Skip to content
We Tried to Debunk Spirit Talker. Most of It Held Up.

Debunk

We Tried to Debunk Spirit Talker. Most of It Held Up.

August 25, 2026 · The Emmaus Team · 10 min read

We took Spirit Talker apart expecting to find something.

That is the honest confession to start with. When you have spent as long in this field as we have, you develop a reflex. An app sells itself on spirit communication, it costs money, it has a slick interface, and some part of your brain has already written the ending before you have read a single line of code.

We were wrong. Not completely, and we will get to the part that did not hold up, but mostly. And in a field this full of nonsense, a company doing the boring things right is news worth publishing.

So here is the good news, in full.

What we actually did

We did not test the app by using it. Using a spirit box tells you almost nothing, because the thing you most want to know is what is happening on the inside.

Instead we opened it up and read its instructions. An Android app ships as a package of compiled code, and with the right tools (jadx and apktool, both free and open source) you can turn that code back into something a person can read. That is what we did.

Then we rebuilt the important parts ourselves, in a separate program, and ran a hundred thousand test cases comparing our version against the real one. If our copy and the original agree a hundred thousand times out of a hundred thousand, we understood it correctly. They did.

The version we examined was 4.3.7, package com.SpottedGhosts.SpiritTalker, with the SHA-256 fingerprint 2171e2fa7e1f9d830b631bdca9198939b531673ebf81db9687215abd0762adbb. We are publishing that so anyone can confirm they are looking at the same file we were.

Then we took the specific claims the makers publish, on the Google Play listing and on their own Common Misconceptions page, and we checked every one.

The sensors are real

This is the headline, and we want to be precise about it because precision is the whole point.

The makers describe it this way: "Spirit Talker scans the environment around the phone using a huge array sensors that can be found inside a phone, a bit like how a Spirit Box scans radio waves."

That checks out. The app reads eight different sensors: the magnetometer, which measures magnetic fields, plus the accelerometer, gravity, gyroscope, linear acceleration, air pressure, humidity and temperature. They are genuinely read, they are registered with the phone's sensor service properly, and their readings genuinely feed the calculation that picks a word.

But there is something better than that, and it is the thing we missed on our first pass.

The app watches the magnetic field around your phone. It calculates the strength of that field, compares it against the previous reading, and when the difference is larger than a set threshold, that is what puts a word on the screen. Not a timer alone. A change in the magnetic field.

That is a real sensor trigger doing real work.

And there is a safeguard we did not expect. If the sensors stop reporting for seven seconds, the app halts the session, clears the word off the screen, and shows a dialog telling you your sensors are turned off. It will not run blind. It refuses to sit there producing output when it has nothing to measure.

That is the behaviour of software written by someone who cared whether it worked.

One smaller thing worth mentioning, because it is the kind of detail that tells you whether a listing is honest. The Play listing advertises around twenty languages. Inside the app we found twenty-six vocabulary files, obfuscated, which decode to exactly those languages plus a couple more. Twenty of them contain precisely the same number of entries as each other, which is what a genuine set of parallel translations looks like. The language list is not padding. It is real.

The privacy promises came back clean

This is the part that matters most for the people using it, and it is where the results are strongest.

On the microphone, their page says: "No, Spirit Talker does NOT access the microphone or secretly listen to you in any way."

True, and stronger than merely true. On Android an app must declare up front that it wants microphone access, and the user must grant it. Spirit Talker never declares it. That means the phone itself blocks the microphone at the operating system level. The app could not listen even if a future version wanted to, without shipping an update that visibly asks you for the permission. We also searched both halves of the program for every audio recording tool Android offers and found none of them. The only sound component in the entire app is the one that plays audio out.

On location, their page says: "No, Spirit Talker does NOT access or use your GPS location."

True, and for the same structural reason. No location permission is declared, so the phone blocks it outright. There is no location code anywhere in the app. We also checked the back door routes, the ones apps use to estimate your position without asking for GPS: Wi-Fi scanning, Bluetooth scanning, cell network lookup. None of them are present either.

On your personal data, their claim is more specific than people usually assume, so here it is in full: "No, Spirit Talker does NOT access your messages, photos, contacts, or any part of your phone or tablet other than a folder where it saves and loads the files of the produced words during a session."

That checks out line by line, including the exception they name.

