<![CDATA[Purpose - This study develops a privacy-oriented pre-screening framework for identifying Android applications with potential Sensitive Data Exposure by combining lightweight permission and metadata features with ensemble learning. Design/methods/approach - Android applications obtained from the AndroZoo repository were analyzed using FlowDroid to construct reference labels based on sensitive source–sink flows. Privacy-oriented features were derived from permissions, application metadata, source and sink indicators, and interaction patterns. An Ensemble Stacking model integrating Random Forest, Support Vector Machine, and Extreme Gradient Boosting with Logistic Regression as the meta-classifier was evaluated under class imbalance. Additional circularity, ablation, repeated validation, and clean-feature experiments were conducted to assess robustness and deployment feasibility. Findings - The proposed framework demonstrated strong capability in distinguishing applications containing FlowDroid-defined potential privacy-risk flows. FlowDroid-derived source and sink indicators were highly discriminative, while permission-only features were less effective. Importantly, the clean-feature configuration retained strong discriminatory capability without requiring FlowDroid at inference time, supporting its use as a lightweight first-stage screening mechanism before more computationally intensive taint analysis. Research implications/limitations - The framework can support developers, security auditors, and platform administrators in prioritizing applications for deeper privacy inspection. However, the study relies on static analysis, a single application repository, and FlowDroid-derived reference labels. Originality/value - This study contributes a two-stage Android privacy-risk screening framework that combines lightweight deployable features with targeted static taint analysis while explicitly addressing label-feature circularity and inference-time feasibility.]]>
