Clone App (also known as XClone App) is an app cloner/private vault for hidin…
SZPY TechSerious warnings 2 confirmed warnings. Checked: 400 reviews, the Android app’s code, the store listing and the privacy label.
From our automated analysis, 26 Oct 2026. Every label links to its evidence in the full report below.
This analysis describes version 4.2.1 of the app (the version number recorded inside the package we inspected), analyzed 2026-10-26 .
The store currently lists version 4.2.2, updated 2026-09-29.
Store screenshots supplied by the developer.
Clone App (also known as XClone App) is an app cloner/private vault for hiding apps. Utilizing Android virtualization technology, it creates a parallel/dual space to clone social and gaming apps – such as WhatsApp Clone, Facebook Clone, Instagram Clone, Messenger Clone, dual WhatsApp, double app, second WhatsApp – enabling multi-account management on a single device while keeping apps/games hidden for privacy protection.
Key Features
★ App Cloning in Parallel/Dual Space & Multi-Account Management
✓ Free to use: Dual accounts per app supported.…
From the developer’s store description.
For developers and the curious
The evidence, sources, measurements and versions behind every label above.
Findings that met the published evidence standard.
Bundles 16 distinct ad networks / mediation SDKs: Amazon Publisher Services, AppLovin MAX, BidMachine, Chartboost and 12 more
The package embeds several distinct advertising or mediation SDKs — a stack built for ad volume, not for a single house ad.
Package artefact
Appworthy
sha256:bf480555881bce998dd13814c31d1ed7b9935939fec648175c1d99f6c3424d5fAggressive ad load: raised by 10 distinct reviewers (about 1 in 40 reviews we read)
Advertising volume or placement that interrupts normal use: ads between every action, unskippable or forced full-screen ads.
Facts that add context without being a charge.
Requests 14 of the 18 sensitive permissions Android defines — ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION, ACTIVITY_RECOGNITION, BODY_SENSORS, CAMERA, PACKAGE_USAGE_STATS, READ_CALENDAR, READ_CONTACTS, READ_EXTERNAL_STORAGE, READ_MEDIA_IM…
The package requests substantially more of the device's sensitive permissions than the typical app in its category. This is a measurement, not an accusation: a permission is granted because a feature needs it, and a wide request list is a reason to look rather than a finding on its own.
Package artefact
sha256:bf480555881bce998dd13814c31d1ed7b9935939fec648175c1d99f6c3424d5fSpecific evidence of a useful property, within the stated scope.
Offers a one-time or lifetime purchase: "One-time Purchase"
The app's own text offers a one-time or lifetime purchase, or reviewers report that the price is stated clearly.
Package artefact
sha256:bf480555881bce998dd13814c31d1ed7b9935939fec648175c1d99f6c3424d5fThe developer's store data-safety disclosure states that data deletion can be requested; we have not seen a deletion control in the app's own text
The developer's data-safety disclosure on the store states that users can request deletion of their data, or the app's own text offers a way to delete the account. This restates what the developer declares; it is not a test of whether deletion works. Apple publishes no equivalent disclosure, so on an Apple-only listing only the app's own text can support it.
Open observations that have not cleared the evidence bar.
The app's own text says: "Download to private album so you can play anytime."
This observation has not cleared the required evidence standard.
The app's own copy describes working without a connection — offline mode, downloading for offline use, or content saved for later. Shown because readers filter on it; it is a feature, not a fairness property, and never counts for or against an app.
Package artefact
sha256:bf480555881bce998dd13814c31d1ed7b9935939fec648175c1d99f6c3424d5fThe app requests QUERY_ALL_PACKAGES, which lets the app enumerate every other app installed on the device.
This observation has not cleared the required evidence standard.
The app ships session-recording or a wide tracking stack, holds permissions that read personal data, or is reported by users to sell, leak or over-collect it. The evidence line says which of those was observed.
