app-sec.redteam.net

Where does the data go?

Tracker-SDK destinations classified by intelligence-sharing bloc. "Bloc" here means the practical state-collection reach over data that flows to that SDK's backend — not just where the company is founded. See the framework note at the bottom for what each label means.

apps → blocsSankey · width ∝ SDK count · hover for value
bloc share lab-widetracker-instances summed across all apps
bloc reachapps touched per bloc
per-app destinationsstacked bar per app · click row → full profile

Framework

5 Eyes + IL
US, UK, Canada, Australia, New Zealand — plus Israel as the de-facto sixth-eye intel partner. Data reachable via CLOUD Act / FISA 702 / UKUSA. Google, Meta, AppLovin, Sentry, New Relic, AppsFlyer, ironSource, Fyber.
EU 14-Eyes
EU jurisdictions party to 14-Eyes intel sharing — Germany (BND), France (DGSE), Netherlands (AIVD), etc. GDPR-bound but SIGINT-cooperated. Adjust.
China · MSS
CN — 2017 National Intelligence Law obligates every domestic company to support MSS / MPS / PLA-61398 requests on demand. Bytedance/Pangle, Huawei HMS, Tencent (MMKV), TopOn, TradPlus, Mintegral.
Russia · FSB
RU — SORM-3 mandatory traffic tap; 242-FZ data-localization law. Yandex Ad, AppMetrica.
Other state-aligned
India (CERT-In), Korea, Türkiye, Iran. Case-by-case reach. InMobi (IN), Kakao (KR).
Industry-neutral
Trade-association standards with no single data destination. IAB Open Measurement.