Privacy
Privacy
Two parts: the promises the iPhone app makes and how each one is enforced in its design, and what this website does with data.
The app
Each promise below is only written down because it is architecturally true: there is no code path that could break it. The app is in development; these are the commitments the released version will ship with.
| Promise | How it is enforced |
|---|---|
| No account | No authentication code path exists. Any in-app purchase is handled anonymously by Apple's StoreKit. |
| No location | The app does not import Apple's location framework anywhere. A build-time check will fail the build if it ever does. |
| Detection runs on-device | The signature catalogue is bundled with the app; matching is pure Swift in the detection core; there is no network call in the detection path. |
| History stays on-device | Local storage only, with explicit Delete History and Clear All Data actions. |
| Bluetooth observations are not uploaded | The app has no networking at launch. Any future analytics would be limited to the allow-listed events below. |
| No ads | None, and no advertising SDKs. |
What a detection record contains
Timestamp, device family, confidence level, signal category and the kinds of evidence that matched (for example "company identifier" and "service UUID"), never the raw bytes. No peripheral identifiers are kept beyond the active session. No raw advertisement data is persisted. There is no silent collection in the background.
If analytics are ever added
Only these events would be allowed, with no payload: onboarding completed, scan started, demo used, qualifying detection, paywall shown, purchase completed, app version. Never: peripheral identifiers, advertisement payloads, manufacturer data, device identity, history or location.
The research harness
Before launch we use an internal test app that deliberately records more than the consumer app will (raw manufacturer data, names, iOS peripheral identifiers, in memory) so we can characterise devices. Its exports replace identifiers with per-export aliases and can redact names; nothing leaves the test phone automatically. This harness is not distributed.
This website
The notify form
If you ask to be notified, we store: your email address, the device you said you were interested in (optional), the time you gave consent, the page you submitted from, and a coarse browser family (for example "iOS" or "mac"). We do not store your IP address. Re-submitting the same address updates the existing record rather than creating a new one.
The data is held in a Cloudflare D1 database in the European Union region and used for one purpose: to email you when the app launches, plus at most a handful of research updates before then. It is not shared with anyone. Every message includes a way to be removed, and you can also ask by email at any time to have your record deleted. Submissions are protected against automated abuse by a hidden honeypot field and, when enabled, Cloudflare Turnstile, which may set a short-lived cookie on Cloudflare's domain while the challenge runs.
Analytics
When enabled, the site uses Cloudflare Web Analytics, which is loaded as a script from Cloudflare and does not use cookies, does not fingerprint, and reports aggregate page views and performance metrics. There is no other analytics, advertising or tracking script.
Cookies
The site sets no cookies of its own. See the notes above on Turnstile and analytics.
Hosting and logs
The site is served by Cloudflare. Cloudflare may process connection metadata to deliver and protect the site under its own policies. Our application code does not write request logs containing personal data.
External links
Research pages link to manufacturer, Apple and Bluetooth SIG pages as sources. Those sites have their own privacy practices.
Changes
This page will be updated when the app is released and whenever any of the above changes. The date at the top is the last revision.
Related: Terms of use · About · FAQ