On integrates 66 third-party SDKs spanning infrastructure, analytics, and attribution. Its App Store privacy label declares cross-app tracking via Purchases, Contact Info, Identifiers, and Usage Data. It collects data linked to your identity including Purchases, Contact Info, User Content, and Identifiers and 1 more category. It includes 3 advertising or attribution SDKs. Whether this is acceptable depends on your personal privacy preferences.

What permissions does On need?

On requests 4 iOS permissions: App Tracking Transparency, Camera, Microphone, and Photo Library.

What data does On collect?

According to its App Store privacy label, On declares cross-app tracking via Purchases, Contact Info, Identifiers, and Usage Data. It collects data linked to your identity including Purchases, Contact Info, User Content, Identifiers, and Usage Data. It collects Search History and Diagnostics not linked to your identity.

How many SDKs does On have?

On integrates 66 third-party SDKs. 3 for attribution, 11 for analytics, 1 for crash reporting, 20 for infrastructure, and 24 for other.

Does On use Google SDKs?

Yes. On includes 14 Google or Firebase SDKs: Firebase App Check Interop, Firebase A/B Testing, Firebase Core, Firebase Remote Config, Firebase Remote Config Interop, Firebase Sessions, Google Data Transport, Firebase Crashlytics, Firebase Core Extension, Firebase Core Internal, Firebase Installations, Firebase Shared Swift, Google Utilities, and FirebaseAppCheck. These are used for cloud infrastructure and services, not advertising.

Does On use App Tracking Transparency?

Yes. On requests the App Tracking Transparency permission, which means it asks for your consent to track your activity across other companies' apps and websites.

Does On access your camera or microphone?

On requests access to both your camera and microphone. The developer says camera access is for "See IntoPlist.strings". Microphone access is for "See IntoPlist.strings". These permissions are only active when you grant them in iOS Settings.

Does On run in the background?

Yes. On registers 1 background mode, which means it can perform certain tasks when you're not actively using it.

What are some alternatives to On?

Other shopping apps include Harbor Freight , AE + Aerie , Afterpay , ALDI Grocery Pickup & Delivery , AliExpress , and Victoria's Secret . Each app takes a different approach to shopping and varies in its data collection and SDK usage.

Shopping · Privacy report

On: Shop Shoes & Apparel

Free · ★4.9 · On AG

Is On safe?

It leans heavily on third-party trackers.

Our take. On is built with more third-party tracking code than 95% of the shopping we have scanned, including an analytics SDK from Germany.

Privacy footprint · vs 80 shoppingHeavy

Trackers from other companies14 · a lot

typical shopping: 5

Data the app links to you5 types · some

typical shopping: 8 · from its own privacy label

What it collects about you

On links 5 categories of your data to you.

From the developer's own App Store privacy label. These are the kinds of data On ties to your identity, and it also declares it shares data to track you across other apps.

PurchasesContact InfoUser ContentIdentifiersUsage Data

Who else is inside

It carries trackers from 4 companies.

Third-party SDKs found in the app, matched to the company that publishes each. Present in the code; we do not observe what they transmit.

🇺🇸GoogleAnalytics

Firebase, AdMob and Google analytics SDKs, built to record how you use the app and serve ads.

SDKs

🇩🇪AdjustAttribution · Germany

Marketing attribution, built to tie installs and in app events back to ad campaigns.

SDKs

🇺🇸AmplitudeAnalytics

Product analytics, built to record detailed behaviour inside the app.

SDKs

🏢Other third partiesanalytics

A third-party SDK.

SDKs

How it compares

Where it sits among shopping.

Every one of these apps we have scanned, on the two measures above: third-party trackers it carries (across) and data it links to you on its own label (up). Toward the top right is more invasive.

Each dot is one shopping app. On sits to the right, carrying more third-party tracking than most.

Other signals

Two more flags.

Each is a fact read straight from the app. The same checks run on every app we scan. Only the ones that apply here are shown.

It declares cross-app tracking

Its own App Store label says it tracks you across other companies apps and websites using your advertising identifier.

It sends analytics to a company in Germany

Adjust is a Germany company. Its analytics SDK is built into the app.

The evidence

What it's built from.

All 66 SDKs in the app, grouped by what they are for. 14 are third-party trackers.

3attribution

11analytics

1crash reporting

51standard libraries

14 of the 66 are third-party trackers. The rest are the app's own code and standard open-source building blocks.

Show the full SDK list

GoogleAnalytics · USA

Google Analytics Connector · Firebase A/B Testing · Firebase Core · Firebase Remote Config · Firebase Remote Config Interop · Firebase Sessions · Google Data Transport

AdjustAttribution · Germany

Adjust · Adjust Signature · Adjust (Flutter)

AmplitudeAnalytics · USA

Amplitude · Amplitude (Flutter)

Other third partiesanalytics

New Relic · OneTrust Privacy/Consent

Standard libraries51 · on-device

The app's own code plus open-source interface, storage and networking libraries.

How we know this

Counterspy downloads the app from the App Store and statically analyzes its compiled binary. Embedded SDKs are matched against a signature database and resolved to the company that operates each. We also read the developer's App Store privacy label, which lists the data the app says it collects and links to you. We do not run the app or intercept its traffic, so we report capabilities present in the code and the developer's own disclosures, not proven transmission. We assess privacy and data collection, not malware, security flaws, or developer intent. Reports are automated and never edited for payment. Scan v1.54.1, 2026-04-04.

Third-party trackers are advertising, analytics and attribution SDKs detected by static signature matching. Presence shows a capability is compiled in, not that it ran or transmitted data.
"Data the app links to you" is the count of data categories the developer declares as Data Linked To You in its App Store privacy label. Labels are self-reported and not verified by Apple.
Comparison across the 80 shopping in our corpus. Trackers: median 5. Data linked to you: median 8.