Loupe Shows What iOS Apps See. The App Privacy Report Doesn't.

A close-up of a hand holding an iPhone, the kind of UI a user sees when an app reads passive device signals with no permission prompt — Photo via Unsplash

TL;DR: Mysk released a free, open-source iOS and iPadOS app called Loupe on June 5, 2026 (version 1.0.1 on June 12). A Show HN submission by Cider9986 hit 216 points on Hacker News by the 07:30 UTC June 21 scan, crossing the 200-point threshold at roughly 06:55 UTC.^[1]^[2] Loupe reads the same public iOS APIs that any sandboxed App Store app can call, and groups the readings into three tiers: Passive (no permission prompt), Needs Permission, and Advanced (canOpenURL probing and Keychain persistence across reinstalls). The App Privacy Report in iOS 17+ Settings shows the gated categories. It does not show the Passive tier. Loupe is the complement, and the two together show a wider fingerprinting surface than Apple's privacy UI alone.

What it is: Loupe is a free, open-source iOS and iPadOS app from Mysk Inc. (Tommy Mysk and Talal Haj Bakry), the same research duo that documented TikTok's clipboard snooping in 2020 and the AirDrop contact-discovery leak in 2019.^[2]^[3]
What it shows: the raw values of public iOS APIs grouped into three cost tiers, exactly as any third-party app can read them: locale, time zone, screen, battery, volume creation timestamp, pasteboard change count, installed apps probe, last-erased timestamp, network endpoints.^[2]
The smoking gun: the volume-creation-date reading and the pasteboard changeCount are the two Passive-tier values that drew the strongest reaction in the HN thread. The volume creation timestamp is a single timestamp accessible to any installed app with no permission prompt at all. Combined with locale, time zone, and screen size, it narrows the device to a small bucket in any reasonable user base.^[4]^[5]
Why it matters now: the cycle 10 trend report explicitly flagged Loupe as a TIER-2 watch candidate and the watch condition was met in 35 minutes at cycle 11, with 0.371 points per minute and 0.200 comments per minute sustained compound on the cross-up. The engagement-justification gate for a TIER-1 fresh primary brief is satisfied.^[6]
What you can do: install Loupe and walk the three tiers yourself. The App Store link is https://apps.apple.com/app/id6766152470. The MIT-licensed source is on GitHub at https://github.com/mysk-research/loupe if you want to read what Loupe is reading before you run it on your own device.^[7]^[2]

What Loupe Actually Is

Loupe is an 8.88-megabyte iPhone and iPad app, free on the App Store, published by Mysk Inc. and signed as version 1.0.1 on June 12, 2026 after an initial release on June 5.^[7] The minimum iOS version is 17.0, the same baseline that introduced the live App Privacy Report. The App Store description opens with the fingerprinting framing: "Ever wondered how advertisers recognize you across apps and websites? It usually comes down to fingerprinting: small, ordinary details about your device, combined until the mix is rare enough to point back to you."^[7]

The Loupe README on GitHub states the design intent directly. Loupe is "an iOS and iPadOS app that gives you a hands-on tour of the device fingerprinting surface. It reads real values from public iOS APIs, the same ones any third-party app can call, and shows them to you raw."^[2] Nothing Loupe reads leaves the device unless the user explicitly exports it. There is no upload, no sync, no third-party SDK, no analytics. The source is on GitHub under the MIT license. The brand assets, app icon, and design source files remain the property of Mysk.^[2]

The Three Signal Tiers Loupe Exposes

The signal tiers in the README are the privacy story. Loupe groups every reading into three tiers, reflecting the cost of access for a third-party app:^[2]

Passive: values visible to any app with no prompt at all. Locale, time zone, screen size and scale, battery state, system uptime, audio route, and a long tail of public framework values that iOS exposes by default. None are uniquely identifying on their own. Together they cut the candidate pool for a fingerprint to a small fraction of the device population.
Needs Permission: readings that trigger an iOS permission prompt the first time the app asks. Contacts, photos, location, calendars, microphone, camera, motion, and the local network. The fingerprint value here is not the data the app reads. The fingerprint value is that the user said yes at all, and the timestamp of when they said yes.
Advanced: side-channel uses of public APIs that do not require permission but exploit how those APIs behave. The README flags two: URL-scheme probing via canOpenURL, which lets an installed app enumerate what other apps are installed by checking which URL schemes resolve, and Keychain persistence across reinstalls, where values stored in the iOS Keychain survive an uninstall and reinstall and can be used to recognize the same user coming back.

