When installing from Github you only trust the developer and their signed certificate key.
When installing from F-Droid you additionally also have to trust the F-Droid developer's signature.
Besides that F-droid has its own problems:
https://privsec.dev/posts/android/f-droid-security-issues/
I don't use F-Droid. I use Obtainium and additionally check signatures in AppVerifier.
Why is Simplex calling to Google?
Hi
I may be wrong, but can someone help me interpret the results of this analysis correctly?
See the Network Related section: Why does Simplex.apk have a hardcoded communication with
An app that is advertised as the most privacy-friendly?
All other indicators can (probably) be considered false positives (for example, the Camera permission, which is needed for video calls)