Dumpert¶
Supported app: 5.8.0 · Build: 22001778 · Input: original Play APKS · Android: 12L / API 32 or newer
nl.dumpert
Watching a clip, submitting a kudo and reporting that a clip was watched are different operations. The inspected Dumpert app has central analytics and a separate first-party recommendation-event sender. Stopping one logger would therefore leave other measurement paths. An identifier is a value that can connect successive records to the same installation or account.
What activity is recorded in the inspected paths?¶
| Activity / service | What our evidence shows | What changes |
|---|---|---|
| Advertising | Ad/auction builders include PPID (publisher-provided ID) or hashed advertising ID, available account/profile IDs, content/player and consent context. | Native feed/banner slots and detail/Shorts preroll attachments are suppressed. Required initialized player infrastructure remains. |
| First-party PostRec | api-dms.dumpert.nl/api/v1.0/post-rec/… receives view/video/progress and recommendation-related kudo events, with optional login token and Cxense ID. |
The separate sender stops even when remote configuration enables it. Actual kudo/favourite submissions remain genuine. |
| Piano/Cxense and Comscore | Traced pageviews, segments, identity association and audience measurement; central events include login/Deluxe context. | Collection, targeting, optional PPID/advertising/App Set IDs and audited queued sends stop. Queue callbacks preserve actual sent/unsent status; old unsent Piano records may remain until expiry. |
| Firebase and Meta/Facebook | App/screen/purchase/share/video events, identifiers, diagnostics, session and push statistics are inventoried. | Collection and runtime re-enablement are suppressed. Previously persisted Firebase measurement/diagnostic batches are filtered before sending without pretending successful delivery. Functional services remain. |
| Didomi | Automatic consent UI is separate from initialization, vendor/purpose choices and manual preferences. | Automatic presentation is skipped; no acceptance or rejection is written. Optional CMP metrics were not independently isolated. |
What remains and what is still unknown?¶
Content, accounts, comments, uploads, real purchases, push and privacy configuration remain, with necessary connection/service identifiers. Genuine Facebook login and Firebase authentication/configuration remain initialized. Cast-client and Play Billing library diagnostics can still transmit; their exact payloads were not fully audited. Remote social players and server-stitched advertising remain unverified. This is not a universal web or network filter.
Available controls¶
All three are enabled by default in stable v1.9.0:
- Hide ads removes native ads and subscription promotions. Its local Deluxe/ad-free account wording and hidden Free price do not grant a real Deluxe entitlement. Genuine subscriber product details and management remain.
- Disable tracking includes Hide ads and stops the audited analytics, optional identifiers, targeting, diagnostics and queued sends.
- Skip consent screens includes both controls and retains manual privacy and genuine saved choices.
See installation, choosing patches and the catalogue.
Evidence¶
Reviewed 28 October 2026 against main 8ca0ddb: implementation audit and destination/control catalogue. The user approved stable promotion after v1.9.0-dev.2, including account/promotion cleanup. That acceptance does not establish every device/billing scenario or a complete packet capture. How to read the evidence.