What you can inspect
Read the permission and privacy boundaries here. When a public release is available, the download page provides its ZIP and matching checksum. A checksum identifies the artifact; it does not prove that an app is safe in every situation.