Your Texting App Can Track You Without Reading Your Messages

You open your texting app and see something simple:

Your conversations.

Your contacts.

A compose button.

What you usually do not see is everything bundled behind that interface.

Many Android apps include third-party software for things such as:

• advertising
• analytics
• measuring installs
• crash reporting
• performance monitoring

These components are often called trackers.

And here is the part that is easy to miss:

A texting app does not need to upload your actual messages to collect useful information about you.

It can learn plenty from how you use the app, what device you use, when you open it, and how you interact with it.

That does not mean every tracker is malicious.

But it does mean message privacy is only one part of app privacy.

You can see the inbox. You usually cannot see the trackers behind it.

Third-party SDKs are pieces of software developers can include inside their apps.

Some provide useful services.

Others help with advertising or analytics.

When you install an app, Android does not normally show you a screen saying:

This app contains these advertising networks, these analytics systems, and these measurement tools.

They are simply part of the application package.

That is where services such as Exodus Privacy become useful.

Exodus scans Android apps for signatures of known tracking SDKs and makes those findings visible to users.

You can search for Android apps here:

Search apps on Exodus Privacy

It can be an eye-opening exercise.

Not because every detected tracker is necessarily active.

Not because every tracker can read your messages.

But because it lets you see software that is otherwise largely invisible from the normal app interface.

So what can trackers collect?

It depends on the tracker and how the developer uses it.

There is no single tracker that represents all tracking.

Advertising and analytics systems can potentially work with information such as:

• advertising or app identifiers
• IP address
• device model
• Android version
• app version
• language or region
• app launches
• screens viewed
• interactions inside the app
• ad impressions
• ad clicks
• session information
• diagnostic information

Some analytics systems also let developers define their own events.

For example:

User opened Settings.

or:

User used Feature A.

That can help developers understand their product.

Advertising systems can use similar signals for things such as measurement, audience building, or selecting which advertisements to show.

None of this requires reading the words inside your text messages.

Tracking can still matter even when your messages stay private

Imagine a messaging app that never uploads a single SMS body.

That is good.

But suppose the app still reports:

• how often you open it
• which features you use
• what phone model you have
• your Android version
• an advertising identifier
• your IP address
• which advertisements you interacted with

The contents of your conversations may still be private.

But the app can still contribute behavioral and device information to advertising or analytics systems.

Those are two different privacy questions:

Does the app upload my messages?

and:

Does the app collect information about how I use it?

A privacy-focused app should be clear about both.

Does a tracker mean someone is reading your texts?

No.

This distinction is important.

Finding an advertising or analytics SDK inside an SMS app does not prove that your messages are being uploaded to that SDK.

The presence of tracking software tells you that the code exists in the app.

It does not automatically tell you:

• whether that tracker is active
• which exact information it receives
• whether it receives SMS content
• whether every detected component sends data

That depends on the app's implementation and configuration.

In the sources I reviewed for this article, I found no evidence that advertising SDKs automatically receive SMS message bodies.

So if someone says:

This app has trackers, therefore advertisers can read all your texts.

that conclusion is too strong.

But the opposite conclusion is too simplistic as well:

My messages aren't uploaded, therefore there is no tracking.

Both can be wrong.

Why would advertisers care about app usage?

Advertising is rarely just about showing a random banner.

Modern advertising systems can use behavioral and device information for things such as:

• selecting ads
• measuring which ads worked
• deciding how often to show something
• grouping users into audiences
• measuring installs or conversions
• showing offers that may be more relevant to a particular audience

That does not mean an advertiser can control what you buy.

But the information collected about how people behave can influence which:

• ads
• products
• offers
• marketing messages
• content

are presented to them.

That is part of why behavioral data has value.

Why this feels different in a texting app

A calculator collecting usage analytics and a messaging app collecting usage analytics are not automatically doing different technical things.

But the context is different.

Messaging apps operate around some of the most personal information on a phone.

They may need access to:

• SMS and MMS
• phone numbers
• contacts
• notifications
• conversation history

Again, that does not mean an analytics SDK automatically receives those things.

But it is reasonable for users to expect software operating in such a sensitive part of the phone to minimize unrelated data collection.

For me, that is the important privacy principle:

If a messaging app does not need certain telemetry to provide messaging, there is value in simply not collecting it.

