Plain talk

Privacy Policy

Last updated: September 2026. No accounts, no login, no name tied to anything you send — but scan and location data does leave your phone when the shared-map toggle is on. Here's exactly what, when, how long, and how to opt out.

What we collect

When you enable "Help build the shared map" in Settings (on by default), the app sends the following to our servers at scrambites.com:

Wi‑Fi identifiers

MAC addresses (BSSID) and names (SSID) of Wi‑Fi access points your phone detects nearby.

Bluetooth identifiers

MAC addresses, UUIDs, and advertised names of Bluetooth devices detected nearby.

Signal strength

RSSI of detected Wi‑Fi and Bluetooth devices, in dBm.

GPS location + timestamp

Your phone's approximate latitude/longitude at the time of each scan, and when it happened.

This is used to match detected devices against known tracker fingerprints, populate the shared map of surveillance infrastructure, and improve detection.

What we never collect

There are no accounts

  • No registration, login, or authentication of any kind
  • Nothing you send is tied to a name

Never collected

  • Your name, email address, or phone number
  • IMEI, UDID, or other persistent hardware ID
  • Photos, contacts, messages, or other personal data
  • Anything that can directly identify you

When data leaves your phone

Only when all three are true:

  1. "Help build the shared map" is on (Settings → Privacy)
  2. Your phone has internet connectivity
  3. A Wi‑Fi/Bluetooth scan completes (every 30s by default while Protection is on), you submit a camera report from the Map screen, or a queued offline scan flushes once you're back online

Turn sharing off and scanning still works locally on your phone — nothing is sent to our servers, but you also stop receiving shared-map and fingerprint-database updates while it's off.

Data retention

Individual scans (Wi‑Fi/BLE ID + location + timestamp)

Checked against known tracker fingerprints in server memory and never written to a persistent, per-scan database. A short rolling buffer of the most recent scans is kept in memory for debugging and clears on every server restart — not kept on a fixed schedule.

Shared map data (aggregated location + tracker type, no per-scan device ID)

Auto-discovered points never confirmed by another device, below our confidence threshold, are archived after 90 days of inactivity. Points confirmed by multiple devices are kept indefinitely, same as the rest of the map.

Camera location reports

Retained indefinitely — these are explicit contributions to the public surveillance map.

Server logs

Our web server keeps request logs for troubleshooting and abuse prevention; these are automatically deleted after 7 days. IP addresses are never stored in the scan or shared-map data — the app itself never associates a scan with a device or an IP.

Your rights

Because there are no accounts and nothing identifying is stored, we cannot associate past scans with a specific device or user once submitted. Camera reports are anonymous and can't be retroactively attributed to a submitter.

Data security

Third-party services

We do not use third-party analytics, advertising, or tracking. The only external service the app talks to is our own server at scrambites.com.

Map tiles load from OpenStreetMap tile servers when you view the Map screen — a standard web request under OpenStreetMap's own tile usage policy. We don't control or have access to OpenStreetMap's server logs.

Children's privacy

ScramBites is not directed at children under 13 and does not knowingly collect data from children. If you're under 13, do not use this app.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will be revised accordingly. Continued use of the app after changes means you accept the updated policy.

Contact

Questions about this policy, or a data deletion request? PLACEHOLDER_EMAIL