The trick is figuring out what parties do that without constantly sniffing traffic or reading source code. Sometimes I wonder what all on F Droid has malware.