<p><b>Startup description</b></p><p>My product is an Android privacy scanner that shows users which trackers and SDKs are embedded in the apps installed on their phone. It scans the device locally, identifies known tracking libraries, and explains in plain language what data each one collects and why it matters.</p><p>I built it as a solo developer after getting frustrated that privacy tools either required root access or just showed permission lists without explaining the actual tracking behaviour. My app does the analysis on-device and adds AI-generated risk explanations so non-technical users understand what they are looking at.</p><p>The app is live on Google Play, currently at version 7.3.8 with 5k+ installs and a 4.5-star rating from 89 reviews. It monetises through a one-time Lifetime unlock and a recurring GUARD subscription tier.</p><p><b>Key highlights:<b></b></b></p><ul> <li>Annual revenue = $1,190</li> <li>Annual profit = $790</li> <li>Churn rate = ~38%</li> <li>LTV = ~$37&nbsp;</li> <li>CAC = ~1.15</li> <li>Business margin ~85%</li> <li>Thousands of app data</li> <li>Tracker Signature Database</li> <li>Pattern Recognizing Machine Learning Modul based on our Data we find ( Trackers, Permissions, Malware, Spyware, fake APKs etc)</li> </ul> <p><b>Team</b></p><p>Solo founder operation. I handle Android development, backend, the website, ASO, content marketing and support. No employees, no contractors, no ongoing salary obligations.</p><p>Everything is documented, and the codebase is written to be handed over. A buyer with Android and basic Cloudflare experience can take over without me. I am available for 30 days of transition support after closing.</p><p><b>Tech Stack</b></p><ul> <li>Kotlin + Jetpack Compose</li> <li>On-device tracker detection engine (proprietary signature database)</li> <li>Google Play Billing for Pro and GUARD subscriptions</li> <li>Install Referrer API for affiliate attribution</li> </ul> <p><b>Backend</b></p><ul> <li>Cloudflare Workers (API layer)</li> <li>Cloudflare D1 (SQLite) for tracker signatures, affiliate data and analytics</li> <li>Real-time Developer Notifications webhook for subscription and refund handling</li> <li>Claude Haiku API for AI-generated risk explanations</li> </ul> <p><b>Website</b></p><ul> <li>Astro 5, deployed on Cloudflare Pages</li> <li>Public scan pages for popular apps, used as SEO landing pages</li> <li>Affiliate dashboard with login</li> <li>Admin dashboard protected by Cloudflare Zero Trust</li> </ul> <p>The whole stack runs on Cloudflare, so infrastructure cost is $5/month. Usage is based on the actual app state, like around 5%, so if the app goes 20x of userbase / scanbase, it will still be $5/month. The API Calls are actually around $20/month but are getting lower over time because of caching. There will also be a limit on API Call costs naturally, because of the caching system.</p><p><b>Marketing and growth</b></p><p>Growth has been 1/3 organic and 2/3 paid ADs.</p><ul> <li>SEO: Public scan pages for well-known apps (messengers, crypto exchanges, social apps) rank for long-tail queries like "which trackers does [app] use". These pages drive 300 visitors/month and convert to installs. 41 scan pages published so far, with the format proven and easily extendable to any app.</li> </ul> <ul> <li>Content: 1 to 2 blog posts per week targeting privacy and tracker keywords. Build in Public posts. A few guestposts. Backlinks on Catalogues etc.</li> </ul> <ul> <li>Communities: Consistent posting on Reddit (r/cybersecurity, r/netsec, r/privacy, r/DroidAppShowcase), X and Indie Hackers. Some reddit posts generated 300k-1M+ views and almost 100 installs, out of them we had 3-4 conversions all within 48h.</li> </ul> <ul> <li>Affiliate program: A complete affiliate system is built and running: referral tracking through the Install Referrer API, an affiliate dashboard, commission calculation, refund handling via webhook, and an admin panel. Creator outreach is underway, with 1 partners onboarded and 0 in the pipeline, including a security creator with 43K followers on X. This channel is built but barely tapped, which is the single biggest immediate upside for a buyer.</li> </ul> <p><b>Revenue and profit</b></p><ul> <li>24 active subscriptions ( 15x monthly / 9x yearly)</li> <li>ARR: $2,075</li> <li>MRR: $180</li> <li>Last 12 months revenue: $1,123</li> <li>Last 12 months profit: $790</li> <li>Profit margin: ~80%</li> <li>Monthly costs: $25 TOTAL. Cloudflare $5, Claude API $20</li> </ul> <p><b>Return on investment</b></p><p>At the current MRR of $180 and monthly costs of $25, net monthly profit is $155. At the asking price of $10,000, payback is roughly 60 months with zero changes to the business. You have to consider that my marketing and scaling abilities are very low; I have almost no budget for advertising. With a good team and a low-to-medium budget, you can achieve payback way faster. The affiliate program could also help with that.</p><p><b>Startup assets<b></b></b></p><p>Everything below is included in the sale:</p><ul> <li>Android app - full Kotlin source code</li> <li>Google Play listing - 4.5</li> <li>Tracker signature database of 172 tracker signatures, the core IP of the product</li> <li>Backend - Cloudflare Workers API and D1 database</li> <li>Dashboard with full analytics / diagramms etc</li> <li>Website&nbsp;</li> <li>Domain</li> <li>Affiliate system - dashboard, tracking, commission engine, admin panel, 1 registered affiliates</li> <li>User base - 1,000 active devices, 24 paying customers</li> <li>Documentation - setup, deployment and architecture docs.</li> </ul> <p><b>Risks</b></p><p>I don't know any. The system is almost automated; only marketing requires a manual touch.</p><p><b>Summary</b></p><p>My app is a profitable Android privacy scanner with 24 paying subscribers, roughly $2,100 ARR, and an ~80% profit margin. But the revenue is not the reason to buy this. The reason is the data underneath it.</p><p><b>The detection dataset is the asset</b></p><p>Over 1 year of development, the app has accumulated a structured, queryable dataset that would take a new entrant years to rebuild:</p><ul> <li>172 tracker signatures mapped to the SDKs they belong to, the data categories they collect, and their corporate owners. This is not a scraped list. Each entry was verified against real APKs. There are another 40+ in the pipeline, but they have to pass our system (a special amount of findings on X different amount of devices have to be tracked to pass into the signatures list)</li> <li>CertNet - 10.000 signing certificates mapped across +7.000 apps, revealing which apps share a publisher even when the store listings hide it. This surfaces relationships that no public registry exposes.</li> <li>SHA-256 and APK hashes for +10.000 app versions, giving a verifiable fingerprint history. A buyer can prove whether a given APK is the official build or a repackaged one, and can trace when tracking behaviour changed between versions.</li> <li>Pattern recognition engine that identifies tracking libraries by structural signature rather than package name, so it still detects SDKs that have been obfuscated or renamed. This is the part competitors cannot copy from a public list.</li> </ul> <p>✅ $1,123 TTM revenue</p><p>✅ 24 customers</p><p>✅ Business model: Freemium+LTD</p><p>✅ Built with JavaScript, Kotlin</p>