MMY claims vs the file dump
Two columns, kept apart on purpose. The left is what the install listing prints about itself. The right is what a dump of the channel APK returned on 10 November 2026. One is a claim. The other is a measurement.
The listing, quoted as a listing
The install page that serves the channel file prints a 4.3 rating, a reviews count written as "1M+ reviews", and a downloads count written as "10M+ downloads". No third-party source is attached to any of the three. The same page shows three player reviews. The names on them are Western names, and the dates on them fall in 2025. That is an observation about what is visible, not a finding about who wrote them.
The page also carries a data-safety section. The text of that section says no data is shared and no data is collected. A reader who stopped there would come away thinking the app declares an empty data practice.
None of this is repeated below as fact. It is repeated as what the page says, because the comparison only works if the claim is quoted accurately first.
The file, quoted as a file
The channel file mmy.2rwkt.apk is 20,954,528 bytes. SHA-256 b699d1480b19ec1fb28974c90df518bc7ff989e0900ec9fcc4beef7c353e6421. Package com.mmyuionn.opp02, versionName 2.2.5, versionCode 225, minSdk 24, targetSdk 35, native code arm64-v8a, engine string Cocos 3.8.2. The application label is MMY. Thirteen permissions are declared. Contacts, SMS, camera and location are not among them.
Two of the thirteen are worth setting against the data-safety text. The manifest includes the Google advertising-id permission, and it includes an install-referrer lookup, the permission that lets an app ask which link led to the install. Separately, the channel file carries an attribution marker in a small channel file packed inside the APK. A manifest line is not proof of what the running app transmits. It is proof of what the app is allowed to ask for, and of what the package was built to include.
The listing says no data is collected. The manifest reserves an advertising id and an install referrer, and the channel build carries an attribution marker. That tension is worth stating plainly. It is not, by itself, an allegation about what leaves the phone.
Row by row
| The listing prints | The file dump shows |
|---|---|
| Prints a 4.3 rating | No rating exists in the file. No third-party source is cited. |
| Prints '1M+ reviews' | A reviews count is not a property of an APK. |
| Prints '10M+ downloads' | A download count is not a property of an APK. |
| Shows three reviews with Western names and 2025 dates | The file has no reviews in it. The observation is about the page. |
| Data-safety text: no data shared, no data collected | Advertising-id permission, install-referrer lookup, and an attribution marker in the channel file. |
| Presents one app named MMY | com.mmyuionn.opp02 at 20,954,528 bytes, and com.Mymuqiueb.ineb at 21,049,457 bytes. |
| Size and version are whatever the page typed | 2.2.5, version code 225, 20,954,528 bytes on the channel file. |
The rating row is the cleanest example of a claim with no checkable counterpart. A file dump cannot contain a rating. Confirming one would take a third party that collected reviews and published its method. Nothing of that kind is cited, so the figure stays in the claims column.
The version row is where other pages go wrong, and it is covered on the name confusion page. Pages elsewhere print version 1.2.4 and sizes from 32 MB up to 42 MB. Neither figure matches either file measured on 10 November 2026. Those pages are not named here. The method is: ask for the byte count, and compare it with 20,954,528 or 21,049,457. A page that cannot produce either number is describing a file this review has not seen.
What the data-safety tension is, and is not
It is a disagreement between two texts. One text is written for the reader of the listing and says nothing is collected. The other text is written for Android and reserves permissions that exist specifically to identify a device for advertising and to attribute an install to a link. A channel file that also carries an attribution marker was built by someone who wanted installs traced back to a source.
It is not a packet capture. This review did not run the app, did not intercept traffic, and does not know what is sent, where, or how often. Saying more than the manifest shows would be the same mistake as trusting the listing's data-safety text: treating a convenient sentence as a measurement. The careful statement is the one above. The reader can weigh it.
How to use the two columns
If you already hold a file, ignore the left column and check the right. Byte count first, because it takes one glance. Hash second, because it settles the question. Package name third, because it tells you which of the two MMY apps you have. The checklist puts those in order.
If you only hold a page, the left column is all that page is offering. Ask it for the byte count, the version code, the package name and the hash. A page that prints a rating and a download count but not those four has chosen the figures it cannot be checked on.