<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Implementing Mobile App Privacy Audit

## Exodus Privacy
```bash
exodus-standalone target.apk              # Detect trackers + permissions
# Output: tracker list, permission list, scores
# https://exodus-privacy.eu.org/en/
```

## Frida Privacy Monitoring
```javascript
// Monitor location access
Java.perform(function() {
    var LM = Java.use("android.location.LocationManager");
    LM.getLastKnownLocation.overload('java.lang.String').implementation =
        function(provider) {
            var loc = this.getLastKnownLocation(provider);
            if (loc) console.log("[LOCATION] " + loc.getLatitude()
                + "," + loc.getLongitude());
            return loc;
        };
});

// Monitor advertising ID access
Java.perform(function() {
    var AIC = Java.use("com.google.android.gms.ads.identifier.AdvertisingIdClient");
    AIC.getAdvertisingIdInfo.implementation = function(ctx) {
        console.log("[PRIVACY] AdvertisingIdClient.getAdvertisingIdInfo called");
        return this.getAdvertisingIdInfo(ctx);
    };
});

// Monitor ContentResolver queries (contacts, calendar, SMS)
Java.perform(function() {
    var CR = Java.use("android.content.ContentResolver");
    CR.query.overload('android.net.Uri', '[Ljava.lang.String;',
        'java.lang.String', '[Ljava.lang.String;', 'java.lang.String')
        .implementation = function(uri, proj, sel, args, sort) {
            console.log("[QUERY] " + uri.toString());
            return this.query(uri, proj, sel, args, sort);
        };
});
```

## PII Detection Patterns
| Type | Regex Pattern |
|------|--------------|
| Email | `[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}` |
| Phone (US) | `\b\d{3}[-.]?\d{3}[-.]?\d{4}\b` |
| IMEI | `\b\d{15}\b` |
| MAC Address | `([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}` |
| GPS Coords | `-?\d{1,3}\.\d{4,}` |
| SSN | `\b\d{3}-\d{2}-\d{4}\b` |

## GDPR Compliance Checklist
| Requirement | Article | Check |
|-------------|---------|-------|
| Lawful basis | Art. 6 | Consent before processing |
| Purpose limitation | Art. 5(1)(b) | Data used only for stated purpose |
| Data minimization | Art. 5(1)(c) | Only necessary data collected |
| Storage limitation | Art. 5(1)(e) | Data retention policy enforced |
| Right to erasure | Art. 17 | Account deletion available |
| Data portability | Art. 20 | Data export feature |
| Privacy by design | Art. 25 | Default privacy settings |

## mitmproxy PII Detection
```bash
mitmproxy --mode regular -s pii_detector.py   # Custom addon
mitmdump -r capture.flow | grep -iE 'email|phone|device_id|latitude'
```
