A Substack investigation has taken aim at a less visible part of mobile privacy: the list of installed apps on an Android phone. The post argues that several popular Indian apps query far more installed applications than they appear to need, raising questions about profiling, platform policy and user consent.

The article’s basic technical point is important. Since Android 11, Google has restricted how much an app can see about other installed apps. Under the package visibility rules, developers are supposed to declare only the apps that are essential to core functionality. In limited cases such as file managers, browsers and antivirus tools, a broader permission can be granted.

The author says they reviewed the manifest files of around 50 popular Indian apps and found several with extremely large app-query lists. Swiggy, according to the post, listed 154 package names. Zepto listed 165. Kreditbee reportedly checked for 860 installed apps, while Moneyview was described as having 944, the highest in the sample. Cred was the only app the author says appeared to hold the high-risk all-packages permission.

Those numbers matter because they turn a vague privacy concern into a concrete one. A manifest file is not a hidden server-side data set. It is part of the application package and can reveal, at least in principle, what the app is set up to detect. That means the question is not simply whether a company can collect the information, but whether users are being told enough about how much can be inferred from their devices.

The post argues that some of the queries appear legitimate. Payment apps may need to check for other payment apps. Security tools may need to identify cloning or multi-account apps. But the article says some companies appear to go well beyond those use cases. It points to lists that include apps unrelated to payments or security, suggesting that the data may be used for profiling or behavioral inference.

The supplied evidence also says the rider versions of Swiggy and Zepto apps use different query lists. In Swiggy’s case, the article claims the rider app checks for personal-loan, personal-finance and even gaming apps. That would be a more invasive use case if accurate, because it would shift from service compatibility toward employee or contractor monitoring.

Because the source is a single blog post, the reporting should remain cautious. The author’s observations do not by themselves prove improper use, and the excerpt does not show the company responses in full. Still, the post raises a real and specific issue: app-store policy can be bypassed by listing individual package names instead of requesting a broad permission, which may leave users with little visibility into what is being checked.

The broader takeaway is that app privacy is not only about location, microphone and contacts. It is also about metadata revealing the rest of your device. If an app knows what else is installed, it can infer habits, income class, entertainment choices or work status with surprising precision.

That is the real challenge the article surfaces. The installed-app list may look technical, but it can function as a behavioral fingerprint.

Claim-to-source map

  • Android package visibility rules and the manifest-file review methodology are supported by the Substack excerpt.
  • The app counts for Swiggy, Zepto, Kreditbee, Moneyview and Cred are all from the supplied post.
  • The observations about rider-app checks and profiling risk are stated or inferred from the article’s text.