rea-reverse

Privacy policy

This policy explains what data is collected when you read rea-reverse.com or use its tools. The site has no accounts, no comments and no contact forms, so we do not ask you for personal information. If you email us, we use your address and message only to reply.

Advertising and cookies

This site is set up to show ads served by Google AdSense on its guides, the home page and topic pages. Tool pages, information pages such as this one, and topic pages listing fewer than three guides load no ad code.

Third-party ad vendors and ad networks may also serve ads on this site. Each of them handles data under its own privacy policy. Google publishes the list of ad technology providers that may be used.

Analytics

This site uses Umami (Umami Cloud, operated by Umami Software, Inc.) to count visits in aggregate, such as which pages are read, how visitors arrive (the referring site), browser, operating system, device type, screen size, language and approximate location. We use these numbers only to understand which guides and tools are useful.

  • Umami’s tracker does not use cookies and does not store anything in your browser. Visits are grouped by an anonymous identifier that Umami calculates from the site ID, your IP address and browser user agent together with a salt that rotates monthly; the IP address is processed for that calculation and for the approximate location, but is not stored in the analytics records (Umami metric definitions).
  • We do not send Umami your name, email address or any account identifier, and we cannot use the statistics to identify you.
  • Umami Cloud runs servers in the US and the EU and stores the data in the region chosen for the site’s account. Umami processes it under the Umami privacy policy.
  • The tracker is loaded from cloud.umami.is and sends its data to gateway.umami.is. It only runs on rea-reverse.com itself. To opt out, block those two hosts with a content blocker.

Online tools

The APK analyzer (also offered as the Google Play compliance checker), the EVM selector extractor the WASM analyzer, the HAR / SAZ API summarizer, the .NET metadata and IL viewer, the ASAR / Electron IPC analyzer, the JS bundle and source map restorer, the native binary overview, the Java class and JAR version checker, the protobuf decoder, the signing certificate fingerprint viewer, the X.509 certificate decoder, the file type identifier, the R8 / ProGuard retrace and the iOS provisioning profile and IPA viewer process the file, bytecode, stack trace or pasted data you provide entirely inside your browser. It is read locally in a Web Worker and is never uploaded to this site, to Google or to anyone else. Nothing about the file is stored after you close the page. Tool pages show no ads.

The JavaScript deobfuscator treats the code you paste or open the same way: it is transformed in a Web Worker without network access, it is never executed, and it is not stored after you close the page.

When these tools are in use, they send at most the following Umami events, each with a fixed set of coarse values (Umami adds the address and title of the tool page, as for any page view):

