Privacy Policy

Overview

WiFi Map - Free WiFi & Chat (the "App", package com.epsilon.wifichat) is published by Epsilon Developers, an independent software publishing brand operated by Satyam Kushwaha and Anurag Mahajan ("Developer", "we", "us", "our").

This Privacy Policy explains what information the App collects, uses, stores, processes, discloses and protects, and what choices you have. By downloading, installing, accessing or using the App, you acknowledge that you have read and understood this Policy.

The App is deliberately built local-first. The overwhelming majority of what it does happens entirely on your phone with no network call at all. Its chat feature, WiFi Chat, works peer to peer: it exchanges data directly with other phones near you and never with us (§7A). A small, clearly-marked set of features — the community hotspot map, speed testing, ads, purchases and crash reporting — involve third parties or our own server, and each one is described in full below.

Shared backend. The community map, profiles and leaderboard are shared with Epsilon Developers' sister app WiFi Map: WiFi Unlocker: both apps read and write the same hotspot database and leaderboard, under the same rules. A contribution or profile created in one app is therefore visible in the other. Chat is unique to this App and has no server component in either app.

1 Data We Collect

The table below lists every category of data the App touches, and where it goes. "On-device only" means the data is written to the App's private sandbox directory and is never transmitted by us.

2 What Stays On Your Device

The following features run entirely on your phone. They make no request to us, and in most cases no network request at all:

• WiFi Scanner — reads the Android WiFi scan results. Vendor lookup uses a bundled offline database, so no request is made.
• Channel Analyzer — computes congestion and recommends a channel from the scan results already in memory.
• Signal Meter and Signal Heatmap — sample RSSI as you walk. The grid is drawn and stored locally.
• Who's On My WiFi — probes addresses on your own subnet. That traffic stays inside your LAN.
• Password Generator and Password Auditor — generation uses the platform cryptographic RNG; strength estimation runs against bundled rules. Nothing typed into the auditor leaves the device.
• Password Vault — see §8.
• Router Access — detects your gateway address and opens it in your browser. It never attempts a login and ships no credential list.
• Network Deep Scan — runs staged local analysis and produces a score and a list of fixes. The report is generated on-device.
• History — a local Drift/SQLite database in the App's private sandbox.
• Nearby now (Map tab) — the list of networks your phone can currently hear. This layer is measured locally and is never uploaded.
• WiFi Chat history — every conversation, message, reaction and remembered person is kept in a separate local database on your phone. It is exchanged with other phones in the conversation (§7A), never with us.

Android's application sandbox keeps this directory inaccessible to other apps. Uninstalling the App removes all of it.

3 What Reaches Our Server

We operate a small edge API on Cloudflare Workers, with storage in Cloudflare D1, R2 and KV. It exists for one purpose: the community hotspot map, which this App shares with WiFi Map: WiFi Unlocker. It has no login, carries no chat traffic, and receives data only from actions you take deliberately. The only profile it holds is the public leaderboard entry described in §7.6.

The offline outbox

Contributions, votes and reports are written to a local queue first and uploaded afterwards, because people add hotspots exactly where connectivity is worst. Until an upload succeeds the App shows the item as queued, never as sent. If no backend is configured for a given build, items simply remain queued locally and nothing is transmitted.

Request signing

Writes carry an HMAC signature computed over the install ID, a timestamp and the request body. This is anti-abuse plumbing, not authentication of you as a person — it lets the server reject replayed and forged writes and enforce a per-install write limit.

4 How We Use Information

Information is used only to power the feature you are using, to keep the community dataset usable, and to keep the App working:

• To deliver the feature you opened. Scan data drives the scanner and analyzer; measurements drive the speed test; local probes drive device discovery.
• To build and moderate the community map. Contributions, votes and reports feed a moderation state machine and a quality score, so that entries which do not work fall away and entries which are reported are reviewed.
• To prevent abuse. The install ID and request signature enforce rate limits and let us block an install that poisons the dataset.
• To show ads in the free version, subject to the consent choice you make in the Google-provided consent form.
• To honour a purchase by checking entitlement against Google Play.
• To fix crashes and improve the App using aggregated diagnostics.
• To answer you when you email us.

We do not build advertising or behavioural profiles of you ourselves, we do not combine data across Epsilon Developers apps, and we do not perform automated decision-making that produces legal or similarly significant effects.

5 App Permissions

Permissions are kept to the minimum the features actually need, and each is requested at the point of use rather than at first launch.

