# LibreFind: matching the apps on your phone against a community database of FOSS alternatives > LibreFind is an Android app that scans the packages installed on your device and checks them against a crowdsourced database in order to flag proprietary software and pair it with an open-source alternative. It is community-driven, it needs a restricted permission to see your app list, and its authors have stated that it will stop working on certified Android devices once Google requires developer identity. **jksalcedo/librefind** — Discover and replace proprietary apps with FOSS alternatives - Repository: https://github.com/jksalcedo/librefind - Stars: 806 · Forks: 20 - Language: Kotlin - License: GPL-3.0 - Published: 2026-10-20 · Updated: 2026-10-20 · Language: en - Canonical page: https://hysenlabs.com/projects/jksalcedo-librefind ## What the app actually checks LibreFind is a free, lightweight, community-driven Android app designed to help you de-Google your device. The mechanism it describes is simple: it scans your installed packages locally and queries an open-source database to flag proprietary software, pairing each match with a privacy-respecting FOSS alternative. The local scan is the part that makes it useful as an audit rather than a catalogue. The application list on a phone is the ground truth of what you have actually installed, including the trackers that shipped with a system image and the apps whose presence you had forgotten. Reading that list on the device and then comparing it against a shared database gives you two things at once: a list of what is proprietary, and a list of what to do about it. The database is described as open source and crowdsourced, and the app's own framing is the de-Google goal rather than a general app store. The output of the scan is a personal sovereignty score, which is the README's name for the summary of how much of your installed software is proprietary. That score is only as meaningful as the database, and the database only as meaningful as the people maintaining it. Which is why the community half of the application is not a social feature bolted onto a scanner but the mechanism that keeps the data current. ## The five features and how they divide The core features split into five areas, and it helps to see them as a workflow. The local device scanner audits the installed apps entirely on-device to calculate the sovereignty score. Discover is the global database search, letting you look up any FOSS or proprietary app directly in the database to plan the next step of a setup, before you have even installed anything. Alternative recommendations is the browse view, where community-vetted open-source alternatives are listed against the software they replace. The Hub is the community area, where pending app submissions are viewed, reviewed and interacted with, and the README's description of it is that it helps maintain the database's integrity. The fifth feature is gamified progression: contributions earn points, and those points come with community rank badges named Scout, Pathfinder, Guide, Curator and Vanguard, which appear on the profile. The screenshots in the README line up with that structure, showing a dashboard for scanning and the score, a discover screen for searching the database, an alternatives list, the community tab, a submission screen and a profile. The progression feature is the design choice most likely to divide opinion, and it is also the mechanism that gets a database built: giving contributors visible status is how you turn a maintenance chore into something people want to do. ## How the community side maintains the database The contribution model is described in four verbs, and they map onto the four ways a user can improve the data. Discover and vote lets people upvote high-quality open-source recommendations so the best alternatives rise to the top. Proposing new pairings lets a user suggest a FOSS alternative for a proprietary app directly from their device, which is the single most valuable contribution, since it starts from a real need. Review and vet means submitting pros, cons and detailed feedback for existing alternative profiles, which is what stops a pairing from being a bare name. Moderating the pending queue means using the community tab to peer-review pending entries before they go live globally. Contributions can be made inside the Android client, and the README also points at a web version at librefind-submission.web.app, which is where you would go if you were not holding the phone. The division of labour between the two surfaces is sensible. Reviewing a queue and writing detailed feedback are activities that want a keyboard, and an on-device contribution that starts from an app you just installed wants to be one tap from the scan that showed you the problem. The same database serves both. The trust model underneath is peer review rather than editorial control. A pending entry is visible to other users before it becomes global, and votes and reviews determine the ranking. That scales better than a maintainer approving every row, and it means the quality of the data is a function of how many people are reviewing. ## Where to get it and what it takes to run LibreFind is distributed through the channels that serve the de-Google audience, and the README links each of them. It is on F-Droid and on IzzyOnDroid, it has a GitHub releases page with an APK download badge, and it is available through Obtainium and through Zapstore. Obtainium in particular exists to install and update applications directly from their source, which fits a project whose whole point is sideloading rather than depending on a store account. The technical floor is modest. The badge in the README states a minimum SDK of 24, and the platform is Android, written in Kotlin. The repository is a conventional Gradle project with build.gradle.kts, settings.gradle.kts, a gradlew wrapper and a gradle directory, plus version.properties and signers.json for release signing, a fastlane directory holding the store metadata and the screenshots the README embeds, and an app directory for the client code. Continuous integration is configured through the .github directory, and one of the workflows is a CodeQL analysis, which is the security scanning GitHub provides. A .forgejo directory and a .weblate directory sit alongside it, the first for the alternative forge and the second for translation, and the presence of both says the project wants its contributors to be able to work on their own infrastructure. ## The two permissions and the Supabase backend The README lists the required permissions, and the list is short and specific. The first is QUERY_ALL_PACKAGES, described as used strictly to scan the local application list for proprietary tracking components, and flagged as a restricted permission. On modern Android this permission is not granted at install time: the user has to allow it from the app settings, and Google applies distribution rules to apps that request it. For an audit tool, it is the permission that makes the whole thing possible, because without it the app cannot enumerate what is installed. The second is