There is no code for reading contacts. None for reading messages. None for reading your photo library or your call history. In fact the app never queries any of the phone's content providers at all, which is the only mechanism by which any of that data can be reached. It does not hold the permissions for it either.

And the folder they mention is exactly what we found: a single directory named "SpiritTalker", where session transcripts are written. That is the one place it touches, and they told you about it before we did.

We went further than the claim required and checked whether anything could leave the device at all. It cannot. We searched the entire application for any way to transmit data over the internet, and there is not a single web client, socket, or line of networking code in it. There is no analytics package, no crash reporting service, and none of the six best known data harvesting toolkits. The app is not choosing not to send your data. It has no ability to.

We did find one loose end, and we chased it down rather than leaving it hanging. There is a Google Analytics tracking number sitting in the app's resources. Nothing reads it, and no analytics software is bundled that could use it. It is a dead string, almost certainly left over from an older build.

The one honest caveat is this. The app reads your phone's ID number and stores it locally, where it uses it to protect its own purchase check. That never leaves the device, and as we have just established, it could not. Verifying that an app was paid for is not the same as collecting data about you, and we think that distinction is worth stating plainly rather than letting it blur.

Where we corrected ourselves

Our first pass through this got something wrong, and the correction went in the developer's favour.

We had worked out how the app chooses which word to display. That calculation includes a timestamp accurate to the millisecond, which means the input changes constantly regardless of what the sensors are doing. From that we concluded the sensors were not really driving the output.

That was incomplete. We had figured out how a word is chosen, but not what causes a word to appear in the first place. When we traced that second question properly, we found the magnetic field trigger described above. The sensors were doing considerably more than we had credited them with.

We are publishing that because it is what tough love looks like when it is pointed at yourself. An investigation that only ever finds fault is not an investigation, it is a genre.

The one thing that did not hold

We are not going to pretend everything checked out, because it did not, and you would be right to stop trusting us if we did.

The Play listing says: "All responses generated are based on real sensor data, NOT random."

The sensor half is true, and we have just spent several paragraphs demonstrating it. The absolute half is not. Alongside the magnetic field trigger there is a second one: a timer that picks a random wait between one and one hundred seconds and produces a word entirely on its own, with no sensor condition attached. Whichever fires first wins. Separately, the vocabulary list is shuffled randomly each time the app loads.

There is a fair reading of "not random" that survives all of this. At the moment the app decides which specific word to show you, it does not roll dice. It performs arithmetic on the sensor readings, using a standard and well documented text to number function, and we verified that behaviour across a hundred thousand cases. So the intent behind the sentence is defensible.

But the sentence as published says all, and it says not random, and both of those absolutes are contradicted by the app's own instructions. That is one sentence in a store listing, not a character assessment, and our suggestion is that the makers reword it rather than anyone treating it as a scandal.

The question we will not answer

Their page also says that responses require spirits to manipulate the phone's environment using energy to produce relevant results.

We cannot check that. Not because we are being diplomatic, but because it is not a software question. We can prove the app reads the magnetometer. Nothing inside that app, or any app, can tell you what moved the magnetometer.

So we take no position. That is a boundary, not a wink, and it points in neither direction. Anyone citing our work as proof either way is misusing it.

Why we are publishing this

Because the field is loud with accusations and quiet with evidence, and we would rather be the other way around.

Somebody built a product, made specific and checkable claims about it, and then, when someone actually checked, most of those claims turned out to be true. The sensors are wired in properly. The safeguard works. The privacy promises are not marketing copy, they are enforced by the phone itself.

That deserves saying out loud, in a field where saying something kind about a commercial product is treated as suspicious.

We will keep checking. We will keep publishing what we find, including the parts that make our own earlier work look wrong. And when a debunk comes back clean, we will tell you that too, at the same volume we would have used if it had not.

That is the deal.

Sources and references

The claims we tested

What we examined

  • Spirit Talker version 4.3.7, package com.SpottedGhosts.SpiritTalker, version code 86
  • SHA-256: 2171e2fa7e1f9d830b631bdca9198939b531673ebf81db9687215abd0762adbb
  • Static analysis only. The app was never installed or run.

Tools

Technical references

Our full technical write up, including the method, the tools, every finding and everything we could not determine, is available on request. We did not reproduce any of the app's vocabulary, which remains the makers' property.

← The Medium
We Tried to Debunk Spirit Talker. Most of It Held Up. | Emmaus Asylum