Platform · Mobile app
The companion app: know early, approve from anywhere
The web console remains the full analyst's tool. The app is for the moments between: a high-risk alert on the way to a meeting, a case that needs an approval today, a quick look at your Health Index. Built with Flutter for Android and iOS; the Android release is prepared and awaits store review.
Updated By Drive Digital Editorial
The app signs in with the same account
Same approval rules as the web · Evidence never downloaded to the phone · No push notifications — alerts come by WhatsApp or e-mail
Direct answer
What does the Spy Monk mobile app do?
The Spy Monk companion app shows alerts, mentions, case status and audit results, and lets Owners and Admins record approvals from their phone. It signs in with the same account using short-lived tokens, caches only list summaries and never downloads evidence. It sends no push notifications: alerts arrive by WhatsApp or e-mail. Android release is pending store review.
- Screens: Home, Alerts, Cases, Audit, Profile — plus mention detail, approval and two-step verification
- Sign-in by a one-time code sent to your e-mail or WhatsApp; two-factor verification supported; tokens in the device's secure store
- Offline: cached list summaries with a stale banner; detail screens always load live
- Android package in.drivedigital.drs, targets the current Play requirements; store listing in English and Hindi
Scope
A deliberately small app
Reputation work has two speeds. The slow speed — reading an audit carefully, collecting evidence, writing a correction request — belongs on a large screen with the full console. The fast speed — noticing, deciding, approving — belongs in your pocket. The app is built for the fast speed only, and it says so wherever a web-only feature would otherwise be expected.
That is why billing, the reviews inbox and consultation bookings open a plain "not available in this version" screen in the app rather than a half-working copy, and why evidence files are summarised (kind, name, fingerprint prefix, time) but never downloaded to the device. The app never claims an external submission succeeded; a mutation that fails while offline tells you plainly that nothing was submitted.
In return you get the things that matter when you are away from your desk: the alerts list for everything a monitoring run flagged — with the alert itself reaching you by WhatsApp or e-mail, as you chose, the full case timeline, and — for Owners and Admins — the approval screen, with the same single-use, named-recipient rules as the web.
Screens
What is in the app
- Available now
Home
Your Reputation Health Index from the latest completed audit with the sources it could check, mentions in the last 30 days, open cases and the latest mentions.
- Available now
Alerts
Every in-app notification — audit completed, high-risk alert, case updated, approval required, payment and account notices — with unread counts and mark-all-read.
- Available now
Cases
The case list and detail: timeline, linked mentions, evidence summary and the current stage. Owners and Admins can record an approval naming the action and recipient.
- Available now
Audit
Start a new audit (one credit), watch it run and read the result with its limitations; the full PDF stays in the web console.
- Available now
Mention detail
Source link, publisher, published date, first-seen date, the risk reason in plain words; mark as seen or open the linked case.
- Available now
Profile
Workspace switcher, communication preferences (verified e-mail and WhatsApp, which messages you want, language and quiet hours), two-step verification status, privacy and data, and account deletion.
- Available now
No push notifications
Spy Monk never pushes anything to your lock screen. Alerts you subscribe to arrive by WhatsApp or e-mail with a short, non-sensitive summary; the Alerts tab keeps the full record.
- Phase 2
Reviews inbox, billing, bookings
Web-console features for now; the app shows an honest placeholder rather than a partial copy.
- Pending feasibility
Connected accounts
Connecting Google, YouTube and other accounts depends on provider approvals still being verified; nothing is connected from the app.
Security model
How the app signs in and stays safe
One-time code, then optional two-step
You enter your e-mail address or WhatsApp number, choose where the six-digit code should go — e-mail or WhatsApp — and verify it. If that channel is unavailable, the app offers your other verified channel. If two-factor authentication is on, the app asks for your authenticator code. Google sign-in in the app is planned for a later version.
Tokens, not cookies
The API issues a fifteen-minute access token and a thirty-day refresh token to the app. They live in the platform's secure store — Keychain on iOS, Keystore on Android — never in plain files.
Rotation with reuse detection
Every refresh rotates the token. If a rotated token is ever presented again, the API revokes the whole family and the app returns to sign-in. Refresh is proactive and single-flight, so a flaky network does not log you out.
HTTPS only in release builds
Release builds refuse any API address that is not HTTPS. No provider keys, gateway keys or AI keys exist in the binary.
Minimal offline cache
Only list summaries — home, alerts, cases, audits — are cached, encrypted, and shown with a stale banner when the network fails. Detail screens always fetch live, so permission changes take effect immediately. Evidence is never stored on the phone.
Sign-out that means it
Logging out revokes the refresh token and wipes the local cache, whatever the network result. If revocation could not be confirmed, the app says so.
Release status
Where the app stands
Honest about the store process: the build is real and verified; publishing needs owner steps and two web items.
- Android release build — signed bundle, code shrinking, 64-bit, 16 KB page alignment, current target SDKAvailable nowBuilt and verified; signed with a throwaway key until Drive Digital's upload key exists.
- Google Play listing (English and Hindi), data-safety answers, content rating notes, screenshotsAvailable nowPrepared; awaits the developer account and review.
- Play Store availabilityPending feasibilityRequires the account-deletion web page and endpoint plus a review account — both requested from the web team — and Google's review.
- In-app account deletionPhase 2The screen exists; deletion on the web is the route until the endpoint ships.
- iOS build and App Store releasePending feasibilitySame Flutter code; signing, review and App Store policy checks pending.
- In-app purchases or checkoutPending feasibilityStore payment policies are reviewed product by product before any purchase flow is added.
- Available now
- Available now2 items
- Phase 2
- Phase 21 item
- Pending feasibility
- Pending feasibility3 items
Questions
App questions
Can I download the app today?
Not yet from a store. The Android release pipeline is complete and verified; publishing waits on Drive Digital's Play developer account, the upload key, and the account-deletion page the store requires. This page will change when the listing is live.
Do I need the app to use Spy Monk?
No. The web console has every feature. The app adds alerts and approvals on the go.
Can I approve a case from the app?
Yes, if you are an Owner or Admin of the workspace. You name the recipient and the action, and the approval is recorded with your name — exactly as on the web. Legal escalation still requires professional review first.
Does the app send push notifications?
No. Spy Monk sends no push notifications and no SMS. Alerts you subscribe to arrive by WhatsApp or e-mail with a short summary that contains no sensitive detail; the Alerts tab in the app keeps the full record for when you open it.
Is the app available in Hindi?
The app's strings are maintained in English and Hindi from the same catalog as the web; the device language selects them. Data such as mentions appears in whatever language it was published.
What happens if I lose my phone?
Tokens sit in the device's secure store and expire on their own; refresh tokens are revoked on sign-out, and the API revokes the whole token family if a rotated token is ever reused. If two-factor authentication is on, your authenticator and recovery codes still protect the account. Ask support through the grievance page to force a sign-out of every session sooner.
Start on the web, continue on your phone
Create your account and run the free audit; the app will sign in with the same account when it is available.
No card needed