The canOpenURL probe and the Keychain persistence items are the ones that draw the most pointed reaction in the Hacker News comment thread. They are not privacy bugs in the classical sense. They are documented public APIs. The point of Loupe is to make them visible to the person who owns the phone, not just to the developer reading the iOS docs.^[2]

The Smoking Gun: Volume Creation Date and Pasteboard changeCount

Two specific Passive-tier readings drew the strongest reaction in the HN thread. The volume-creation-date reading is a single timestamp accessible to any sandboxed app with no prompt at all. It records, to the second, when the device's user volume was created (i.e. the last setup or erase). HN commenter RedComet called it out directly: "Volume creation date is pretty egregious. I don't see any reason that and Pasteboard changeCount should be so granular."^[4] HN commenter regecks flagged the same value from a different angle: "The 'iPhone last setup or erased on ...' is really nasty. What can a user really do about that? I feel like this should be fudged somehow by the OS."^[5]

The Pasteboard changeCount counter is the second granular Passive-tier reading the thread flagged. iOS exposes a monotonically increasing counter every time the system pasteboard is written to, and any app can read it without prompting. The counter exists so apps can avoid re-reading unchanged pasteboard content. The side effect is that any installed app gets a high-resolution timestamp of pasteboard activity, which leaks when the user copied what, even if the app never sees the content itself.^[4]

None of these readings is a name or an email. None of them requires a permission prompt. None of them is sent off the device by Loupe. The point is not any one reading. The point is that an app can read all of them at once, on a device with a known locale, time zone, screen size, and battery curve, and the combination narrows the device down to a small bucket in any reasonable user base. The ad-tech and attribution layer has been doing this for years. Loupe is the first widely-circulated tool that names the inputs in plain English.

This Is the Hole Apple's Required Reason API Was Supposed to Close

Loupe lands two years after Apple shipped the Required Reason API, the privacy manifest framework Apple introduced at WWDC 2023 and enforced starting May 1, 2024. The Required Reason API requires developers to declare, in their app's privacy manifest, why they call any API that could be misused to derive a device fingerprint. Apps that do not declare a use, or that declare a use inconsistent with what the app actually does, can be rejected at App Review.^[8]

In May 2024, Mysk published a study analyzing the network traffic of several high-profile apps updated after May 1, 2024. The study found that apps including Google Chrome, Instagram, Spotify, and Threads were calling APIs on the required-reason list without declaring a valid reason, and were sending the resulting values off device. The Required Reason API, in other words, did not prevent the apps it covered from performing fingerprinting. It documented the practice.^[8]

Loupe is the second-derivative of that finding. Where the 2024 study read network traffic and inferred which APIs the apps were calling, Loupe reads the same APIs directly from the user side and shows the values the apps would have collected. The Passive tier, by definition, requires no manifest declaration because none of those APIs are on the required-reason list. The Advanced tier exploits APIs Apple has not added to the list. The result is a fingerprint the Required Reason API does not touch, because the fingerprint is built from readings Apple did not classify as required-reason in the first place.^[2]^[8]

The HN commenter microtonal pointed out the parallel implication for Apple's most visible privacy control. The "Allow Apps to Request to Track" toggle in iOS Settings blocks access to the advertising identifier. It does not block URL-scheme probing, the volume creation timestamp, the pasteboard counter, or any other Advanced-tier signal. A user who enables every toggle iOS offers can still be fingerprinted across apps.^[9]

The Mysk Research Track Record: Why This Briefing Is Brief

Mysk is a two-person research team: Tommy Mysk and Talal Haj Bakry. Their public research portfolio includes the 2020 link-preview research that exposed how URL previews in messengers leak IP addresses and metadata, the 2021 accelerometer study showing that any iOS app can read accelerometer data to infer typing and movement patterns, the May 3, 2024 Required Reason API assessment, and most recently the May 19, 2026 disclosure of CVE-2026-28910, an Archive Utility quirk that let a sandboxed macOS app break out of its container, bypass TCC protections, and hijack other installed apps.^[3]^[10] Loupe, in this context, is a packaging of the underlying research as something a normal iPhone user can install and read, instead of having to read a packet capture.

