I remember back in 2009, I had been working for Privacy International for about a year and I was insanely busy travelling all over the place speaking at conferences, public consultations and the like, when I received a request to speak at an App Developer conference in the UK.
I agreed because in my mind mobile apps are one of the worst infringers of privacy and data protection laws due to hidden adtech SDKs and other data exfiltration which is not permitted in the EU without real consent.
The next email asked me to provide a brief summary of my keynote so I went on to create a plan for a keynote on App Privacy under the UK Privacy and Electronic Communications Regulation (aka PECR also known as the ePrivacy Directive in the EU).
Imagine my surprise when the next reply stated "Oh that sounds great but we don't think our audience would be interested in that." - why on earth they reached out to someone from Privacy International to give a keynote and expected it not to be about privacy, is lost on me but them's the apples - the keynote did not go ahead and to this day, mobile apps continue to be some of the most serious lawbreakers when it comes to privacy, security and data protection laws (not to mention consumer protection laws).
As such, I am incredibly careful about the apps I allow to be installed on my mobile devices - I no longer play mobile games (they are literally STaaG - "surveillance tooling as a game") and the mobile apps I do use are mostly limited to utility tools.
Over the past few months I have started to replace as many mobile apps as I can with new Progressive Web Apps (PWAs) which I run on a local docker server (on my local network) so they are completely private. I can "share" them as a Desktop App (making them standalone apps on my iPhone's home screen) and keep all state stored locally on the device. I can even secure them with passcodes via browser APIs and use my local fingerprint scanner (on my MacBook Pro or my Mac Studio) - with everything stored in the secure enclave on device.
For example, last week I finally got round to setting up the gym in my garage and wanted to start the 100 Push-Ups programme (which is very good by the way) - I checked the App Store for existing apps (because this is a well known and popular 6 week workout programme that actually works) and as expected found dozens of apps claiming to be for the 100 Push-Ups programme. I checked out several of them and they were all woeful - the free ones are just completely restricted and unusable, the paid for (either directly or with in-app purchases) were just as bad and they are all exfiltrating data from the device.
So I opened iTerm and asked Claude Code to "Please can you checkout the original 100 pushups programme and create a PWA for our local docker stack that will allow me to follow the programme, save the session results to the local device and provide me with timers in between sets to help with my rest timings" - within 15 minutes it was done - one hit, passcode implemented, PWA based, committed and pushed to a local gitea repo and then launched as a docker service directly from git context. Up, running and working flawlessly, no tracking, no SDKs, no third party network requests, no adtech, no surveillance.
This is just one of dozens of App Store apps I have replaced with local PWAs in the past couple of months and I don't feel even remotely guilty about it.
Why?
Because as I said, Mobile Apps have been ignoring the law for literally 20 years, their own industry have declared they are not interested in privacy and now we have the tools to circumvent them entirely and create tools which respect our fundamental rights and don't require us to share our interests for corporate profits.
I don't care if app developers hate this because app developers have never tried to obey the law, they have never been interested in the law and as a result the global shape of online privacy is beyond bad, it is literally held to ransom by corporate greed.
So my advice to my readers? Do you have an old laptop or old computer lying around? If so set up a docker (or container manager of your choice - proxmox for another example) server on it and next time you need a simple utility app to make your day easier, ask your vibe coder to do it for you as a PWA. With LetsEncrypt being free it is trivial to do (PWAs need to be secured with HTTPS to work) and most utility apps are incredibly easy and quick to reproduce with a competent coding agent such as Claude.
If you want to be able to access them when you are not at home, you can either put them on a cheap VPS and ask your coding agent to implement authentication - or just do what I do and have a VPN setup on your home network (many broadband routers support running a VPN server such as Wireguard), connect to it when you are away from home and still have access to all your apps. Mobile App developers need to understand that we don't "need" them anymore and if they don't change their attitude and start obeying the law, it might not be the regulators or litigators they need to be most concerned about - it might well be regular users who have decided they don't want to be stalked and surveilled anymore so have chosen another way, a sovereign way, their own way - and no-one is going to cry about an app developer that has literally broken the law for their entire existence and profited from it, when they go out of business - celebration is the more likely response.