacy Policy
Google Cloud Run	Hosts the app's backend	Google Cloud Privacy
Google Cloud Logging	Stores operational logs and explicitly opted-in setup-study events; current ordinary-log retention is 30 days	Google Cloud Privacy
Google Cloud Firestore	Stores rate-limit counters on the backend	Google Cloud Privacy

The app does not use any advertising SDKs, crash-reporting services, analytics SDKs, or social login SDKs.

5. Permissions

Permission	Why it is needed
`INTERNET`	To reach the backend server and the Play Integrity API
`POST_NOTIFICATIONS`	To send you a local notification when your integrity status changes
`RECEIVE_BOOT_COMPLETED`	To schedule an integrity check shortly after the device boots
`SCHEDULE_EXACT_ALARM` / `USE_EXACT_ALARM`	To fire daily scheduled checks at the times you configure

The app does not request permissions for location, contacts, camera, microphone, phone state, or storage.

6. Children

This app is not directed at children under 13 and does not knowingly collect information from anyone under 13.

7. Data retention and deletion

On-device data is deleted when you clear the app's storage or uninstall the app.
Ordinary backend logs and setup analytics currently expire after 30 days. Opting out stops future study uploads; it does not retroactively remove already ingested events.
Rate-limit records store hashed install IDs and counters. The current limiter does not implement the automatic 90-day deletion claimed by an earlier policy version; retention/deletion maintenance remains a separate backend task.
A hash does not make an installation unidentifiable: records can still be associated with the same installation. No account identity is requested by this app.

8. Security

All communication between the app and the backend uses HTTPS with TLS. The backend validates package name, signing certificate, request hash, and token freshness before processing any request, rejecting replayed or tampered tokens.

9. Changes to this policy

If the data practices described above change materially, this document will be updated and the "Last updated" date at the top will be revised. For significant changes, a notice will be displayed in the app.

10. Contact

Questions or concerns about this privacy policy can be directed to the project repository:
https://github.com/ByteBuddiesGroup/play_integrity_autocheck