Audit device fingerprinting signals on iOS and iPadOS

Loupe is an iOS and iPadOS app that gives a hands-on tour of the device fingerprinting surface exposed by public iOS APIs - the same ones any third-party app can call. It reads real values from those APIs and shows them to you raw, without aggregation or hashing, so you can see exactly what your iPhone quietly exposes and why each individual reading helps an app recognize you again across sessions. The premise, stated directly by the source: trackers don't need your name, email, or location to recognize you online - no single reading is necessarily unique on its own, but together they form a fingerprint that follows you across apps and websites.

Loupe groups every signal into three tiers by cost of access: Passive (visible to any app with no prompt at all - locale, time zone, screen, battery, and more), Needs Permission (readings that trigger an iOS system prompt - contacts, photos, location, calendars), and Advanced (clever side-channel uses of public APIs, such as URL-scheme probing via canOpenURL and Keychain persistence across app reinstalls). It also builds for macOS, though the source notes the Mac version is mostly complete but not yet fully polished. The app itself was written almost entirely by AI coding tools, as the source discloses directly.

Use Loupe to understand, concretely and on your own device, what data points a third-party iOS app can gather about you without any special permissions (the Passive tier), what triggers an explicit permission prompt, and what less-obvious side channels (URL-scheme probing, Keychain persistence) exist beyond the obvious permission-gated APIs. It's a fit for privacy-curious users, security researchers, and developers who want a concrete, hands-on demonstration of iOS device fingerprinting rather than an abstract explanation.

It is an educational and inspection tool, not a protective one - it shows you what's exposed, it doesn't block or reduce it. For actual anti-fingerprinting protection while browsing, the source points to Mysk's separate product, Psylo, a privacy-first browser with proxy-backed browsing and isolated tabs.

Input is simply running the app on an iOS/iPadOS device or simulator - no configuration needed to see the readings. To build from source, open code/Loupe.xcodeproj in Xcode 26+, copy code/Config/Signing.local.xcconfig.example to code/Config/Signing.local.xcconfig and fill in your own DEVELOPMENT_TEAM and bundle identifiers (gitignored, never published), then build and run. The project uses Xcode's buildable folders, so new Swift files are picked up automatically without editing the project file.

Output is an in-app display of each signal's raw value, grouped by tier. Nothing Loupe reads leaves the device unless the user explicitly exports it - values are never uploaded, synced, hashed, or shared.

Loupe reads directly from public iOS and iPadOS system APIs (locale, time zone, screen, battery, contacts, photos, location, calendars, URL-scheme handling, Keychain) with no external service integration or network calls beyond an explicit user-initiated export. It's a standalone Swift/Xcode project with no dependency on a backend.

Privacy-conscious iPhone and iPad users, security researchers, and app developers who want to see, in concrete and raw terms, exactly what a third-party app can learn about their device through public APIs - and, by extension, anyone deciding whether they need stronger anti-fingerprinting protection like a dedicated privacy browser. It is licensed under MIT for the source code (the name, logo, and design assets are not covered).