For years, Samsung has shipped its Galaxy M, F, and A series smartphones in India with a little-known app called AppCloud. Despite its name, AppCloud isn’t a cloud storage service. It’s essentially an app-installer that surfaces third-party app recommendations during device setup.

On new Galaxy devices in these lineups, AppCloud appears as part of the initial onboarding and forces users to choose whether they want to install certain apps before setup can be completed. You can postpone this by choosing the “later” option, but the app continues to push a persistent notification until you finish the selection process or disable it entirely.

For most users, AppCloud has long been regarded as little more than nuisance bloatware, a side effect of Samsung’s need to generate revenue beyond hardware margins while competing with aggressive Chinese smartphone brands in India.

But findings by the non-profit SMEX from earlier this year suggest AppCloud may not be as harmless as once assumed.

Since 2022, Samsung has also been preloading AppCloud on its A and M series phones in several West Asian and North African (WANA) markets. This rollout has triggered privacy concerns due to AppCloud’s ties to ironSource, a company founded in Israel and now owned by US-based Unity.

While AppCloud can be disabled, it is difficult to remove without root access. Furthermore, its privacy policy is not easily available online, raising questions about transparency, user consent, and what kind of data the app may collect.

ironSource itself has a controversial track record. The company previously operated an “InstallCore” program that became infamous for installing software without clear user permission and for bypassing security warnings, behavior that resulted in widespread criticism and blacklisting by several anti-malware tools.

The presence of an Israeli-origin technology component on Samsung phones in WANA countries poses additional problems. Several nations in this region legally bar Israeli companies from operating, and in light of the ongoing Israel–Palestine conflict, the preload of an app tied to such a company becomes even more contentious.

ironSource’s Aura technology, which “optimizes device experiences” by surfacing apps, content, and services directly on smartphones, has been used on Samsung devices in Europe, Russia, and Southeast Asia, and by telecom operators in the US; it also appears to do something similar to AppCloud. However, AppCloud itself is not listed anywhere on ironSource’s website, which appears to be the major cause for concern, even though the app is now owned by a US company.

While there’s no concrete evidence that AppCloud engages in questionable data practices today, the lack of an accessible privacy policy and ironSource's past reputation are causing anxiety among users.

Consumer advocates and privacy-focused users are urging Samsung to take immediate steps, like providing a clear opt-out for AppCloud during setup, making its privacy policy public and accessible, and to stop preloading the app entirely in sensitive regions.

With concerns rising across multiple markets, Samsung will likely need to issue a statement to reassure customers. We have reached out to the company for comment and will update this story once we hear back.