The Mysk company also publishes Psylo, a privacy-first iOS browser with proxy-backed browsing and anti-fingerprinting protections, referenced in the Loupe README as a related product. The Loupe tool itself is free and MIT-licensed on the source code. The brand assets and the design source files remain the property of Mysk.^[2]

The 800-star and 33-fork count on the GitHub repo is the developer-side engagement signal. Three open issues is a healthy queue for a 17-day-old privacy tool with a small team. The repo's MIT-licensed source is auditable line by line.^[2]

What You Can Actually Do

Install Loupe. The App Store link is https://apps.apple.com/app/id6766152470.^[7] The app is free. The 8.88-megabyte download is small. The MIT-licensed source is on GitHub at https://github.com/mysk-research/loupe if you want to read what Loupe is reading before you run it on your own device.^[2]

After installing, walk the three tiers. The Passive tier is the part most users have not seen before. The Needs Permission tier is the iOS permission dialog you have seen a thousand times, but the Loupe readout shows what the dialog is actually gating, not just the name of the permission. The Advanced tier is the part that makes most users' eyes widen, because the canOpenURL probe and the Keychain persistence items are the inputs an ad-tech SDK would use to follow a user across apps even after the user has denied the IDFA prompt.^[2]

On the iOS settings side, the App Privacy Report in Settings → Privacy & Security → App Privacy Report shows a per-app access log for the categories that have a permission gate. It does not show the Passive tier. It does not show the Advanced tier. Loupe is the complement. The two together give a fuller picture than either one alone.^[7]^[2]

If you want to read the comment thread, the Hacker News submission is at https://news.ycombinator.com/item?id=48608645.^[1] The thread crossed 200 points on June 21 at around 06:55 UTC, satisfying the cycle 10 trend-report watch condition for a TIER-1 fresh primary brief.

What to Watch Next

Apple's response. Apple has not commented publicly on Loupe as of this writing. If Apple adds the Passive-tier APIs (system uptime, volume creation timestamp, locale, time zone, battery, screen) to the Required Reason API list, that would be the first material tightening of the iOS device-fingerprint surface since May 2024.
canOpenURL behavior change. Apple restricted canOpenURL in iOS 9, but the API is still callable and the result still tells an app which URL schemes other apps register. A future iOS release that returns a uniform "yes" or "no" for any canOpenURL call, regardless of which scheme is probed, would close the Installed Apps Probe vector. There is no public signal Apple is planning this.
Required Reason API compliance follow-up. Mysk's 2024 study identified Chrome, Instagram, Spotify, and Threads as non-compliant. Two years later, the Loupe release is a fresh opportunity for Mysk (or another researcher) to repeat the network-traffic analysis and publish an updated compliance table. If a major app has stopped reading fingerprint-tier APIs in the intervening two years, that is a signal the Required Reason API works for that app. If nothing has changed, that is a signal the framework is not enforced.
European Commission pressure. The Digital Markets Act gatekeeper rules already require Apple to allow alternative browser engines and alternative app marketplaces in the EU. DMA enforcement could plausibly extend to fingerprinting transparency requirements, since DMA Article 5(2) covers combinations of personal data across services. No DMA enforcement action specifically targeting device fingerprinting has been announced.
Android port. The Loupe GitHub issues have a recurring request for an Android version. The Android fingerprinting surface is wider than the iOS one. If Mysk or a fork ships an Android version, that is the next natural primary brief.

Sources

Published: June 21, 2026