Blog

Someone Cloned My App: How to Prove It and What to Do

By Connor G ·

Decide whether the clone used your code and assets, or just a similar idea. Archive the pages, save the bundle or binary, and record the URLs and dates before the listing changes. Compare unique strings, file structure, assets and any marker you planted against your own release. Then send a 512(c) copyright notice to the host, and use the official App Store dispute form if the copy is listed there. https://fortifie.xyz/cracked is a free search of public listings for your app, not proof.

This guide is for the Mac or JavaScript developer who found a lookalike: a re-skinned copy, an AI-rebuilt web app, or your JavaScript bundle running on another domain. This is not legal advice. Talk to a lawyer if needed.

Copied code or copied idea?

Copyright can cover the way you expressed the app: source and bundled code, comments, text, images, icons, audio and other assets you created. It does not cover the idea of the app, a feature list, or a workflow someone else implemented with their own code and art. The US Copyright Office states this limit in Circular 1: Copyright Basics: copyright protects expression, not ideas, procedures or methods.

Look at what they shipped.

  • Your JavaScript bundle, unique functions, comments or error strings on their domain or in a GitHub repo is a code issue.
  • Your icons, screenshots, marketing text or help files reused in their listing is an assets issue.
  • An app that works like yours but was written from scratch, with different code and art, is usually a competition issue. Host and store complaint forms are not built for that case.

An AI-rebuilt copy sits in one of those buckets too. If a model rewrote the UI and features without taking your files, you may have a lookalike with no copied code. If the published result still contains your bundle, comments, assets or a planted marker, treat it as copied expression and prove that overlap.

A trademark, if you have one, covers your name, logo or other branding that identifies you, not your features. Talk to a lawyer about whether your facts support a copyright notice, a trademark claim, both, or neither.

Capture proof before anything changes

Listings, repos and store pages get edited or disappear. Capture what you see, then compare. If you do not have a URL yet, search here:

  • Google: your app name plus "clone", "copy", "cracked" or "free download", and quote the name if it is generic.
  • GitHub: the app name, a distinctive error string, a unique function or CSS class, or a comment you wrote.
  • Other domains: a unique chunk filename, source-map path, or string from your bundle.
  • The Mac App Store: search for your name and close spellings.

https://fortifie.xyz/cracked is a free search of public listings for your app, not proof. It will not cover every host, and a name hit is not a confirmed copy.

Once you have a listing, save it in a folder you can hand to a host, a store or a lawyer:

  1. Write down the exact URL, the date and time you found it, and the host or store name.
  2. Take full-page screenshots of the listing and any screens you can reach without signing in to a production account.
  3. Save a copy of the page and its assets. For a web app, download the HTML and the JavaScript, CSS and image files it loads, including .map files if they are still exposed. For a Mac app, do not download anything from a crack, warez or torrent listing; record that listing by URL and screenshot only. If the copy is offered as an ordinary download on the copier's own site or store page, save the archive to an isolated folder and do not launch the .app.
  4. Hash the saved files and keep the output next to them:
shasum -a 256 path/to/saved-file
  1. Keep your own originals in the same record: the release archive, git history, design files and store text, with dates.

You can also submit the URL to a public web archive, such as the Internet Archive's Save Page Now. Do not depend on the live listing staying up. Your local copies and hashes are the record you control.

If the copy is a Mac binary that might be your own build, do not launch it. Compare the signature and files to your release. The guide to telling whether your Mac app has been cracked covers codesign and spctl.

Prove the code is yours

A side-by-side screenshot of two similar UIs is useful context, but it is weak proof that they used your code. Hosts and stores ask you to identify your work and the infringing material. Aim for overlap you can point to in files.

JavaScript and web apps

Start with strings and structure that came from your repo, not from a common library. Search the saved bundle and any source maps for comments or error text you wrote, unusual function or CSS class names, source-map paths that match your project, asset hashes that match files you shipped, and license headers or author notes you included.

shasum -a 256 path/to/saved-bundle.js path/to/your-release.js
rg -F "YourUniqueErrorText" path/to/saved-copy/

An exact hash match on a file you shipped is strong evidence of an unmodified copy of that file. A rewritten or minified bundle will not hash-match, so the unique strings, paths and assets matter. A public source map can still list your original filenames.

If you planted a per-customer fingerprint in your JavaScript, check the recovered files for it. Fortifie adds a hidden fingerprint to each protected JavaScript build on a paid plan, and a Leak Finder upload can show whether a recovered file matches a build issued to your Fortifie account. It does not name which of your own customers leaked it. Each paid Mac harden can carry a hidden per-build fingerprint. Leak Finder can name which build (and your label) a recovered copy came from. For Mac builds, if you give each customer their own labeled build, Leak Finder can name which customer's build a recovered copy came from. The JavaScript fingerprint is account-level only. The Mac fingerprint survives typical re-signing and a simple license-check patch. It does not survive LLVM strip tools or deliberate padding rewrites: a determined attacker can remove it. A name match on a listing is not this kind of file-level match.

Mac apps

Compare the copy to the build you shipped: CFBundleIdentifier and version strings, icons and other resources you created, distinctive strings or a marker you planted, and Team ID and cdhash if the binary may be your signed build rather than a rewrite.

For a Mac app, a planted marker, plus your release records and resource comparison, is the practical way to show the copy used your app. If the binary has been patched, Team ID and cdhash will not match, so also compare the bundle ID, version, icons and other resources.

Where to report it

This is not legal advice. Talk to a lawyer if needed. Do not send a notice you cannot stand behind; several of the forms below are signed under penalty of perjury. A notice is a fit when you can identify your work and the copied code or assets, and a poor fit when the other app is a similar idea with different code and art.

