You shouldn't have to trust us. You should be able to verify.

Status: the repositories below publish at launch. This page describes what you will be able to verify once they are live.

Why we will open-source the mobile apps

A KnytX mobile install asks you for permissions that very few apps should ever ask for. It reads your incoming calls, reads your incoming SMS, runs a foreground service, listens for boot, and (on Executive plans) accesses camera and microphone for biometric enrollment.

Those are the same permissions a stalkerware app asks for. The difference between us and stalkerware is what the code does with the access. The only honest way to make that difference verifiable is to publish the code.

We will publish:

• Android client — Kotlin, GPLv3, at github.com/knytx.
• iOS client — Swift, GPLv3, at github.com/knytx.
• Browser extension if and when we ship one — GPLv3.

We do not publish:

• The Rust backend (closed source). This is where the broker-removal templates, the dark-web vendor integrations, the scoring algorithms, and the ML models live. Releasing those would let bad actors evade our detection logic without informing real users.
• The ONNX biometric models. Those are derived from third-party research weights and bound by upstream licenses.
• The web dashboard (Next.js). Less load-bearing on permissions, but still proprietary for the same operational-security reasons as the backend.

The line is: anything that asks for permission on your device is open. Anything that runs on our servers is closed but documented. API behaviour is documented. Contact security@knytx.com to request the OpenAPI specification, which describes every request the mobile app can make of the backend.

Reproducible builds

A reproducible build means anyone, anywhere, can compile the source code and get a binary. That binary is byte-for-byte identical to the one we ship to the Play Store or App Store. If they are not identical, something has been added, and you should not install our binary.

We make this verifiable:

1. Each release tag in github.com/knytx will be signed.
2. CI builds the release artefact from the tagged commit using a pinned toolchain.
3. The build hash (SHA-256 of the APK and IPA respectively) is published in the release notes on GitHub.
4. The Play Store and App Store binaries we publish are the same artefact CI produced, with the same hash.

To verify, you:

1. Clone the repo at the tag.
2. Run the documented build (./scripts/reproducible-build.sh).
3. Compare the SHA-256 of your output with the SHA-256 in the GitHub release notes.

If they do not match, please report it to security@knytx.com and to the wider security community. A diverging hash means one of three things: our build infrastructure was compromised, a CI race condition introduced non-determinism, or the published binary is not from this source. Any of those is a vulnerability we want fixed immediately.

This commitment is in scope of our security disclosure policy.

Audit history and cadence

• Pre-launch audit. Before the first public release, an independent firm reviews the mobile codebases for the obvious categories. Those are permission misuse, network egress to undisclosed endpoints, insecure storage of credentials or biometric material, and side-channel leaks via logs or analytics.
• Annual paid audit. Every twelve months thereafter, we commission a fresh audit. We rotate the auditor every two cycles to avoid familiarity bias.
• Community audit, anytime. Once the code is public, our disclosure policy covers researchers acting in good faith. We welcome reports.

Audit reports are published in redacted form (with vendor-specific identifying information removed when the auditor requires it) within 60 days of receipt. Findings are tracked in public issues where they can be discussed without operational risk; sensitive findings are tracked privately until remediated, then published.

What the apps actually do — quick reference

For the impatient, here is a one-line description of every permission and what the code does with it. The full disclosure with code references lives at /legal/mobile-permissions/.

The Play Store and App Store privacy labels reflect this exact list. If a privacy label diverges, the GitHub README is the source of truth.

The promise that survives us

If KnytX is ever sold, acquired, or otherwise changes hands, the open-source mobile clients under GPLv3 remain free for anyone to maintain. Even if every other commitment on this site evaporated, you could still fork the mobile clients. They would keep running against any compatible backend, including a self-hosted one, if someone built it.

GPLv3 makes this a legal entitlement, not a corporate promise. We chose it on purpose.

What we ask from contributors

Once the repos are live, they accept pull requests under the standard fork-and-PR flow. By contributing, you agree that your contribution is licensed under GPLv3. We do not require a CLA. We do not relicense your contributions. We do not have a dual-licensing scheme that lets us monetise the open-source code outside GPL terms.

For security disclosures, please read our security disclosure policy before opening a public issue. We prefer private disclosure first.

The audit trail applies to the KnytX mobile app — the primary surface where these open-source components run.

Questions

Repository, build, or audit questions: security@knytx.com. License or contribution questions: legal@knytx.com.