About the project

What we do

• We accept APK, XAPK and split-APK sets, parse the manifest and print everything that follows from it: version and build code, minimum Android, target API, architectures and the full permission list with dangerous ones marked.
• We compute the file’s SHA-256 and the signing certificate fingerprint — both are visible before download, on the version page.
• We write the description separately in Russian and English: two written texts, not one run through a translator.
• We keep version history: an app with several builds gets a page for all versions and a page for each one, including how it differs from the build served now.
• Google Play delivers some apps not as a single file but as a set of parts tailored to one device. We merge such a set into a single APK and sign it with our own key — otherwise it would not install at all. The contents are left untouched, and the SHA-256 and fingerprint shown in the listing describe exactly the file you download: those are the ones to compare.
• An important consequence: a package carrying our signature will not install over the same app from Google Play — you have to remove that one first. The certificate fingerprint in the listing tells you whether the signature is ours or the original.

What we do not do

• We do not publish mods or “improved” builds: we never change what is inside an app — not the code, not the resources, not the ads.
• We do not publish mods, cracked builds, versions with licence checks stripped out or with advertising injected.
• We do not require sign-up: there are no accounts and no passwords here at all.
• We do not charge visitors: there are no paid downloads, subscriptions or “faster download” options.

Where the files come from

Files enter the catalog through a keyed upload API, used both by our team and by developers who have been issued a key. An uploaded app does not reach the storefront by itself: first the file is parsed, then descriptions in both languages are written, and only then publishing happens as a separate action.

A file that antivirus engines call malicious is unpublished automatically, with no human in the loop.

What the site knows about you

• No accounts, no passwords — downloading needs no sign-up, so there is nothing for us to store.
• A visitor’s IP address is never written to the database: both the download log and the pageview counter store a hash instead. We do not claim the hash is irreversible — it is computed with a fixed key and the IPv4 space is finite — so we treat it as personal data and keep it for a limited time.
• The site functionally needs exactly one cookie — the chosen interface language. There are no session cookies because there are no sessions: there is nowhere to log in. The colour theme lives in the browser’s localStorage and is never sent anywhere.
• Pageviews are counted by our own counter on this same server: page, country, referral source and an address hash. Third-party visit counters also run on the pages — they collect their own data by their own rules. Neither their data nor ours is tied to a person: there is nothing to tie it to, since a visitor here has neither an account nor a profile.

File checking

Out of 1043 published listings, the served file has been seen by antivirus engines for 1029. For another 0 the file is not in the VirusTotal database at all — no engine has ever seen it, and we will not pass that off as a check. 0 are still queued, and their listings say so.

Contacts

Write to us: contact@apploko.com