About the project

What we do

• We accept APK, XAPK and split-APK sets, parse the manifest and print everything that follows from it: version and build code, minimum Android, target API, architectures and the full permission list with dangerous ones marked.
• We compute the file’s SHA-256 and the signing certificate fingerprint — both are visible before download, on the version page.
• We write the description separately in Russian and English: two written texts, not one run through a translator.
• We keep version history: an app with several builds gets a page for all versions and a page for each one, including how it differs from the build served now.
• Google Play delivers some apps not as a single file but as a set of parts tailored to one device. We merge such a set into a single APK and sign it with our own key — otherwise it would not install at all. The contents are left untouched, and the SHA-256 and fingerprint shown in the listing describe exactly the file you download: those are the ones to compare.
• An important consequence: a package carrying our signature will not install over the same app from Google Play — you have to remove that one first. The certificate fingerprint in the listing tells you whether the signature is ours or the original.

What we do not do

• We do not publish mods or “improved” builds: we never change what is inside an app — not the code, not the resources, not the ads.
• We do not publish mods, cracked builds, versions with licence checks stripped out or with advertising injected.
• We do not require sign-up: there are no accounts and no passwords here at all.
• We do not charge visitors: there are no paid downloads, subscriptions or “faster download” options.

Where the files come from

Files enter the catalog through a keyed upload API, used both by our team and by developers who have been issued a key. An uploaded app does not reach the storefront by itself: first the file is parsed, then descriptions in both languages are written, and only then publishing happens as a separate action.

A file that antivirus engines call malicious is unpublished automatically, with no human in the loop.

What the site knows about you

• No accounts, no passwords — downloading needs no sign-up, so there is nothing for us to store.
• A visitor’s IP address is never written to the database: both the download log and the pageview counter store a hash instead. We do not claim the hash is irreversible — it is computed with a fixed key and the IPv4 space is finite — so we treat it as personal data and keep it for a limited time.
• The site functionally needs exactly one cookie — the chosen interface language. There are no session cookies because there are no sessions: there is nowhere to log in. The colour theme lives in the browser’s localStorage and is never sent anywhere.
• Pageviews are counted by our own counter on this same server: page, country, referral source and an address hash. Third-party visit counters also run on the pages — they collect their own data by their own rules. Neither their data nor ours is tied to a person: there is nothing to tie it to, since a visitor here has neither an account nor a profile.

File checking

Out of 1032 published listings, the served file has been seen by antivirus engines for 50. For another 885 the file is not in the VirusTotal database at all — no engine has ever seen it, and we will not pass that off as a check. 96 are still queued, and their listings say so.

Contacts

Write to us: contact@apploko.com