"No ads" does not automatically mean "no tracking"

This is another distinction worth understanding.

An app can show no advertisements while still using:

• analytics
• crash reporting
• performance monitoring
• attribution

Those tools can have legitimate purposes.

Crash reporting can help developers fix bugs.

Analytics can help developers understand which features are useful.

Attribution can tell a company where an install came from.

But they still represent information leaving the device.

So:

No ads is one claim.

No analytics is another.

No trackers is another.

They should not be treated as synonyms.

Permissions do not tell you everything either

Android permissions tell you what an app is allowed to access.

For an SMS app, permission to access messages is expected.

It needs that access to function.

But a permission does not tell you what the app sends elsewhere.

And some tracking does not require an alarming permission at all.

An app already knows when:

• it launches
• you open a screen
• you tap a feature
• a session starts
• something crashes

So checking permissions is useful, but it is not a complete privacy audit.

Google makes a similar distinction with the Google Play Data Safety section, which describes developer-declared collection and sharing separately from Android permissions.

Learn about Google Play Data Safety

How can you check the texting app you use?

You do not need to be a developer.

Start with a few simple checks.

Search for it on Exodus Privacy

Go to:

Exodus Privacy reports

Search for the package or app name you use.

Exodus may show:

• known tracker signatures
• tracker categories
• permissions
• analyzed app version
• report date

If you see trackers, you can inspect what Exodus knows about them.

If you see zero trackers, that is useful information too.

But neither result should be treated as the entire privacy story.

Read the app's privacy policy

Look for clear answers to questions such as:

• Does the app collect analytics?
• Does it use advertising?
• Does it use crash reporting?
• Does it upload message content?
• Does it have cloud sync?
• Which third-party services does it use?

A good privacy policy should explain what actually happens.

Check Google Play Data Safety

The Play Store also shows what developers declare about data collection and sharing.

It is useful context.

But it is still a developer-provided disclosure, not a complete independent technical audit.

Look at the business model

Ask a simple question:

How does this app make money?

There is nothing automatically wrong with advertising.

But an ad-supported product naturally has different incentives and technical requirements than an app that does not contain advertising at all.

Understanding the business model helps put the privacy disclosures into context.

What does "0 trackers" actually mean?

This part deserves some honesty too.

Exodus performs static analysis and looks for signatures of known tracker SDKs.

So when Exodus reports:

0 trackers

the precise meaning is:

No known tracker signatures were detected in the analyzed APK.

That is useful independent evidence.

But it does not mean:

• the app can never make a network request
• every possible telemetry system has been ruled out
• the scanner knows every tracker that exists
• every future version of the app will have the same result
• the app has been mathematically proven perfectly private

Exodus itself explains these limitations.

Read the Exodus Privacy FAQ

Privacy evidence is strongest when several things agree:

• independent scanner results
• the privacy policy
• Google Play disclosures
• the app's documented behavior
• the business model

What Exodus currently shows for ZenSMS

ZenSMS also has a public Exodus Privacy report.

You can inspect it yourself here:

ZenSMS on Exodus Privacy

At the time of writing, Exodus reports 0 known tracker signatures in the ZenSMS build it analyzed.

The Exodus report may lag behind the newest Google Play release, so the version and report date matter.

And as explained above, I do not think "0 trackers" should be treated as a magic privacy certificate.

It is one piece of independent evidence.

ZenSMS also publicly states that it includes:

• no advertising SDKs
• no analytics SDKs
• no crash-reporting SDKs
• no automatic usage analytics

ZenSMS does not maintain a cloud copy of your inbox or require a ZenSMS account for messaging.

Optional diagnostics are user-initiated rather than automatically transmitted.

You can read the full policy here:

ZenSMS Privacy Policy

Privacy is bigger than whether somebody reads your messages

For a messaging app, the first privacy question is obvious:

Does this app upload my conversations?

But that should not be the last question.

Also ask:

Does it collect analytics?

Does it contain advertising SDKs?

Does it measure how I use the app?

Does it automatically send crash information?

What does its privacy policy say?

What does an independent scanner find?

A texting app does not need to read your messages to learn something about how you use it.

And that information can still have value for analytics, measurement, profiling, or advertising.

That does not make every tracker malicious.

It does mean that users deserve to know when those systems are present.

Because when an app sits between you and some of your most personal communication, privacy should include what the app chooses not to collect too.