Event Parameters and possible values
apk_analyze kind: apk or aab; size: <10M, 10-50M, 50-200M or >200M; outcome: ok or error; code (only on error): one of the analyzer’s fixed error codes, such as NOT_ZIP or TIMEOUT; fails: number of failed checks; ms: <2s, 2-10s or >10s
apk_export format: json, html or print
evm_analyze outcome: ok or one of the EVM tool’s fixed error codes, such as INVALID_HEX or EOF_UNSUPPORTED; fns: number of functions found as 0, 1-10, 11-50 or >50; ms: <2s, 2-10s or >10s
wasm_analyze, wasm_wat outcome: ok or one of the WASM tool’s fixed error codes, such as NOT_WASM or WAT_FAILED; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s
har_analyze outcome: ok or one of the HAR tool’s fixed error codes, such as NOT_HAR or TIMEOUT; n: number of endpoints found as 0, 1-10, 11-100, 101-1000 or >1000; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s
dotnet_analyze outcome: ok or one of the .NET tool’s fixed error codes, such as NOT_DOTNET or NATIVE_AOT; n: number of types found as 0, 1-10, 11-100, 101-1000 or >1000; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s
dotnet_il outcome: ok or one of the .NET tool’s fixed error codes; ms: <2s, 2-10s or >10s
asar_analyze outcome: ok or one of the ASAR tool’s fixed error codes, such as NOT_ASAR; n: number of files in the archive as 0, 1-10, 11-100, 101-1000 or >1000; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s
asar_fuses outcome: ok; format: elf, pe, macho, fat (universal Mach-O) or plist (Info.plist); n: number of fuse wires or integrity entries as 0, 1-10, 11-100, 101-1000 or >1000; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s
asar_file outcome: ok or one of the ASAR tool’s fixed error codes, such as UNPACKED; size: <10M, 10-50M, 50-200M or >200M (of the extracted file); ms: <2s, 2-10s or >10s
sourcemap_analyze outcome: ok or one of the source map tool’s fixed error codes, such as NOT_SOURCE_MAP or LIMIT_EXCEEDED; map: where the map came from, file, inline or none; n: number of sources in the map as 0, 1-10, 11-100, 101-1000 or >1000; size: <10M, 10-50M, 50-200M or >200M (all files together); ms: <2s, 2-10s or >10s
sourcemap_lookup outcome: ok or one of the source map tool’s fixed error codes; n: number of positions looked up as 0, 1-10, 11-100, 101-1000 or >1000; ms: <2s, 2-10s or >10s
sourcemap_file outcome: ok or one of the source map tool’s fixed error codes, such as NOT_FOUND; size: <10M, 10-50M, 50-200M or >200M (of the previewed or downloaded source); ms: <2s, 2-10s or >10s
sourcemap_zip outcome: ok or one of the source map tool’s fixed error codes; n: number of files in the .zip as 0, 1-10, 11-100, 101-1000 or >1000; size: <10M, 10-50M, 50-200M or >200M (of the .zip); ms: <2s, 2-10s or >10s
binary_analyze outcome: ok or one of the binary tool’s fixed error codes, such as UNKNOWN_FORMAT or MALFORMED; format: elf, pe, macho, fat (universal Mach-O) or none; arch: x86, x86-64, arm, arm64, riscv, mips, ppc, other or none; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s
java_analyze outcome: ok or one of the Java tool’s fixed error codes, such as UNKNOWN_FORMAT or MALFORMED_ZIP; kind: class, jar, war, ear, aar, zip or none; n: number of classes as 0, 1-10, 11-100, 101-1000 or >1000; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s
java_explain outcome: ok or none (whether a pasted error message named a class file version or Java release); n: number of findings as 0, 1-10, 11-100, 101-1000 or >1000. The pasted text itself is never sent
protobuf_decode outcome: ok, malformed (decoded up to a wire-format error) or one of the protobuf tool’s fixed error codes, such as INVALID_HEX; input: hex, base64, file or none; grpc: frames or none; size: <10M, 10-50M, 50-200M or >200M (of the pasted text or file); ms: <2s, 2-10s or >10s
cert_analyze page: keystore or x509 (which of the two certificate tools); outcome: ok or one of the certificate tools’ fixed error codes, such as UNKNOWN_FORMAT or UNSUPPORTED; format: pem, der, pkcs7, jks, jceks, pkcs12, apk, aab or none; integrity: ok, bad, unchecked, none or na (keystore integrity check); n: number of certificates as 0, 1-10, 11-100, 101-1000 or >1000; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s
filetype_identify outcome: ok or one of the file type tool’s fixed error codes, such as EMPTY or READ_FAILED; family: the coarse kind of the top result, one of executable, bytecode, archive, image, media, document, database, firmware, disk, crypto, text, other, unknown or none; conf: high, medium, low or none; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s
retrace_run outcome: ok or one of the retrace tool’s fixed error codes, such as NOT_MAPPING or MALFORMED_MAPPING; n: number of stack frames in the pasted trace as 0, 1-10, 11-100, 101-1000 or >1000; mapped: how many of them the mapping covered, in the same buckets; size: <10M, 10-50M, 50-200M or >200M (of the mapping file); ms: <2s, 2-10s or >10s
jsdeob_run outcome: ok or one of the deobfuscator’s fixed error codes, such as PARSE or TOO_LARGE; from: paste or file; strings: string-array decoding status, decoded, none, failed or off; bundle: webpack, browserify or none; n: number of bundle modules as 0, 1-10, 11-100, 101-1000 or >1000; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s
jsdeob_zip n: number of modules in the .zip as 0, 1-10, 11-100, 101-1000 or >1000
ios_analyze outcome: ok or one of the iOS tool’s fixed error codes, such as UNKNOWN_FORMAT or NO_APP; kind: profile, ipa, app, xcarchive, info-plist, entitlements, privacy, macho or none; ptype: development, adhoc, appstore, enterprise, developer-id, mac-appstore or none (profile type); fails: number of failed checks as 0, 1-10, 11-100, 101-1000 or >1000; size: <10M, 10-50M, 50-200M or >200M; ms: <2s, 2-10s or >10s

These events never include the file name, package name, version, certificate, hash, bytecode, selector, host, URL, header, cookie, type or method name, path inside an archive, IPC channel, source path, position, stack trace, section, symbol or library name, string, class or package name, manifest value, pasted error text, protobuf field number or value, keystore alias or password, fingerprint, bundle id, team id, profile name or UUID, device UDID, entitlement, detected format name, byte, offset or any other content of the file. Reports you export are generated in your browser and saved only to your device.

The APK analyzer also computes the SHA-256 hash of the whole file in your browser and shows a link that searches that hash on VirusTotal. The page never opens or requests that link by itself. If you click it, your browser opens virustotal.com in a new tab with only the hash in the address (no referrer is sent), and VirusTotal’s own privacy policy applies. The hash is never sent to Umami or anyone else. If you use “Compare signer with the previous release”, the second file you choose is read the same way, locally, and nothing about it is sent anywhere; the class and method names shown by the class browser also stay on the page.

The signing certificate fingerprint viewer can take a keystore password. The password is passed to the tool’s Web Worker together with the file, used there only to check the keystore and decrypt its certificates, and discarded when the analysis ends. It is not stored in the page or in browser storage, not logged, and never sent to this site, to Google or to anyone else. Private keys in a keystore are never decrypted.

Users in the EEA, the UK and Switzerland

For visitors from the European Economic Area, the United Kingdom and Switzerland, ads are only shown together with a Google-certified consent management platform (CMP) that implements the IAB Transparency and Consent Framework. The CMP asks for your consent before personalized ads or the cookies they rely on are used, and you can change or withdraw that choice at any time through the same consent dialog. If you do not consent, Google may show non-personalized or limited ads.

Fonts

Pages load web fonts from Google Fonts, which means your browser sends a request, including your IP address, to Google’s servers. See the Google Fonts privacy FAQ.

Server logs

The site is a static website hosted on Cloudflare Pages. Cloudflare may process standard request data such as IP address, user agent and requested URL to deliver and protect the site, as described in the Cloudflare privacy policy. Apart from Umami described above, we do not run other analytics scripts.

Guides link to other websites, such as the REA repository on GitHub, npm and rea.tools. Those sites have their own privacy policies.

Contact

For privacy requests or questions about this policy, use the contact page.

Changes

If this policy changes, the date at the top of this page is updated.