GitHub and other hosts

For a repo, gist, Pages site or other hosted copy, send a copyright notice under 17 U.S.C. 512(c), not a circumvention claim under 17 U.S.C. 1201. A 512(c) notice identifies your work and the exact URLs. GitHub reviews these under its DMCA Takedown Policy.

The US Copyright Office explains the required elements on its Section 512 page and provides a sample notice: identify your work, identify the material and its URL, give your contact information, and include the good-faith and perjury statements plus your signature. Send the notice to the service provider's designated agent, listed in the Copyright Office's DMCA Designated Agent Directory. A notice on one URL does not clear every mirror, so keep searching after you send it.

Copies of web apps often land on GitHub. A Hacker News thread about Photopea copies is a reminder to check GitHub and list exact URLs, not a comment on those parties.

Search engines

After you notify the host, you can ask search engines to drop the listing:

The App Store

If the copy is listed on the App Store, including the Mac App Store, use Apple's official forms:

Apple's App Store dispute forms page, also linked from Apple's developer support, says that in most cases Apple will contact the provider and ask that they work with you directly. The name and email you enter will be supplied to that provider. Apple does not promise to remove the app.

What should you do if someone cloned your app? Decide whether they used your code and assets or just a similar idea, capture the listing and files, prove the overlap, then send a 512(c) notice to the host and use the official store form if the copy is listed.

How do you prove someone copied your code? Compare the saved copy to your release. For JavaScript, use unique strings, comments, file paths, asset hashes and any per-customer fingerprint you planted. For a Mac app, compare the bundle ID, resources, planted markers and, if it may be your signed build, the Team ID and cdhash. If you shipped a paid Mac harden with a Fortifie per-build fingerprint, Leak Finder can name which build (and your label) a recovered copy came from. The Mac fingerprint survives typical re-signing and a simple license-check patch. It does not survive LLVM strip tools or deliberate padding rewrites: a determined attacker can remove it.

Make the next clone easier to catch

Before the next release, plant something you will recognize in a copy: a unique, harmless string or comment in your JavaScript, a marker in a Mac resource or string table, a per-customer fingerprint in JavaScript so a recovered file can be tied to a license, and dated git history and release archives. Fortifie's hidden fingerprint is on protected JavaScript builds on paid plans and ties a recovered file to your account's build, not to one of your own customers. Each paid Mac harden can carry a hidden per-build fingerprint. With Studio, or the Leak Finder add-on on Solo, Leak Finder can name which build (and your label) a recovered copy came from. The Mac fingerprint survives typical re-signing and a simple license-check patch. It does not survive LLVM strip tools or deliberate padding rewrites: a determined attacker can remove it.

Make a copied JavaScript bundle less useful to reuse. Do not leave source maps public on a production host. Minification still leaves your strings and structure easy to copy. Hardening the bundle can make the shipped files slower to read and reuse. It raises the cost of a casual copy; it does not make copying impossible.

Search again on a schedule for your app name, distinctive strings and planted markers on Google, GitHub and the other places above. https://fortifie.xyz/cracked can run a free search of public listings for your app, not proof.

Fortifie Leak Finder (included with Studio, a paid add-on on Solo) searches public GitHub and web listings by app name. It does not download or confirm copies, and a name match is not a confirmed copy. You can also upload a recovered file you already have; Fortifie hashes it and, for protected JavaScript builds, checks whether it carries your account's fingerprint. Each paid Mac harden can carry a hidden per-build fingerprint. Leak Finder can name which build (and your label) a recovered copy came from. The Mac fingerprint survives typical re-signing and a simple license-check patch. It does not survive LLVM strip tools or deliberate padding rewrites: a determined attacker can remove it. Fortifie drafts a takedown notice for listings it finds; you review it and send it yourself. Fortifie never sends the notice, and the draft is not legal advice. https://fortifie.xyz/cracked is a search of public listings, not proof.

FAQ

Is it illegal to clone an app?

Copyright can cover your code, text and artwork. A similar idea built with different code and assets is often a competition question, not a copyright one. Talk to a lawyer about your facts; this is not legal advice.

Can I take down an AI-rebuilt copy of my app?

If the published copy includes your code, comments, bundle or assets, document that overlap and consider a 512(c) notice to the host. If someone rebuilt the features and UI without taking your files, a copyright notice may not fit. Talk to a lawyer.

How do I prove someone copied my JavaScript?

Save their bundle and compare it to yours. Look for unique strings, comments, source-map paths, matching asset hashes and any per-customer fingerprint you planted. An exact hash match on a file you shipped is strong; a rewritten file needs those other overlaps.

What proof do I need for a DMCA notice?

The US Copyright Office lists the elements on its Section 512 page: identify your work, identify the infringing material and where to find it, give your contact information, and include the good-faith and perjury statements plus your signature. Keep the URLs, dates, screenshots and file comparisons that support those identifications.

Can I find out which customer leaked my code?

If you ship each customer a build with its own planted marker, a recovered file that carries that marker shows whose build it was. Fortifie's fingerprint on paid-plan protected JavaScript builds shows whether a recovered file matches a build issued to your Fortifie account; it does not name which of your own customers leaked it. Each paid Mac harden can carry a hidden per-build fingerprint. Leak Finder can name which build (and your label) a recovered copy came from. For Mac builds, if you give each customer their own labeled build, Leak Finder can name which customer's build a recovered copy came from. The JavaScript fingerprint is account-level only. The Mac fingerprint survives typical re-signing and a simple license-check patch. It does not survive LLVM strip tools or deliberate padding rewrites: a determined attacker can remove it.