Where does an app come from, and what is it made of? An app is short for application, which is a software program, and apps can help people play games, read the news or find their way. Apps are made by developers, who may work alone or in a team, and a program is first written in a computer language by a person and then translated into a form the computer can run. JavaScript is a scripting language that makes web content update on its own, and it is the third layer after HTML and CSS. In web code, an event such as a click can run code, so a click can run code that, for example, changes a label on the page.

More than 100 million apps were downloaded in the first 60 days after Apple opened its App Store in 2008, and by January 2010 more than three billion had been downloaded. As of November 2026, Apple reviews apps before they appear on its App Store, and Apple handles payments and hosting for apps there, so developers do not have to build their own store. Apple says apps that cheat the review system can be removed and the developer expelled from its developer program. As of November 2026, developers can earn money from an app by charging for the download or for features inside it, and Google Play's payment policy says apps that take payment for in-app features generally must use Google Play's billing system. Some apps and some things inside apps cost real money, and in-app purchases let a person pay for extra things inside an app.

What is going on inside the phone? Here is how the pieces fit together. Software is the programs a computer runs, and hardware is the equipment, while an operating system is the main software that manages a computer's resources and lets other programs run. The idea of a program stored inside a computer's memory was introduced in the late 1940s, and many operating systems use virtual memory, so parts of a program's memory can wait on storage such as a hard drive when not in use and be swapped back into the faster main memory when needed. The operating systems of personal computers commonly provide a graphical user interface, and an operating system provides services to users and to programs. An operating system manages resources such as memory, the processor and devices for the programs running on a computer.

Next, here is how an Android phone keeps apps apart. Every Android app lives in its own security sandbox, where each app is treated as a different user of the system, and an Android app, by default, runs in its own process. The system starts that process when one of the app's parts needs to run. The Android system follows the principle of least privilege, which means that each app, by default, can reach only the components it needs. You may have heard that an app can use anything on a phone, but the Android system gives each app only the access it needs, and a person has to grant some permissions. Here is a way to think about it: each app is treated as a different user of the system, and each one gets only the access it needs.

How does an app get to use the camera or a person's contacts? An app can ask for permission before it uses the camera or contacts on a phone, and you can say Allow or Deny. On Android, a person can let an app use their location only while they are using that app, and a phone's settings let a person change an app's permissions after they first answered. On Android, runtime permissions give an app more access to restricted data, so the app must request them before it can use that data. A person can choose how long an app may use location, camera or microphone, such as only while using the app or asking every time. If a person gives an app permissions such as camera or location, any third-party code built into the app receives those same permissions.

Where does an app find the things it shows? Here is how that works for a website. A web server sends a website's content to the device that asks for it, and in a client-server system the client sends a request and the server sends back a response. A server is a computer on a network that stores things like files and sends them to other devices. A web server answers with a status code, such as 200 for success and 404 when a file cannot be found, and a browser may make several requests for one page, to fetch the page's other files such as JavaScript and CSS. An API is a system access point or library function with a well-defined syntax that programs can use to get well-defined functionality.

Here is a question about how a page gets built. Pages can be built in two ways, and some apps keep working without a good connection. A static web server sends its files as they are, and a dynamic one builds pages with an application server and a database first. A database is a repository of information that a server can pull content from to build a page or screen. Network-connected apps often use HTTP to send and receive data, and a server answers each request with a response. Some apps, such as progressive web apps, are built to keep working on a slow connection or when offline, and a progressive web app is a website that can be installed on a device and launched like any other app.

Who else can learn about a person from an app? Some apps share information from a phone with other companies that show ads based on a person's location and interests. SDKs used for in-app advertising can send a person's data to several parties at the same time while the person uses an app. As of November 2026, Apple's App Tracking prompt lets a person tell an app not to track them, and then the app cannot get the system advertising identifier, and on iPhone a person can tell an app not to track them and still use the app's full features. As of November 2026, on Apple's App Store, each app has a privacy label meant to help people understand what data the app collects and how it is used. As of November 2026, Apple's guidelines say an ad that interrupts an app must show that it is an ad, must not trick people into tapping, and must have a close or skip button.

Personally identifiable information is information that can be used to distinguish or trace a person's identity, alone or with other information, and encryption turns readable data into a form that hides its meaning. Phishing is when criminals try to get people to open harmful links or attachments, and it can come as an email, text, direct message or phone call. Updating an app gives you the latest features and makes it more secure. An app can send a notification, a short message that shows up on a phone's screen, and Android notifications are meant to give timely information and reminders even when the app is not in use.

Let us look at the rules for apps made for children. Children's apps have their own rules. The COPPA rule was designed to protect children under age 13, and COPPA covers a general-audience site or service only when it has actual knowledge that a child under 13 is giving it personal information. For an app, the COPPA rule says the link to the privacy policy must be on the app's home page. As of November 2026, Apple's guidelines say Kids Category apps must not have links out of the app or ways to buy things unless they are in an area behind a parental gate. They also say Kids Category apps should not include third-party analytics or third-party advertising, with limited exceptions, and may not send personally identifiable information or device information to third parties.

Before a child gets an app, a grown-up should be asked. Parents can set up a phone so that a child has to ask a grown-up before getting an app, and some phones have settings that let a parent make a child ask permission before downloading or buying apps. As of November 2026, Apple's Ask to Buy is turned on by default for children under 13. As of November 2026, depending on the child's state, country or region, Ask to Buy is turned on by default and can't be turned off if the child is under 18. As of November 2026, when a child asks to get an app on an iPhone, the parent can approve or decline the request from the parent's own device.

Grown-ups have other ways to set limits, and here they are one by one. Here are a few more things a grown-up can do on a child's phone. Parents can block or allow particular apps on a child's phone, and a parent can set daily time limits on a child's phone, and Google's Family Link can also set a bedtime. On Apple and Google phones, a parent or guardian creates the account for a child under 13. Apps and games can have an age rating, and parental controls can block games and apps by their rating, and on Google Play they can limit what is downloaded by maturity level.

Words to know

• sandbox: app's own space
• encryption: data scrambling
• phishing: scam tries
• notification: short message