Most people tap an app without thinking about what is behind it. An app is short for application, which is a software program, and apps can help people play games, read the news or find their way. Apps are made by developers, who may work alone or in a team, and a program is first written in a computer language by a person and then translated into a form the computer can run. Software is the programs a computer runs, and hardware is the equipment, while an operating system is the main software that manages a computer's resources and lets other programs run. An operating system manages resources such as memory, the processor and devices for the programs running on a computer.

Next, here is how Android treats each app. Every Android app lives in its own security sandbox, where each app is treated as a different user of the system, and an Android app, by default, runs in its own process, which the system starts when one of the app's parts needs to run. The Android system follows the principle of least privilege, so each app, by default, can reach only the components it needs. Apps may ask for permission to use information on a device, such as contacts, calendar entries and location, and an app can ask for permission before it uses the camera or contacts on a phone, and you can say Allow or Deny. Many Android app permissions are for private user data, which includes location and contact information.

People keep some control after they first answer. Android permissions come in types: install-time permissions given automatically at install, and runtime permissions the app must request while running. On Android, runtime permissions give an app more access to restricted data, so the app must request them before it can use that data. A person can choose how long an app may use location, camera or microphone, such as only while using the app or asking every time, and a phone's settings let a person change an app's permissions after they first answered. If a person gives an app permissions such as camera or location, any third-party code built into the app receives those same permissions.

Where does an app find the things it shows? A web server sends a website's content to the device that asks for it, and in a client-server system the client sends a request and the server sends back a response. A server is a computer on a network that stores things like files and sends them to other devices. A static web server sends its files as they are, and a dynamic one builds pages with an application server and a database first, and a database is a repository of information that a server can pull content from to build a page or screen.

A client is a machine or software application that accesses a cloud over a network connection, and cloud computing is on-demand network access to a shared pool of computing resources such as servers, storage and applications. Some apps, such as progressive web apps, are built to keep working on a slow connection or when offline, and a progressive web app is a website that can be installed on a device and launched like any other app. Mobile code is software obtained from a remote system, sent across a network and run on a local system without the person installing or running it themselves. An Android App Bundle is a publishing format, and Google Play uses it to make an optimized APK for each device so only the needed code and resources are downloaded.

How do apps reach phones, and how do their makers earn money? More than 100 million apps were downloaded in the first 60 days after Apple opened its App Store in 2008, and by January 2010 more than three billion had been downloaded. As of November 2026, Apple reviews apps before they appear on its App Store, and Apple handles payments and hosting for apps there, so developers do not have to build their own store. Apple says apps that cheat the review system can be removed and the developer expelled from its developer program. As of November 2026, developers can earn money from an app by charging for the download or for features inside it, and Google Play's payment policy says apps that take payment for in-app features generally must use Google Play's billing system. Some apps and some things inside apps cost real money, and in-app purchases let a person pay for extra things inside an app.

Some apps share information from a phone with other companies that show ads based on a person's location and interests. SDKs used for in-app advertising can send a person's data to several parties at the same time while the person uses an app. The advertising identifier on an iPhone is called IDFA, and on Android it is called the Google Advertising ID, or GAID. As of November 2026, Apple's App Tracking prompt lets a person tell an app not to track them, and then the app cannot get the system advertising identifier, and on iPhone a person can tell an app not to track them and still use the app's full features. As of September 2025, California's privacy agency said Android had no built-in equivalent of Apple's App Tracking Transparency. Cybersecurity officials caution that signing in to an app through a social network account can let the app collect information from that account.

Apple has special rules for children's apps. As of November 2026, Apple's guidelines say Kids Category apps should not include third-party analytics or third-party advertising, with limited exceptions. These apps must not have links out of the app or ways to buy things unless they are in an area behind a parental gate, and Apple says they may not send personally identifiable information or device information to third parties. As of November 2026, on Apple's App Store, each app has a privacy label meant to help people understand what data the app collects and how it is used. Apps and games can have an age rating, and as of November 2026, developers must answer age rating questions honestly so that an app works properly with parental controls.

The COPPA rule was designed to protect children under age 13, and COPPA applies to mobile apps that connect to the Internet. The COPPA rule applies to operators of apps and other online services directed to children under 13 that collect, use or disclose their personal information. The FTC says the primary goal of COPPA is to place parents in control over what information is collected from young children online. COPPA covers a general-audience site or service only when it has actual knowledge that a child under 13 is giving it personal information. It does not apply to teenagers, though the FTC is concerned about teen privacy.

For an app, the COPPA rule says the link to the privacy policy must be on the app's home page. The COPPA rule does not require a privacy policy at the point of purchase, such as in the app store, though the FTC encourages it as a best practice. The FTC's COPPA guidance says information given before an app is downloaded is most useful to parents, since a parent may already have paid once the app is downloaded. Personally identifiable information is information that can be used to distinguish or trace a person's identity, alone or with other information.

Before a child gets an app, a grown-up should be asked. Parents can set up a phone so that a child has to ask a grown-up before getting an app, and some phones have settings that let a parent make a child ask permission before downloading or buying apps. As of November 2026, Apple's Ask to Buy is turned on by default for children under 13, and depending on the child's state, country or region, it is turned on by default and can't be turned off if the child is under 18. As of November 2026, when a child asks to get an app on an iPhone, the parent can approve or decline the request from the parent's own device. Parents can block or allow particular apps on a child's phone, and parental controls can block games and apps by their rating. A parent can set daily time limits on a child's phone, and Google's Family Link can also set a bedtime. On Apple and Google phones, a parent or guardian creates the account for a child under 13.

The CISA, a U.S. cybersecurity agency, advises getting apps only from official app stores such as the device maker's or the operating system's store. Phishing is when criminals try to get people to open harmful links or attachments, and it can come as an email, text, direct message or phone call. Updating an app gives you the latest features and makes it more secure, and many software updates are made to fix security risks, and a phone can be set to update its apps automatically. Taking out apps you no longer use helps avoid unnecessary data collection.

Words to know

• sandbox: app's own space
• COPPA: children's privacy rule
• phishing: scam tries
• server: network computer