Privacy Policy

• Call sign — typed by the user; used to identify the operator on the reflector and to request an X.509 client certificate.
• Email address — typed by the user; included in the certificate signing request as the certificate's email address (the certificate Subject is your call sign), and used for certificate-related correspondence initiated by the reflector operator (not by us).
• Password — only for profiles that log in with a password instead of a certificate. Typed by the user and stored encrypted with a key held in the Android Keystore. The password itself is not sent to the reflector: the app answers the reflector's login challenge with a value computed from it.

Microphone audio is captured only while Push-to-Talk is active. Push-to-Talk can come from the on-screen button, the home-screen widget or a hardware PTT key, and the widget and hardware keys also work while the app is in the background or the screen is off. Audio is encoded with the Opus codec and transmitted in real time to the reflector you have configured. Audio is not recorded, stored, or retained on the device or by the app developer.

• When location is enabled, the app uses Google Play services to obtain your approximate or precise coordinates. If that fails or is denied, the app may make a one-shot call to ipwho.is to derive an approximate city-level location from your public IP address. The app then looks up the city name for your coordinates with Android's geocoder, which on devices with Google Play services is a Google service.
• You can disable automatic location entirely in Settings and enter a city/latitude/longitude manually instead.
• By default ("Coarse location (grid-square center)"), the coordinates sent are the centre of your 6-character Maidenhead grid square, or of the larger 4-character square if you are within 1 km of the smaller square's centre. If you turn this off, your exact coordinates are sent. The city name and the grid locator are sent as well. The city name is not coarsened.
• The last known location and city are stored on the device and are reused when no new location is available.
• Location is sent to the reflector you have configured so that other operators can see where you are transmitting from. Location is not collected by the app developer.

• A private key, certificate signing request (CSR), and the certificate issued by your reflector are generated and stored locally in the app's private storage. The app sends the CSR to your reflector and presents the certificate when it logs in; the private key is not sent to the reflector. Apart from that, the private key, CSR and certificate leave the device only when you share a profile to a POC handset (see f), and then only end-to-end encrypted for that handset.
• Keys, certificates and the reflector's CA bundle are excluded from Android cloud backup and device-to-device transfer. A restored or transferred profile that logs in with a certificate therefore requests a new certificate on its first connection.

• Reflector host, port, talkgroup lists, audio device choice, and other user preferences are stored locally in Android DataStore.
• This includes your call sign, email address, encrypted password, manual location, the last known location and city (see c), talkgroup and call-sign data downloaded from the reflector portal, and a list of call signs recently heard on the reflector (kept for 24 hours by default, adjustable in Settings).
• Map tiles you view are cached on the device.

• When you use "Share to a POC handset", the app sends the selected profile to that handset: profile name, reflector and map settings, call sign, talkgroup lists, the app's platform and version, and either your email address, private key, CSR, certificate and CA bundle, or the password. The profile is encrypted on your phone with a key that only the handset holds (end-to-end encryption) and relayed through the RF.Guru pairing service (section 2e), which cannot decrypt it.
• Before a profile is shared or unpaired, the app asks you to unlock with your device's screen lock (a strong biometric such as your fingerprint, or your PIN, pattern or password). Android performs this check; the app only learns whether it succeeded and never receives biometric data. Sharing is not possible on a phone without a screen lock; on such a phone, unpairing asks for a confirmation instead.
• The app keeps a local list of your shares, including random pairing tokens, in private storage that is excluded from backups. For each share it shows the handset's name and roughly when the handset last checked in with the pairing service.
• Anyone holding a handset can copy what was shared to it. Unpairing makes the handset delete the profile the next time it checks in within 180 days (a handset that stays offline longer keeps it but stops using it), but does not revoke the certificate or password on the reflector: copies taken from the handset keep working until the certificate expires or the password is changed. For a full revocation, ask the reflector operator.
• A handset that cannot confirm its pairing with the pairing service for 30 days (the current setting) stops using the profile until it checks in again.

• Receives: call sign, email address (inside the certificate signing request), certificate-related material or a login response computed from your password, real-time audio during transmission, your location, city name and grid locator (see 1c), and standard protocol metadata (selected talkgroup, monitored talkgroups, protocol version).
• If "Auto-reconnect after a long break" is turned on in Settings (off by default), the app can also reconnect to the reflector in the background.
• The reflector is chosen and operated by you or a third party you have selected. Its data-handling practices are governed by that operator, not by the app developer.

