Stalkerware is software installed on a phone, usually by someone with physical access to it, that lets another person secretly monitor calls, messages, location, photos, and browsing activity — without the device owner’s knowledge or consent. It’s a distinct category from parental control software: stalkerware is built specifically to operate covertly, often marketed under euphemisms like “employee monitoring” or “child safety” while being used, in practice, against partners, exes, and family members who never agreed to be tracked.
The industry behind it is large and, recurringly, badly secured. Multiple stalkerware companies have been hacked or leaked customer and victim data over the years, including an incident earlier in 2026 where a hacktivist scraped over half a million payment records from several stalkerware apps. If you suspect you’re being monitored, the goal of this guide is to help you recognize the signs and respond in a way that keeps you safe — which isn’t always the same thing as removing the software immediately.
A Safety Note Before Anything Else
If you believe a partner or someone who could become dangerous is monitoring your device, read this section first.
Don’t act on suspicion alone in a way that tips off the person monitoring you, especially if you have any safety concerns about how they’d react to being discovered. Stalkerware often sends the person monitoring you a notification, or simply shows them, the moment it’s uninstalled or the phone is factory reset. If your safety depends on them not knowing you’ve noticed, removing the software the moment you suspect it can escalate risk rather than reduce it.
If your situation involves domestic violence or any fear for your physical safety, contact a domestic violence hotline or anti-stalking organization before taking technical action. Organizations like the National Domestic Violence Hotline and the Safety Net project at the National Network to End Domestic Violence have specific guidance for exactly this scenario, including how to document evidence safely and how to time the removal of monitoring software around your broader safety plan, not just the technical question of “how do I delete this.”
Assume any device the person monitoring you has had access to could be compromised, not just your phone. Shared computers, shared cloud accounts, shared smart home devices, and even a child’s device can be vectors. If you need to research this topic or make calls for help, consider doing so from a device or account the other person has never had access to — a library computer, a trusted friend’s phone, a new account they don’t know exists.
Signs Worth Paying Attention To
No single sign here is proof of stalkerware on its own — phones do unusual things for ordinary reasons. But a cluster of these, especially appearing together or after a specific person had access to your device, is worth taking seriously.
Battery drains faster than it used to, with no other clear cause. Monitoring software typically runs continuously in the background, recording and transmitting data. A sudden, sustained change in battery life — not a single bad day, but a consistent pattern — is one of the more reliable indirect signs.
The phone runs hot or the fan-equivalent processes spike when you’re not actively using it. Background data collection and transmission uses processing power, which generates heat. A phone that’s warm while sitting idle in your pocket is behaving differently than one that’s actually idle.
Data usage is higher than your actual usage explains. Stalkerware needs to send what it collects somewhere, and that transmission shows up in data usage statistics even if the app itself is hidden from your home screen.
Someone seems to know things about your activity, location, or conversations that they shouldn’t have a normal way of knowing. This is the most direct signal, even though it’s not a technical one. If a person repeatedly references private conversations, your exact location at unusual times, or activity you didn’t share with them, that’s a stronger indicator than any battery statistic.
Unfamiliar apps, or apps disguised under generic names, that you didn’t install. Stalkerware is frequently designed to look like a system utility, a calculator, or some other innocuous app icon, specifically so it doesn’t draw attention during a casual glance at the home screen.
Security or antivirus settings have been changed without your involvement, particularly anything that needed to be disabled to allow the monitoring software to be installed in the first place — like Google Play Protect or an equivalent built-in protection being turned off.
How to Check, Carefully
Review your installed apps list directly through phone settings, not just your home screen, since stalkerware often hides its icon. On Android, check Settings → Apps for anything unfamiliar; on iPhone, check installed profiles and configuration settings under Settings → General → VPN & Device Management, since iOS stalkerware often relies on a managed configuration profile rather than a traditional app.
Check for unfamiliar device administrator or accessibility permissions on Android. Stalkerware frequently requests deep system permissions to function, and those permissions are visible if you look at Settings → Security → Device Admin Apps or the Accessibility settings menu, even if the app itself is disguised.
Use a reputable mobile security scanner as a second check, not your only check. Tools from established security vendors can catch many stalkerware variants, but no consumer app catches everything — some stalkerware is custom-built or frequently updated specifically to evade detection. A clean scan result is reassuring but not conclusive.
If you need certainty and the stakes are high, a professional digital forensics review is the most reliable option. Some domestic violence support organizations offer this service directly or can refer you to a service that does, specifically calibrated for situations where the cost of being wrong — in either direction — is high.
What to Do If You Find It
Decide on timing based on your safety plan, not just your instinct to remove it immediately. If discovery puts you at risk, coordinate the removal with a safety plan — which might mean using a temporary new device to communicate and plan before touching the monitored phone at all, then removing the software at a moment when you’re not dependent on that device or are in a secure location.
Document what you found before removing it, if it’s safe to do so. Screenshots of the unfamiliar app, the permissions it had, and when you discovered it can matter later, whether for a protective order, a police report, or simply your own record of what happened.
A factory reset is the most thorough removal method, but it also erases everything else on the device. Back up what you want to keep — to an account or storage service the other person doesn’t have access to — before resetting, and be aware that a factory reset is also one of the actions most likely to immediately notify whoever installed the monitoring software, depending on the specific stalkerware product.
Change your account passwords from a different, uncompromised device, not from the phone you suspect is monitored. If stalkerware has been capturing keystrokes or screen activity, changing a password on the same compromised device may simply hand the new password to the same monitoring software.
Why This Keeps Happening
Stalkerware persists as an industry because it’s profitable and because enforcement is inconsistent — it’s frequently marketed under a legal-sounding pretext (monitoring “your own” device, or a device you pay for) even when it’s being used against someone who never consented and has no practical way to opt out. The recurring data breaches affecting stalkerware companies themselves are darkly instructive: software built to spy on someone without their consent is often built by companies with little incentive to secure the data it collects, because the entire business model already depends on operating in a legal and ethical gray zone.
If you’ve been a target, the breach risk runs both directions — not only is your activity being monitored by the person who installed it, but the data those apps collect has, in multiple documented cases, ended up exposed to anyone who found the breached database. That’s an additional reason removal matters once it’s safe to act, beyond stopping the person actively watching you.
After You’ve Secured Your Device
Once you’ve safely removed monitoring software and changed your credentials, it’s worth rebuilding your digital footprint with deliberate separation from anything the previous monitoring had access to — new accounts where it makes sense, storage that isn’t tied to a shared family plan or a cloud account the other person ever had login access to.
daftei is built around individual account access — no shared family login model that quietly gives someone else visibility into what you store. Files are encrypted with AES-256 at rest and TLS 1.3 in transit, available on iOS, Android, and the web, and account deletion follows a 30-day window before becoming permanent, giving you a clean, independent place to keep documents and photos that belong to you alone going forward.