In short: Apps on Android — and to a lesser extent on iOS — can retrieve the full list of programs installed on your device. This reveals far more than you might expect: your financial habits, health interests, personal life, and the fact that you use a VPN. A 2026 security audit found that several major popular applications specifically scan for installed VPN clients and transmit that data to their own servers. VPN does not close this channel — it protects the network and hides your IP address, while app inventory is read locally on the device itself. You can limit collection through OS permissions and digital hygiene — the specific steps are below.
What Is Happening: Apps Are Reading Your Installed App List
This is not a theoretical risk. In April 2026, the research firm RKS Global published an audit titled "Detecting Surveillance in 30 Popular Apps," using static analysis of APK binaries across 68 control points. The result was striking: 7 of the 30 apps retrieved the full list of installed VPN clients and other software on the device. Some of them, according to network traffic analysis, transmitted that data to their own servers.
The scale goes beyond a single audit. Research on the Google Play ecosystem found that approximately 30% of apps (around 4,214 samples in the dataset) make use of Installed Application Monitoring (IAM) calls — methods for enumerating what is installed on a device. Historically, some of these calls did not require explicit user permission, making this channel essentially invisible to the person being profiled.
How is this technically possible — and why do developers use it? The next section explains the mechanism.
How an App Learns What You Have Installed
The mechanism differs significantly between Android and iOS. Android has historically been more open; iOS imposes stricter architectural limits.
Android: QUERY_ALL_PACKAGES and Intent Tricks
On Android, the key permission is QUERY_ALL_PACKAGES. It literally allows an app to retrieve the full list of installed software on the device. Before Android 11, this permission required no explicit declaration: any app could call PackageManager.getInstalledPackages() and receive a complete inventory.
With the release of Android 11 (2020), Google restricted package visibility: by default, an app now sees only the packages it explicitly declares interactions with in its manifest. QUERY_ALL_PACKAGES was retained, but Google Play policy formally permits it only for apps that need the full list for core functionality — antivirus tools, launchers, and file managers.
In practice, the restriction is circumvented in several ways. First, an app can explicitly declare QUERY_ALL_PACKAGES in its manifest and pass the Play Store review — often with vague justification. Second, using an ACTION_MAIN Intent filter with CATEGORY_LAUNCHER retrieves apps that have a home-screen icon, covering the majority of user-facing programs. Third, some IAM calls historically worked without a user-facing permission dialog, even if declared in the manifest.
You can check whether a specific app has permission to see all installed packages at Settings → Apps → [app name] → Permissions. For a broader guide on which permissions deserve review, see the article Dangerous App Permissions: Which to Check and How.
iPhone/iOS: canOpenURL and the App Privacy Report
On iOS the situation is fundamentally different. Apple does not provide an open API for retrieving a list of installed applications — a developer cannot call anything analogous to getInstalledPackages() and receive a full inventory. This is an architectural constraint, not just a policy.
The one remaining tool is the canOpenURL method, which lets an app check whether another app with a specific URL scheme is installed — for example, instagram:// or telegram://. Since iOS 9, Apple has capped this at no more than 50 schemes declared in the app's Info.plist. This is targeted probing of individual apps, not a complete inventory sweep.
The use of canOpenURL is logged in the App Privacy Report — a built-in iOS tool that records which data types and URL schemes your apps have accessed. For a detailed breakdown of what this report shows, see the article iPhone App Privacy Report: What It Shows and How to Use It.
The takeaway: on iOS this channel exists but is significantly narrower. On Android it is considerably broader and harder for users to control.
What Your App List Reveals About You
The list of installed programs is, in a sense, a detailed profile of the device owner. The combination of apps tells observers:
- Financial position: a premium banking app, a brokerage, a crypto wallet, or conversely a payday loan app — reliable indicators of income level and financial behaviour.
- Health and lifestyle: medical apps, nutrition diaries, sleep trackers, pharmacy apps — indirect indicators of chronic conditions or specific health interests.
- Personal life: dating apps reveal relationship status; children's apps indicate a child in the household.
- Political or religious affiliations: specialised news aggregators, prayer apps, advocacy organisation apps.
- Profession and interests: IDEs and DevTools point to a developer; design tools to a UX specialist; trading terminals to an active investor.
- VPN use: the VPN client itself is part of the inventory other apps can see. An app can record that a specific VPN client is installed and include that in its analytics data.
A documented example: the Indian lending app Kreditbee (over 50 million downloads) was found by researchers to be probing for the presence of 860 specific apps on users' devices. This is not a hypothetical threat — it is documented large-scale profiling through app inventory, capable of inferring gender, language, age, and behavioural characteristics from installed software alone.
App inventory profiling is a distinct surveillance vector that complements other identification techniques — including browser fingerprinting, covered in the article Browser Fingerprinting: What It Is and How to Protect Yourself. Both methods work without cookies and without an IP address, making them resistant to standard privacy measures.