Used only as a fallback when on-device location is unavailable or disabled. The request consists of your outbound IP address as seen by the service. See ipwho.is for their privacy policy.

https://portal.<your-reflector-domain>/

• The app fetches public reference data (talkgroup metadata, call-sign hints). These are GET requests for static resources and do not include personally identifying information beyond your IP address (as with any web request).
• The data is fetched about once a day while "Update from portal automatically" and "Enhanced reflector" are on, and is stored on the device.

• On-device location resolution uses Google Play services. Google's privacy policy applies: policies.google.com/privacy.
• Looking up the city name sends your coordinates to Android's geocoder, which on devices with Google Play services is a Google service.
• On the other editions, location resolution uses the operating system's location service, and that provider's privacy policy applies: Apple on iPhone, iPad and macOS, and Microsoft on Windows.

https://poc-request.svxconnect.app

• Used only if you share a profile to a POC handset: while sharing, when you open the share list or unpair or cancel a share, and at app start while an unpair is still pending. Operated by RF.Guru on Google Cloud (Cloud Run and Firestore) in the europe-west1 region (Belgium).
• Receives from your phone: the pairing code you type; a name for your phone (by default its manufacturer and model, which you can edit before sharing); platform and app version; a random token for each share, which the service stores only as a hash; a random value used for the verification number; the encrypted profile; and your IP address as part of the connection. The service also stores when the share was started, sent, accepted and ended. The handset sends its own name (by default its manufacturer, model and a short tag that the handset computes from its Android ID, which is not itself sent), app version, public key and similar values, and the service records, to within an hour, when the handset last checked in. Your phone is shown the handset's name and last check-in time; the handset is shown your phone's name.
• It cannot read the shared profile, which is end-to-end encrypted. It can see the information listed above, the size of the encrypted profile, and when requests are made.
• Retention: the encrypted profile is deleted as soon as the handset accepts or declines it, or the share is cancelled. Otherwise it is deleted with the record of the pairing attempt. A pairing attempt that is cancelled or declined is deleted 24 hours after it ends, and is first reduced to its state, reason, end time and token hashes. One not completed in time is deleted about 24 hours after its deadline (20 minutes after it starts, or at least 15 minutes after the profile is sent). The pairing code is stored only as a keyed hash, together with the pairing ID and your token hash, and deleted about 1 hour 20 minutes after the attempt starts. After an unpair, a minimal record (state, reason, end time and token hashes, no device names) is kept for 180 days. An active pairing is deleted 400 days after the handset last checked in (or was activated); checks by your phone do not extend this. Deletion is automatic and can happen up to about 24 hours after these times.
• IP addresses are used for rate limiting, in the service's memory only (IPv6 addresses shortened to their /64 network). After a failed code entry, a keyed hash of the address (IPv6: its /64 network) is stored with a failure counter for at most 2 hours; automatic deletion can take up to about 24 hours more. The service's own logs record the request type, result, timing, pairing ID and state change, but no IP addresses, tokens, codes, keys or profile content; they are kept for 30 days in Google Cloud Logging and cannot be deleted individually before then. Google Cloud's automatic request logs, which contain IP addresses, are excluded from storage.

wss://reflector.<your-reflector-domain>/

When a profile's "Enhanced reflector" option is on (the default), the app keeps a secure WebSocket connection to the reflector's live feed to receive node and talker status, also while it is not connected to the reflector. The app sends no data over it; the server sees your IP address and a standard connection request.

When the map is shown, map images are downloaded from the OpenStreetMap Foundation's tile servers. These requests include your IP address, the app's package name (com.gururf.svxconnect) and the map area you are viewing. The OpenStreetMap Foundation's privacy policy applies.

To find your reflector, the app looks up its DNS SRV record with plain DNS queries to your network's DNS servers, which bypasses Android's Private DNS setting. If those servers cannot be determined, the app uses Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). Other host names are resolved through Android's normal resolver.

If Android backup is on, Android copies the app's data to your Google account backup, and to a new phone during device-to-device transfer. This includes the settings and profiles in 1e. Keys and certificates, the share list and pairing tokens are excluded. Passwords are included only in encrypted form and cannot be decrypted after a restore, so you will need to enter them again. Google's privacy policy applies: policies.google.com/privacy.