AppnalysisBot is the single identity behind every HTTP request Appnalysis makes. If you found this page from a User-Agent string in your server logs, this page explains who we are, what we fetch, and how to control it. As part of building a mobile intelligence Agent that reasons only over evidence it can show you, we publish how AppnalysisBot collects that evidence, and how to stop it.
AppnalysisBot is how the Appnalysis Agent collects the public evidence it reasons over: app store listings, published documents, and public pages across a large number of sources. Everything it reads is public and published. It is not a general-purpose web crawler, it does not roam the open web harvesting content, and it does not train models on what it fetches. A smaller number of requests are our own automated checks against our own site.
One documented exception: app store listing pages are read as a person's browser would read them, per analysis rather than continuously, and are not gated on the store's own robots.txt.
Every request carries the lowercase substring appnalysisbot in its User-Agent. That is the only string you need to match on. The canonical form is AppnalysisBot/1.0 (+https://info.appnalysis.com/appnalysisbot; PurposeToken). App store listings reject non-browser clients, so store fetches use a hybrid browser form that keeps the same identity at the end of the string. The purpose token is a short label naming the job behind the request, so you can group our traffic in your own logs.
A User-Agent can be spoofed by anyone. Where it matters, AppnalysisBot signs requests using Web Bot Auth, the HTTP Message Signatures profile for automated agents. Our Ed25519 public keys are published at https://info.appnalysis.com/.well-known/http-message-signatures-directory. Signed requests carry Signature, Signature-Input, and Signature-Agent headers, and the keyid in Signature-Input matches a key in that directory. During rotation both keys appear for seven days.
To allow us at your edge or WAF, match the case-insensitive substring appnalysisbot in the User-Agent. One rule covers every purpose token and the hybrid store form. To slow us down, add User-agent: AppnalysisBot with Crawl-delay: 1 to your robots.txt. To keep us out entirely, use Disallow: / in the robots.txt of your top-level directory, for every subdomain you want to opt out. You can also contact us and we will action it directly.
Block us entirely via robots.txt and we stop fetching your pages: anything we have already published that cites you keeps its link, but we can no longer confirm that link is alive and your content will not inform future Appnalysis answers. Block only our document fetches and publicly published documents on your site will not be read, so answers that would have cited them fall back to weaker sources or say nothing. Blocking by IP address rather than robots.txt will not work reliably, because it also blocks us from reading the robots.txt that we actually honour.
We do not crawl the open web looking for content to ingest, we do not train models on the pages we fetch, we do not attempt to reach content behind a login or paywall, we do not evade rate limits, challenges, or blocks, and we do not collect personal data from the pages we read.