Yalp uses a Google account, which isn't good.

I use https://apkpure.com

No idea what Yalp is doing with your email here: https://github.com/yeriomin/YalpStore/blob/23503d639034d68b8...

I find Android code really hard to read - there's so many levels of indirection here I can't find where it's actually calling whatever.google.com to grab the APK

This particular code looks fairly straightforward (could definitely be clearer). It's building a url and including the email as a path segment. What the remote service (http://tokendispenser-yeriomin.rhcloud.com/) is doing with that email is harder to determine.

That part is open source too: https://github.com/yeriomin/token-dispenser

That said, if you're sketched out by it, don't use it on a Google account with any data on it. Just make a new empty account for apk downloading.

"Stores email-password pairs, gives out Google Play Store tokens"

I couldn't tell if it was encrypting the password but even if it was... yuck!

Basically the author created web interface to similar APK downloader. At least Docker is completely unrelated.