Permissions the App deliberately does not request

The App declares no QUERY_ALL_PACKAGES, no accessibility service, no SYSTEM_ALERT_WINDOW overlay, no background location, no contacts, storage-scope, SMS, call-log, or microphone permission.

Revoking a permission

You may revoke any permission at any time via Settings → Apps → WiFi Chat → Permissions. Revoking location disables the Map tab's "my location" and, on Android 12 and below, WiFi scanning. Revoking camera disables QR import. Revoking nearby devices / Bluetooth turns off Nearby chat; same-Wi-Fi chat keeps working. Everything else keeps working.

6 Location & Prominent Disclosure

Location is the most sensitive permission the App asks for, so it is worth being exact about it.

6.1 What location is used for

• Centring the map on where you are, so nearby community hotspots are the ones you see first.
• Choosing which map tiles to fetch for the area on screen.
• Stamping a contribution you choose to submit, with the coordinates rounded to 5 decimal places before they are stored or sent.
• On Android 12 and below only, satisfying the operating system's requirement that an app hold location permission before it is allowed to read WiFi scan results at all.

6.2 What location is never used for

• Background or continuous tracking. The App holds no background-location permission and starts no foreground service for location.
• Building a location history or movement profile.
• Location-targeted advertising by us. (Google AdMob independently infers a coarse country/region from your IP address — see §9.)
• Sale or transfer of location data to data brokers. We do not do this and have no commercial relationship of that kind.

6.3 Prominent disclosure

Before Android's runtime permission dialog appears, the App shows a dedicated in-app disclosure screen during onboarding that names the data (location), the purpose (finding nearby hotspots and placing a contribution) and whether it is shared. That screen carries no advertising, requests no permission itself, and cannot be swiped past without acknowledgement. This satisfies Google Play's prominent-disclosure requirement, and it is deliberately placed before the OS prompt rather than buried in this document.

7 Community Map & Shared Credentials

The community layer of the map is user-generated content. This section explains its privacy properties; the rules governing what may be posted are in the Community Guidelines, and network owners can request removal through the Network Owner Removal page.

7.1 What a contribution contains

When you contribute a hotspot you supply the venue name, venue type, security type and — optionally — the passphrase for a venue you are entitled to share. The App attaches the coordinates rounded to 5 decimal places (roughly one metre of precision removed) and the vendor OUI prefix. It attaches your install ID so the entry can be rate-limited and moderated.

7.2 What is deliberately not stored

• Full BSSIDs are never stored. Only the first three octets — the manufacturer prefix — are kept. The server rejects a full MAC address outright rather than truncating it silently. A full BSSID is a stable identifier for a specific access point and, in aggregate, a location database; we do not want one and do not keep one.
• Precise coordinates are never stored. Rounding happens on the device before transmission.
• Your identity is never stored. There is no account, no email, no device identifier — just the random install ID.

7.3 Permission attestation

Contributing requires you to affirm that you have the right to share the network in question. Sharing a passphrase you are not entitled to share is a violation of the Acceptable Use Policy and will result in removal and, on repetition, in your install being blocked from contributing.

7.4 Moderation

New entries appear on the map straight away, marked unverified, so that other people can try them and say whether they work. An unverified entry's passphrase is not released to anyone until two other installs confirm the entry works, or a moderator approves it. Depending on the moderation setting we operate at the time, a new entry may instead be published immediately with its passphrase, or held until a moderator approves it. Entries that accumulate negative reports are flagged and withdrawn from the map pending review, and an owner takedown request withdraws one at once. Removed entries are deleted from the published tiles immediately, and because tiles are replaced atomically rather than merged, a removed entry disappears from devices the next time they refresh that area rather than lingering in a stale cache.

7.5 Credentials for community entries

Where a community entry carries a venue passphrase, that credential is stored encrypted on the server and delivered per hotspot on request, rather than baked into the public tile. That is what makes a takedown effective: revoking one record removes it everywhere, instead of it surviving in every tile every device has already cached.

7.6 Leaderboard and profile photos

Contributing earns points, and contributors appear on a public leaderboard covering the last ten days. Your entry shows the display name you choose, your avatar colour, a country flag and, if you add one, a profile photo. Leave the name blank and the leaderboard shows a generated "Contributor 1234" name instead. You can change the name, the colour and the photo at any time from your profile, and a change appears on the leaderboard within seconds.

