Spyware and stalkerware FAQ

Stalkerware is hidden software that reports on a phone’s messages, calls, location, photos and screen. It is often sold as parental or employee monitoring. Hiding and lack of consent are what make it stalkerware, and the installer is usually someone with access to the phone.

It checks the file hash against about 2,950 known samples and the signing certificate against 470+ vendor keys. It also matches 640+ package names and 900+ spyware servers. If nothing matches, behaviour rules look for signs like hidden icons, accessibility abuse and reading SMS, calls and location together.

No. The scanner and its database run in your browser, and your file is read locally. After a scan, an anonymous result can be shared: the verdict, danger code and package name or hash. Switch sharing off before you scan if you prefer.

No website can. A web page only reads files you give it. To check an Android phone, scan extracted APKs, paste the package list, or use the GuestSpy Android app.

iOS does not let apps see other apps, so no product can scan an iPhone’s app list. GuestSpy checks configuration profiles and walks you through a checklist of accounts, sharing, forwarding and jailbreak signs. Most iPhone monitoring happens through account access and profiles, which the checklist covers.

Clean means nothing matched. Low risk means minor findings that the app’s purpose probably explains. Suspicious means capabilities worth a look, with no family match. Dangerous means a profile that looks like monitoring software. Known stalkerware means a match to a named family. Visible parental apps get a purple Watchware label.

It is a short ID like GS-STK-AND-7685. The parts are class (such as STK stalkerware or WCH watchware), platform (such as AND or IOS) and a family number. Use it to look up the entry in the threat encyclopedia.

It can. Behaviour rules may flag a call recorder, password manager or company MDM agent. Every verdict shows its evidence and confidence, so check whether the app’s purpose explains the rules that fired. A certificate match to a known family is very rarely wrong.

They are labelled watchware (WCH) and shown in purple. They can do much of what stalkerware does, but they stay visible. If you are an adult and did not agree to one, treat it like stalkerware.

Wait if the installer is someone you fear, because removal can alert them. Read the safety page first, export the PDF report and change passwords from a safe device. For support, see stopstalkerware.org or, in the US, call 1-800-799-7233.

On Android, a reset removes user-installed stalkerware unless the phone was rooted. Erasing an iPhone removes apps and profiles. On both, set up as new and change passwords first, or a backup or known password can bring it back.

The name once belonged to a monitoring app in the TheTruthSpy family. That product line is gone, and our scanner flags its builds (com.guest, GS-STK-AND-1405) as stalkerware. The about page has the full story.

It is 100% free. The Web Scanner and both apps have no paid tier, no trial, no account and no scan limit. Every feature, including PDF and JSON export, is open to everyone.

No. We do not sell data or show ads. The privacy policy lists exactly what we store.

The Web Scanner analyses files you give it. The Android app scans every installed app, watches for changes and guides removal. The iPhone app runs the checklist and profile analyzer on the phone.

You can with their knowledge and consent, for example to help a family member or a client. Advocates use it this way. Checking a phone without consent is what this product exists to catch.

Export it from the GuestSpy Android app, use adb pull, or save it with a file manager. The app scanner page has the steps. You can also paste adb shell pm list packages output for a quick name check.

It comes from Echap’s open stalkerware-indicators project (CC-BY 4.0), plus our own rules. To contribute, share the hash and certificate fingerprint from a report’s Identity section in a community report.