killerloanapps · live: India · Sri Lanka · historical: India · Nigeria · deleted · methodology

Methodology

Play-Store-only, paperwork-first. Everything on this site comes from public Play listings captured with our own harvest tooling; nothing is inferred about a company's conduct beyond what its own listing, permissions and paperwork say.

Pipeline

Harvest — keyword search on the Play Store for lending terms per country (in/lk/ng plus local-language terms), then fetch full detail + permissions for every candidate (scripts/harvest.py, via our GPlayAPI v2 instance at gplayapiv2.fly.dev). Writes data/harvests/<CC>_<date>.db.
Warehouse — corpora merged into one DuckDB (scripts/build_warehouse.py), each row carrying its corpus id, harvest date, legal-entity fields, privacy policy URL and the full permission set.
Availability recheck — every app id of every live corpus is re-queried against its own storefront on each refresh (scripts/check_deletions.py), so deletions are recorded as events, not lost.
Scoring — rubric (rubric.yaml 0.2) applied per app (scripts/score.py), including a +15 platform_removed adjustment for apps that have since vanished from the store.
Publication — static pages (scripts/build_site.py) committed and served from GitHub Pages.

Corpora

A corpus is a dated harvest of one country's storefront. Live corpora are re-harvested and rechecked on a schedule; historical corpora are frozen research snapshots kept as of their harvest date — useful precisely because they show what the 2021-22 abusive-lending wave looked like, and how much of it later disappeared.

Live corpus	Country	Harvested	Apps
India	`in`	2026-09-21	229
Sri Lanka	`lk`	2026-09-20	155

Historical corpus	Country	Snapshot	Apps	Note
India	`in`	2022-02-27	725	India corpus Dec 2020 - Feb 2022 (dbhub copy, byte-exact)
Nigeria	`ng`	2022-03-04	117	Nigeria corpus Mar 2022 (DStudio x CC shared drive)

Indicator families

Seven families, derived from DeepStrat's Indicators for Detection of Abusive Digital Lenders (Nov 2022, copy in docs/) — the framework the operator of this site co-wrote. Each family scores 0-100; the composite is a weighted average, and families with no signal in a corpus's era are reported as partial rather than imputed.

Family	Name	Weight
I1	Brand & ASO abuse	15
I2	Metadata opacity	25
I3	Physical presence & paperwork	15
I4	Cyber hygiene	10
I5	3rd-party supply chain	15
I6	Permission excess	15
I7	Responsiveness	5

Lending scope

The harvest is keyword-driven, so it also catches general-purpose payments, shopping, ledger and foreign apps. Those stay in the dataset (nothing is hidden) but are labelled out_of_scope or adjacent and kept out of headline counts. 34 app ids are currently listed as clearly non-lending in data/scope_rules.yaml; everything else is classified by lending keywords in title + summary.

Deletion evidence

Two classes, never blended: corpus record (a gap logged while the historical corpus was being built — the 2021-22 India record of 339 apps) and availability recheck (a live check against the storefront, stamped with the date). An app that disappears and later reappears is removed from the deletion log automatically.

What this is not

Not a verdict on any company. A high score means the public listing shows indicators associated with abusive lending; a low score is not a safety certificate.
Not a substitute for regulatory records. Where a licence claim matters, check the regulator (CBSL/MCRA in Sri Lanka, RBI and the state police in India, FCCPC in Nigeria) — we say what the listing claims, not what the law says.
Not real-time. The snapshot date on every page is the date of the last harvest or recheck; apps change silently.
No personal data. Developer/legal contacts here are the business contacts the developer published on the store.

Risk signals, not verdicts. Scores flag indicators of abusive-lending behaviour from public app-store data. A high score is not proof of illegality; a low score is not a safety certificate. See methodology.