INTERNET, used to check app configurations against the project's decentralised Supabase database. That is the network half of the design, and the split is worth noticing: the scan itself is on-device, and only the lookup against the shared database needs a connection. The supabase directory in the repository holds the database side, which means the backend configuration travels with the code and a self-hosted or alternative instance is at least conceivable. The project describes the database as decentralised, which is the right description for a community-owned dataset: the data belongs to the contributors rather than to a company's account. ## The 2027 identity requirement and what it means for the app The most consequential paragraph in the README is the callout about Google, and it deserves to be read as a statement about distribution rather than about the code. The notice says that Google has announced that, starting in 2026/2027, all apps on certified Android devices will require the developer to submit personal identity details directly to Google. Since the developers of this app do not agree to that requirement, the app will no longer work on certified Android devices after that time. The README links to keepandroidopen.org for the background on the campaign around it. The mechanism is straightforward. A certified device is one that carries Google's proprietary services, and shipping on it means accepting Google's terms for distribution. An app that refuses the identity requirement loses that channel, and therefore has to be sideloaded, or installed from the alternative stores, or run on a device without certification. For the project, the practical effect is a forced redistribution shift rather than a change of purpose. The channels it already uses, F-Droid, IzzyOnDroid, Obtainium and Zapstore, are exactly the ones that do not require the identity submission, which is why the README links all of them and why a badge points at Obtainium as a first-class option. For a user, it means the app's future is tied to whether sideloaded applications continue to work on their device, and to whether the alternative stores keep serving it. ## Where LibreFind is the wrong tool The first limitation is the coverage of the database, and it is inherent to the design. Detection works by matching a package you have installed against an entry in a community-maintained table. An application that is proprietary, that tracks you and that nobody has entered is not flagged, and the sovereignty score rewards you for a device full of software that happens to be missing from the list. The score is a measure of the intersection of your device and the database, and reading it as anything more is a mistake. The second limitation is the matching itself. The tool identifies installed packages, so an application that is proprietary in its data handling but distributed under a free licence, or a free application with proprietary components, sits in a category the package list cannot express. The third is the permission. QUERY_ALL_PACKAGES is a restricted permission, so the first run of the scan is not a one-tap operation, and the permission exists in a category that platform vendors and store policies have been tightening. For a user on a managed device, the app may simply not be usable. The fourth is the platform. LibreFind is an Android application, and there is no equivalent here for iOS, where the equivalent question is answered by the system settings and by what the platform blocks by default. A reader looking for a cross-platform audit tool will not find one here. ## Licence, governance and release cadence The repository is licensed under GPL-3.0, with a LICENSE file at the root, and the project ships the usual governance files alongside it: CONTRIBUTING.md, SECURITY.md and a POLICY.md that presumably covers how the community handles submissions and moderation. The GPL is the right licence for a project in this category, since it guarantees that a modified build stays open and that the community's contributions cannot be closed off. One small inconsistency is worth noting for anyone checking the licence from the README rather than the repository: the licence badge in the README carries an MIT logo, while the project's licence metadata and the LICENSE file say GPL-3.0. The file and the metadata agree with each other, so the badge is the odd one out, and it is the kind of detail that a legal review of a fork would raise on its own. The release history shows steady work. v1.2.1 was published on 2026-10-10, v1.2.0 on 2026-09-27 and a v1.2.0 beta on 2026-09-15, and the last push to the repository was on 2026-10-17. The project is not archived, and with a two to three week cadence across the 1.2 line it is being maintained actively. ## Conclusion Adopt LibreFind if you want an inventory of the proprietary software on your own device and a concrete replacement for each item, and you are willing to grant a restricted package-query permission and to contribute the gaps you find. Do not adopt it on a certified device you intend to keep on Google's distribution model, because the project's own notice says the app will stop working there once developer identity submission becomes mandatory. Verify first that the apps you care about are present in the database, since a clean scan only means nothing was matched, that the alternative suggested for each one is maintained, and that the store you install from still serves the build after the identity requirement takes effect. ## FAQ ### What permissions does LibreFind need on Android? Two. QUERY_ALL_PACKAGES, a restricted permission, is used to scan the local application list, and INTERNET is used to check app configurations against the decentralised Supabase database. Because the first is restricted, it has to be granted from the system settings rather than at install time. ### Will LibreFind keep working on my phone after 2027? Not on certified devices, according to the project's own notice. Google has announced that apps on certified devices will require developers to submit personal identity details, and since the developers of LibreFind do not agree to that requirement, the app will no longer work on certified Android devices after that time. ### Where can I install LibreFind from? From F-Droid, IzzyOnDroid, the GitHub releases page, Obtainium and Zapstore. The application requires a minimum SDK of 24 and is written in Kotlin for Android. ### How do I add an app or an alternative to the LibreFind database? From the app itself you can propose a new pairing for a proprietary app, and the community tab lets you review and vote on pending entries. There is also a web version at librefind-submission.web.app for contributions that need a keyboard. ## Sources - [Issues](https://github.com/jksalcedo/librefind/issues) - [jksalcedo/librefind on GitHub](https://github.com/jksalcedo/librefind) - [License: GPL-3.0](https://github.com/jksalcedo/librefind/blob/main/LICENSE) - [README](https://github.com/jksalcedo/librefind/blob/main/README.md) - [Releases](https://github.com/jksalcedo/librefind/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/jksalcedo-librefind