MOBTRACKER PRIVACY POLICY

1. Introduction

This Privacy Policy describes how MobTracker (also referred to as "the App", "we", "us", or "our") handles personal and sensitive user data. This policy applies to both the web application hosted on GitHub Pages and the native mobile applications compiled for Android and iOS devices.

Our goal is to be fully transparent about what data is accessed, how it is used, and the privacy controls at your disposal.

2. Sensitive Permissions & Data Collection

The App requests access to certain sensitive device permissions and data in order to provide its core functionalities. Below is a detailed description of each type of data handled:

A. Precise Location Data

MobTracker offers an opt-in Pair Tracking (device-to-device tracking) feature. If and only if you voluntarily accept a location sharing request:

• The App accesses your precise location (latitude and longitude) using standard device GPS and network-based Geolocation APIs (e.g., navigator.geolocation.watchPosition).
• Your coordinates are securely transmitted as encrypted/obfuscated packets to a transient, public HTTP pub/sub messaging relay (ntfy.sh).
• This location data is used exclusively to visualize your real-time position on your paired partner's local map and is not stored permanently.
• The location data is only collected while the App is actively running or sharing is kept open. You may terminate sharing instantly at any time.

B. Phone Number Inputs

The App features an Offline Region Locator allowing you to input a phone number to visualize its registration country/region calling code:

• All phone number searches run 100% client-side.
• The geocoding and carrier lookup processes are executed entirely locally inside your browser or native device webview by deserializing embedded static BSON resources.
• No phone numbers, search terms, or query logs are ever sent to a remote server.

C. Recent Searches & History (Local Storage)

• Your recent phone number queries, paired session history, and saved persistent pairs are stored directly in your browser or device's local memory (localStorage).
• This data remains strictly on your individual device and is never synchronized to a cloud service or remote database.

3. Third-Party Services & Relays

To enable real-time coordination without centralized database storage, MobTracker utilizes third-party services:

• ntfy.sh (HTTP Relay Service): Location updates are published via a free public instance of ntfy.sh. This service acts purely as a transient message relay and does not persistently store location coordinates.
• OpenStreetMap & Leaflet: Interactive maps are rendered using OpenStreetMap tiles. Map interactions do not transmit any personal identifiers or search data to OpenStreetMap servers.

4. Data Sharing & Disclosures

We are committed to keeping your personal data confidential:

• No Commercial Sharing: Your location, phone prefix searches, and device telemetry are never rented, sold, or shared with advertisers or commercial third parties.
• Exclusive P2P Transmission: Your coordinates are shared exclusively with the person/device holding the randomized, unique pairing link that you generated or accepted.
• Secure URL Identifiers: Pairing links utilize XOR-based symmetric obfuscation and URL-safe Base64 encoding to prevent the exposure of raw session IDs in browser history or networks.

5. User Choice & Data Deletion Controls

You have full, autonomous control over your privacy settings within MobTracker:

• Stop Location Sharing: Simply close the active location-sharing tab or close the App to terminate the live broadcasting of location coordinates.
• Revoke Permissions: You can revoke Geolocation permission at any time through your mobile device's system settings or browser site settings.
• Wipe Local Data: You can instantly clear your entire cache, including recent prefix lookups, saved pairs, and coordinate logs, by using the "CLEAR" or "Trash/Delete" buttons provided in the user interface.
• Privacy Mode: Enable "Privacy Mode" (the eye icon toggle) in the app header to automatically redact all raw coordinates and force a manual "REVEAL" action before rendering latitude or longitude coordinates.

6. Security Measures

We implement robust technical mechanisms to secure your experience:

• All network communications with the public relay use encrypted HTTPS protocols.
• Pairing links use client-side obfuscation keys to secure transaction details from passive sniffing.
• We do not collect or request user names, passwords, email addresses, or biometric profiles.

7. Google Play Compliance Statement

This policy complies with the Google Play Developer Program policies regarding User Data and Location Data. We declare that:

• We do not access background location data without explicit notification, and no hidden data harvesting operations are present.
• No high-privilege Android permissions (such as READ_SMS or READ_CONTACTS) are declared or used by this application.

8. Contact Information

For inquiries, support, or code reviews, please visit our official open-source repository on GitHub: github.com/gents83/MobTracker.