What Apps See and Whether VPN Protects Against It
Before moving to practical steps, it is worth drawing a clear line between what VPN can and cannot address — this is not a shortcoming but a matter of different jobs.
| What the App Does | What It Reveals | Does VPN Protect? |
|---|---|---|
| Reads the installed package list via QUERY_ALL_PACKAGES or IAM calls | Full profile: interests, finances, habits, presence of a VPN client | No — this is local OS access; VPN is not involved |
| Detects a specific VPN client via package visibility | That you use a VPN and which client | No — data is read directly from the device, not over the network |
| Collects advertising ID (GAID/IDFA) to link profiles across apps | A persistent cross-app tracking identifier | No — the ad ID is network-independent (see: How to Disable Ad ID Tracking) |
| Determines your real IP address, carrier, and city via network requests | Geolocation, carrier name, connection type | Yes — VPN substitutes the server's IP, hiding your real address and carrier |
| Intercepts unencrypted traffic on open Wi-Fi | Pages visited, form data, session tokens | Yes — all traffic passes through an encrypted tunnel |
| Monitors DNS queries at the ISP level | Which domains you visit | Yes — DNS queries travel inside the tunnel; your ISP cannot see them |
Does VPN Protect Against App List Reading — Honestly
Direct answer: no, and that is by design — VPN solves a different problem. A virtual private network works at the network layer: it encrypts outgoing traffic, hides your IP address from websites and services, protects data from interception on public networks, and conceals your DNS queries from your ISP. All of this happens outside the device itself, in the communication channel.
The installed app list is read inside the device, at the operating system level — before any traffic leaves the phone. The VPN client does not sit between the OS and other apps; it sits between the device and the internet.
For a full breakdown of what VPN genuinely protects against and what it does not, read the dedicated article: What a VPN Protects Against — and What It Does Not.
The sensible minimum is to address both attack surfaces simultaneously: hand the network surface to a VPN, and keep the local data layer under permission hygiene. For the network layer on Android: LiMP VPN for Android — WireGuard and IKEv2 protocols, no logs.
Checklist: How to Limit App Inventory Data Collection
- Review app permissions on Android. Settings → Apps → [select app] → Permissions. Revoke access to "All apps" for any application that does not need it for its core function. Be wary of marketplaces or messaging apps requesting full package visibility without explanation. A detailed review guide: Dangerous App Permissions: Which to Check.
- Reset or limit your advertising ID. On Android: Settings → Privacy → Ads → Delete advertising ID (Android 12+), or reset it and enable "Opt out of interest-based ads." The ad ID connects your inventory profile to everything else. More detail: Advertising ID: How to Disable Tracking.
- Keep your OS updated. Android 11 and later restrict package visibility by default. Security updates patch vulnerabilities through which older IAM calls worked without explicit permissions.
- Minimise your installed app footprint. Every app you install can potentially be enumerated by others. If functionality is available in a browser, use the web version rather than installing the app.
- Use a work profile for sensitive apps. Android lets you create an isolated work profile (via Settings → System → Multiple users). Apps in the work profile cannot see apps in the personal profile — and vice versa.
- On iPhone: check the App Privacy Report regularly. Settings → Privacy & Security → App Privacy Report. This shows which URL schemes your apps have accessed via
canOpenURL. Also restrict tracking: Settings → Privacy → Tracking → disable "Allow Apps to Request to Track." Full details: iPhone App Privacy Report. - Cover the network layer with a VPN. App inventory is a local layer — VPN does not close it. But VPN closes what the inventory leaves open: your IP address, traffic on public networks, DNS queries. Both layers matter — LiMP VPN for Android handles the network one.
Frequently Asked Questions
Can an app find out that I have a specific VPN installed?
Yes. If an app has package visibility via QUERY_ALL_PACKAGES or IAM calls, it sees everything installed — including VPN clients. Some apps also probe for specific known packages using Intent filters. A 2026 security audit found at least several major popular apps are already doing exactly this.
Does iOS read the app list the same way Android does?
No. iOS architecturally does not provide an open list of installed applications. The only available method is canOpenURL, capped at 50 URL schemes — a much narrower channel than Android, but not zero. Use of this method is logged in the iOS App Privacy Report.
If I delete an app, does the record that it was installed disappear?
Locally, yes — the package entry disappears from the device inventory immediately after deletion. But if the data was already transmitted to the app's server while it was running, deleting it from your phone does not retract those server-side records.
Does incognito mode or clearing the cache help?
No. Incognito mode and browser cache clearing affect browsing history — a completely different mechanism. Installed app inventory is system-level information, unrelated to the browser and unaffected by its settings.
Is it legal for apps to collect your app list?
Google Play policy permits QUERY_ALL_PACKAGES only for apps that need it for core functionality. Outside that framework it is a grey area. Under GDPR (EU) and CCPA (California), a list of installed applications may qualify as personal data requiring a legal basis and, in some cases, explicit consent. Enforcement in this area is still developing across jurisdictions.
Should I delete marketplaces and government apps because of this?
Not necessarily. The practical approach: minimise your app footprint where a browser version works just as well; review and revoke unnecessary permissions; keep the OS up to date; and use a work profile to isolate sensitive apps from the general pool.