Package artefact
sha256:bf480555881bce998dd13814c31d1ed7b9935939fec648175c1d99f6c3424d5fThe app's own text says: "• Subscriptions cannot be transferred. You can manage or cancel your subscription via Google Play > Settings > Subscriptions."
This observation has not cleared the required evidence standard.
Cancelling the subscription is blocked, hidden, multi-step, or simply does not take effect.
Package artefact
sha256:bf480555881bce998dd13814c31d1ed7b9935939fec648175c1d99f6c3424d5fThe app's own text says: "Subscribe to VIP, do not support migration to other devices"
This observation has not cleared the required evidence standard.
Advancement or competition is gated behind spending money rather than playing.
Package artefact
sha256:bf480555881bce998dd13814c31d1ed7b9935939fec648175c1d99f6c3424d5fThe app's own text says: "Become a VIP to unlock all privileges"
This observation has not cleared the required evidence standard.
The core of the app — not extras — sits behind payment, or previously-free function moved behind a paywall.
Package artefact
sha256:bf480555881bce998dd13814c31d1ed7b9935939fec648175c1d99f6c3424d5fThe app's own text says: "Help optimize compatibility"
This observation has not cleared the required evidence standard.
The app's own screens offer a way past sign-up — guest access, skipping, or browsing before registering — rather than gating the product behind an account. The store's privacy disclosure is checked alongside it: that disclosure is self-reported, so it corroborates this credit rather than establishing it.
Package artefact
sha256:bf480555881bce998dd13814c31d1ed7b9935939fec648175c1d99f6c3424d5f400 reviews read for this analysis. Each observation keeps the sample and store it was based on.
I can't even open my app, the ads are non stop , deleted!
too many adds. even after 15 adds my cloned app not opening. worst experience. worst app
many ads in this app. sometime not open properly
A sampled review illustrates one person’s experience. It does not establish a finding on its own.
“Not assessed” means we could not measure it. It is never a zero and never a pass.
Android package 4.2.1, scanned 26 Oct 2026. These describe that package, not the current store version.
Supporting measurements: not a complete list of possible harms or positives. Measurement vocabulary 1.4 · how these are measured
This analysis describes version 4.2.1 of the app (the version number recorded inside the package we inspected), analyzed 2026-10-26 .
The store currently lists version 4.2.2, updated 2026-09-29.
Each store’s release notes, as the developer wrote them. They are the developer’s words, not ours.
No release notes were provided for this version.
clone-app-parallel-dual-spaceAssessed 2026-10-26 from 400 user reviews, the app's package, the store listing and its privacy label.
What the stores publish. Store ratings are the stores’ numbers, not Appworthy’s, and are never averaged across stores.
This assessment is produced automatically. Six independent signals are read — user reviews, SDKs in the app package, the app's own on-screen text, the app manifest, the store listing and the store privacy disclosure — and each candidate finding is filed under the sources that support it.
No charge stands on one kind of evidence — with one published exception. A finding is either a measured fact that anyone can reproduce (an ad SDK is in the package; every subscription bills weekly; the privacy label omits a tracker we can see), or it is an interpretation — and an interpretation needs independent sources to agree before it reaches the catch list. The exception is a harm only users can see: a charge may publish from reviews alone, as “Reported by N users”, once enough reviewers raise it to clear that charge’s own published bar. That agreement rule is what replaced the human reviewer, not a model’s confidence.
There is no overall score, on purpose. A 0–99 number was published here until 2026-09-15. It was withdrawn because it discriminated too weakly to be the instrument — 44.7% of every pair of apps tied — and because a single number is a verdict where a count is an observation. What publishes instead is a row of measurements, each of which says what was counted and, where we could not look, says that instead.
Findings under One source only are real reports we do not stand behind as findings. They are shown because withholding them entirely would hide a genuine complaint, and labelled because publishing them as charges would be an accusation off a single source.
Write to [email protected], or use the form. Name the finding, the app version and the evidence that needs correcting. Factual corrections are free and never depend on buying anything.