Gander: an offline Android file viewer with zero permissions

The problem Gander picks: viewers that ship your documents to a server

Stock Android viewers are fragmented by format. A PDF opens in one app, a .docx in another, a spreadsheet in a third, and several of them treat the file as something to upload before they can render it. Gander's premise is that the rendering should happen on the device and that the app should not be able to transmit anything even if it wanted to. The README states the app does not hold the INTERNET permission, which means an upload path is not a policy the user has to trust, it is absent from the manifest. That is a stronger claim than a privacy policy, because it is enforced by the operating system at install time.

The audience is narrow and specific: people who open contracts, medical scans, internal spreadsheets or source files on a phone they do not fully control, and who would rather sideload a 5 MB APK than accept a cloud viewer. It is also for anyone who wants one viewer instead of six, since the supported format list covers documents, spreadsheets, slides, images, video, audio, Markdown and plain text.

How the renderers are wired: WebView, ExoPlayer and a tiled image view

The architecture is not a single engine. According to the supported formats table, PDF goes through pdf.js running offline inside a sandboxed WebView. Word .docx goes through docx-preview, also in a sandboxed WebView. Spreadsheets (.xlsx, .xls, .xlsm, .xlsb, .csv, .ods) go through SheetJS. PowerPoint .pptx goes through PPTXjs. Markdown is rendered by marked with DOMPurify, offline. Video and audio go through Media3 ExoPlayer. Photos use a tiled deep-zoom image view that is EXIF aware, with GIF, SVG, AVIF and ICO handled in the WebView instead.

Two details in that table matter more than the list itself. First, the sandbox: PDF and DOCX parsing runs in a WebView rather than in native Kotlin, which is why the APK ships no native libraries and a single build runs on every architecture. Second, the fallback. Anything not in the table, including files with no extension, offers "View as text", which shows raw content without renaming the file, and large files load 5 MB at a time behind a Show more button. That is a deliberate trade: instant open over a complete parse.

The night mode for PDFs is the most opinionated feature described. It inverts the page while keeping each colour's hue, turns scans and figures over with the text, and leaves photographs as they were printed. Inverting a photograph usually produces a negative; excluding photographs from the transform is the correct call and it is not obvious until you read the screenshot caption.

Installing Gander from the APK and opening a first file

The README gives the install path directly. Gander runs on Android 8.0 (API 26) and up, and viewing PDFs additionally needs Android System WebView 125 or newer, from May 2024. Download the latest APK from the Releases page; the file is named Gander-x.y.apk and runs on every architecture because the app ships no native libraries. Copy it to the phone, tap it, and allow "install unknown apps" when prompted. Play Protect may warn about an unknown developer, which is what a sideloaded open source build looks like.

Step 3 of the README's tester instructions is the one that counts for the Play Store programme: install it, and set it as your default for PDFs. That is also the most useful first action for a normal user, because it routes every PDF tap on the phone into Gander. After that, the first real use is opening a document from outside the app rather than from a file browser inside it. Share a PDF from a chat or mail app into Gander, or tap the file in a file manager and choose Gander as the handler. The share sheet and "Open with" integration is listed as a feature, so the app is meant to be reached this way. A PDF reopens at the page you were reading, however you open it, which the README describes under "Picks up where you left off".

For folder browsing, the app relies on one-time system grants rather than a storage permission. The README does not spell out the grant dialog in the excerpt available, so expect to pick a folder once and see it listed on the home screen next to recent files with thumbnail previews.

Updating is install-over-install: put the new APK over the old one and recents and folder grants survive. The README also points at Obtainium for automatic updates without a store, and the repository contains fastlane metadata, which is the standard layout for store listing assets.

What Gander does not open, and where the promise costs you

Legacy binary .doc and .ppt are not supported. The README is explicit about why: no open-source renderer is both faithful and small enough to bundle. The app explains this and suggests re-saving as .docx or .pptx. Binary .xls does work, which makes the gap inconsistent in a way users will notice: old spreadsheets open, old documents do not.

The second constraint is the WebView dependency for PDFs. Android System WebView 125 or newer is required, and the README notes the app says so when you open a PDF rather than failing quietly. Devices that have stopped receiving WebView updates are therefore not PDF-capable, even though they may meet the API 26 floor. On a phone kept offline on purpose, WebView will not update either, so the PDF path depends on a component the user may be unable to refresh.

Third, the distribution problem is real and the README treats it as such. A personal developer account cannot publish to the Play Store until twelve people have used the app for fourteen continuous days, and the README asks testers to set Gander as the default PDF handler because Google checks genuine use, not just installation. Until that is satisfied, the only install route is an APK, and the README says the GitHub releases are not going anywhere regardless.

Gander compared with MuPDF and the stock Android viewers

The closest comparison is MuPDF, which also renders on device and is open source. The difference is scope and mechanism. MuPDF is a document engine with a viewer attached, focused on PDF and XPS with its own C rendering core, and it is used as a library by other applications. Gander is an application-first viewer that deliberately avoids native libraries, which is what allows one APK to run on every architecture. That choice also explains the format coverage: Gander gets DOCX and PPTX by bundling JavaScript renderers into a WebView, a route MuPDF does not take for those formats.

Against the stock viewers, the difference is the permission model rather than the rendering. A stock PDF viewer may render locally and still hold INTERNET for crash reporting or cloud sync. Gander's About screen asks Android what the app requests and shows the answer next to the full licence text for every bundled library, which is a check the user can run rather than a claim to accept. That screen is the feature that distinguishes it from every privacy-policy-based alternative.

Maintenance, updates and what the MIT licence means here

The repository is not archived, and the last push was on 2026-09-16. Three releases landed in the two weeks before that: v1.15 on 2026-09-06, v1.16 on 2026-09-08, and v1.17 on 2026-09-14. That is a fast cadence for a viewer, and it means the APK you install today will have a successor shortly.

The upgrade cost is low by design. Installing a new APK over the old one preserves recents and folder grants, so there is no migration step and no data to export. There is no server component and no account, so nothing has to be kept in sync. The cost you do carry is the WebView requirement: a device that falls behind on WebView updates loses PDF rendering independently of any Gander release.

Gander is MIT licensed, and the README states the About screen shows the full licence text for every bundled library. MIT is permissive, so redistributing a modified APK is permitted provided the licence and copyright notice travel with it. That is a statement about the licence text, not legal advice; if you plan to ship Gander inside a product, read the bundled library licences the About screen lists rather than assuming the MIT label covers all of them.

Editorial conclusion

Adopt Gander if you handle sensitive documents on Android and want a viewer that cannot upload them, or if you need one app for formats the stock viewers split across several. Skip it if your files are legacy binary .doc and .ppt, if your device runs a WebView older than 125, or if you will not sideload an APK. Before installing, open the About screen and check the permission list it reads back from Android, then set Gander as your default PDF handler, which is the specific action the Play Store testing programme requires.

Frequently asked questions

Official sources

1. License: MIT
2. mokshablr/gander on GitHub
3. Project website
4. README
5. Releases