Developers & researchers

Data & API

Which outside companies Android apps contact, observed on real phones by PingBill users who chose to share their receipts. Free to use under the Open Database License.

What's in it

Per app: the companies it contacted, the share of sessions in which each was seen, contacts per minute, the domains involved and the app versions observed.
Per company and per domain: the apps that contact it.
εxodus Privacy tracker IDs, so observed contacts can be linked to εxodus's static analysis.

An app is published only once receipts from 3 different phones exist, and a company or domain is listed for it only if 2 phones saw it. Receipts, receipt IDs and install IDs are never published. Shared receipts contain no IP addresses, times of day or device identifiers, and unknown domains arrive as the site only (example.com), so personal subdomains never leave the phone.

Endpoints

Base URL https://api.applabs.llc. Full reference: API docs (group pingbill).

Endpoint	Key	Returns
`GET /pingbill/v1/meta`	optional	Definitions, thresholds, licence, totals
`GET /pingbill/v1/apps/{package}`	optional	One app's companies, domains and versions
`GET /pingbill/v1/companies/{id}`	optional	The apps that contact a company
`GET /pingbill/v1/domains/{host}`	optional	Who runs a domain, and which apps contact it
`GET /pingbill/v1/apps`	required	Search and list apps
`GET /pingbill/v1/companies`	required	Search and list companies
`GET /pingbill/v1/export/app-companies.csv`	required	Every app × company pair (bulk download)

Without a key: 60 requests an hour per IP address. With a key (header X-API-Key): 5,000 an hour.

Get an API key

Create an account, then a key. The key is shown once, so store it safely.

# 1. Sign up (password 8–72 characters); the answer includes an accessToken
curl -X POST https://api.applabs.llc/pingbill/v1/auth/signup \
  -H 'Content-Type: application/json' \
  -d '{"email":"you@example.com","password":"…"}'

# 2. Create a key with that access token
curl -X POST https://api.applabs.llc/pingbill/v1/api-keys \
  -H 'Authorization: Bearer ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name":"my research project"}'

# 3. Use it
curl https://api.applabs.llc/pingbill/v1/apps?search=flashlight \
  -H 'X-API-Key: ak_…'

Already have an account? Sign in with POST /pingbill/v1/auth/login instead of step 1. List your keys with GET /pingbill/v1/api-keys and revoke one with DELETE /pingbill/v1/api-keys/{id}.

Licence and credit

The data is available under the Open Database License 1.0. Credit it as “PingBill by AppLabs; tracker categories from εxodus Privacy”.

What the data can and can't tell you. It shows what PingBill users' phones observed during their sessions, not everything an app can do: connections opened before a session, trackers reached by hard-coded address and companies not in PingBill's database are missing. Company names come from εxodus Privacy's tracker list and a small AppLabs list.

Questions, or a correction about an app or company: mail@applabs.llc