u/futurefinancebro69

A friend asked me to go over two short reports since im slightly more technical and these are my findings:

quick background:

there have been a few short reports on $APP (Muddy Waters being the big one) all basically saying their ad targeting works because theyre harvesting data they shouldnt have. Stock dropped since. i wanted to see how much of the technical claim is real so i went through the public MAX SDK on github.

one thing you need to know before anything else. the public repo is ONLY the mediation adapters (the glue between MAX and other ad networks). the actual AXON core that does the bidding is closed source and not in the repo. so all the juicy stuff (cross app tracking, the kid stuff, stuff from the short reports etc) is in code i literally cannot see. not gonna pretend otherwise.

tldr: the conflict of interest is 100% real and visible. the consent handling is genuinely sloppy. the actual smoking gun is in closed code nobody outside the company can audit, so i cant confirm it and honestly neither can the shorts.

1. consent flags get passed off with zero verification the partner actually honors them

17 adapters take your opt out flag, turn it into a string, hand it to the third party network and walk away. no callback, no check. the adapters whole job is “ok i told them.”

```java
if ( hasUserConsent != null && !hasUserConsent )
networkExtras.putString( "npa", "1" ); // non personalized ads
if ( isDoNotSell != null && isDoNotSell )
networkExtras.putInt( "rdp", 1 ); // restrict data processing
```

also worth noting opting out just means you see a non personalized ad. theres no skipTracking() anywhere. you opting out changes the ad, not whether the event gets logged.

2. the consent strings themselves are mangled

Fyber adapter, the entire CCPA privacy string crushed down to three hardcoded values:

```java
InneractiveAdManager.setUSPrivacyString( isDoNotSell ? "1YY-" : "1YN-" );
```

Verve adapter, the IAB consent string (supposed to encode WHICH things you agreed to) just gets stuffed with “0” or “1”:

```java
if ( !hasUserConsent )
userDataManager.setIABGDPRConsentString( "0" );
```

could be sloppy plumbing instead of malice. but its the kind of thing that looks real bad if a regulator ever looks, because the consent signal isnt being passed through properly.

3. the conflict of interest is the part thats actually clean cut

this is the strongest thing and its not even hidden, its just the org chart. AppLovin owns all of it:

- MAX runs the auction (the auctioneer)
- AXON bids in that auction (a bidder)
- Adjust is the attribution layer that decides which ad gets credit for a sale (the ref). they bought it in 2021.

so one company runs the auction, has its own guy bidding in it, AND owns the ref that decides if its own bid earned the credit. you can see the attribution pipe right in the demo app, this block is in every single ad type:

```kotlin
val adjustAdRevenue = AdjustAdRevenue(AdjustConfig.AD_REVENUE_APPLOVIN_MAX)
adjustAdRevenue.setRevenue(ad.revenue, "USD")
adjustAdRevenue.setAdRevenueNetwork(ad.networkName)
Adjust.trackAdRevenue(adjustAdRevenue)
```

Adjust (which AppLovin owns) gets the dollars, the network, the placement, every impression. the “independent” attribution and the ad seller are the same company. to be clear a conflict of interest is legal. plenty of companies have them. doesnt prove anything on its own but its worth looking at.

4. MAX does see everyone elses bids

every adapter has a collectSignal() that hands the networks bid token to MAX. so the vantage point for the “AppLovin can see what everyone bids” claim is real. what i CANT show is whether AXON then uses that to sharpen its own bids (which would be the actual problem). thats in the closed core.

what i could NOT find in the repo (be skeptical of these):

- no persistent cross app ID. the “they track you everywhere” claim would be in closed core.
- no COPPA / child flags anywhere (lines up with the reported sep 2024 removal but thats not a smoking gun).
- no direct download / install code.
- no auto click ad logic.

all the headline stuff is in code that isnt public.

So in conclusion of my vibe coded forensics:

verifiable: a real conflict of interest (auctioneer + bidder + ref, one owner), consent plumbing that doesnt pass signals through right, and the ability to see competitors bids. NOT verifiable: whether any of that is actually the illegal data harvesting the shorts allege, because that code is closed.

Wondering what y’all think? Im fucking sus of this whole thing.

Shorts:

https://muddywatersresearch.com/research/2025/mw-short-app/

https://fuzzypandaresearch.com/category/applovin/

I work buy side and spent a few years building a parser that takes XBRL data from SEC EDGAR and outputs clean formatted Excel models. Income statement, balance sheet, cash flow, segments. Every number ties to the filing.

Originally I was trying to build something like Yahoo Finance. Then I realized that space is completely saturated and in 2026 nothing is more valuable than human created models with real assumptions behind them. The data is commodity. The analysis is the product.

So instead of selling data I’m building a collaborative space for financial modeling. Think source control but for equity research. You download a baseline model that already ties to the 10K, fork it, change your assumptions, post your thesis. The community sees exactly what you changed and votes on the best analysis. Platform tracks your accuracy over time so you build a real track record.

Calling it ModelPit. The whole idea is that building a model from scratch takes hours before you even get to the analysis. If the verified starting point already exists you skip straight to the interesting part.

Would you use this to practice modeling or build a portfolio before recruiting? What would make it useful to you as a student?

Nothing to sell. Just want feedback from people learning this stuff.