A profile photo is optional. It is reduced on your device before upload, stored on our server under a name derived from its content, and shown to everyone who opens the leaderboard. Anyone can report a photo from the leaderboard; a photo reported by several people is hidden pending review, and a moderator can delete a photo and block the same image from being uploaded again. Remove your photo at any time from your profile; Delete everything removes it too.

7A WiFi Chat (Peer-to-Peer Messaging)

WiFi Chat lets you talk with people on the same Wi-Fi network, or close by with no network at all. It is built so that we are not part of the conversation: there is no chat server, and no message, contact list or chat identity is ever sent to us or stored by us.

7A.1 How messages travel

• Same Wi-Fi. Phones on one local network find each other by broadcasting short presence packets on the local network and exchange messages directly. The traffic stays inside that network; it is not routed over the internet.
• Nearby (optional). If you turn it on, Google Nearby Connections links your phone with phones close by over Bluetooth, Bluetooth Low Energy and Wi-Fi Direct. Google Play services provides the radio connection; message content is opaque bytes to it, and direct and group messages are encrypted before they are handed over. Phones may relay encrypted packets for each other so that people a few phones apart can still be reached.
• Because there is no chat server, messages can only arrive while the App is running. For a few minutes after you leave the App it keeps listening and shows a notification for new messages. If you turn on Stay reachable (Settings → Notifications, off by default), it keeps listening in the background, with an ongoing notification you can turn off at any time. Chat notifications are created on your phone from messages your phone received; no message passes through us or through a push service. A direct message to someone who is out of range waits on your phone until you are both in range with the App running.

7A.2 Who can see what

7A.3 Identity and verification

Your chat identity is a pair of keys generated on your phone and held in Android's hardware-backed Keystore; your chat ID is derived from the public key, so nobody can claim it without your device. Every packet is signed with that key and checked by the receiving phone. Each direct conversation shows a safety code derived from both people's keys; if the codes match on both phones, nobody is in between.

7A.4 Storage and deletion

Messages are stored in a local database on each phone in the conversation, up to the newest 2,000 per conversation. Deleting a message, clearing a chat or deleting a chat removes it from your phone only; the other phones keep their copies, exactly as with a letter you have sent. Chat settings → Delete all chats and Settings → Privacy → Delete everything erase every chat, remembered person and your chat keys, and give you a new chat identity.

7A.5 Safety, blocking and what we cannot do

You can block anyone from their profile card or a chat's menu; their packets are then dropped by your phone and they can no longer see you online. They are not told. Because chats never pass through us, we cannot read, moderate, retrieve, restore or disclose any message, including in response to a legal request — there is no copy for us to have. The rules for conduct in chat are in the Community Guidelines. If you receive threats or illegal content, block the sender and, where appropriate, report it to local authorities with screenshots from your phone.

8 Password Vault & Encryption

The vault holds network credentials that you typed, generated in the App, or scanned from Android's own share-WiFi QR code. It is entirely local.

8.1 How entries are protected

• A random 256-bit key is generated on your device and held in flutter_secure_storage, which on Android is backed by EncryptedSharedPreferences — the key material is wrapped by the Android Keystore and does not leave the device.
• Each passphrase is encrypted with AES-256 in counter mode under a per-entry nonce, then authenticated with an HMAC-SHA256 tag computed over nonce ‖ ciphertext. Encrypt-then-MAC means a tampered record fails to verify rather than decrypting to garbage.
• Only the ciphertext is written to the local database. The key is never written into it.
• Nothing in the vault is uploaded, synced, backed up to our servers, or shared with any third party.

8.2 What this protects against, and what it does not

This design protects your vault against another app reading the database file, and against an attacker who obtains the database without the Keystore-held key. It does not protect against malware running with root privileges on your device, nor against someone who has your unlocked phone in their hands. Keep a screen lock enabled.

8.3 Device backup

Where Android's backup mechanism is enabled on your device, encrypted values may be included in a device backup by the operating system. That backup is governed by Google's terms, not ours, and the ciphertext remains unreadable without the corresponding Keystore key.

9 Advertising & Consent

The free version of WiFi Map & Chat displays advertising supplied by Google AdMob. Advertising is removed entirely for anyone holding the Remove Ads or Pro purchase.

9.1 What AdMob receives

• Android Advertising ID (AAID) — a resettable identifier you control
• IP address, used for ad delivery and coarse country/region inference
• Device model, OS version, language, screen characteristics
• Ad interaction and performance events (impression, click, completion)
• The consent choices you made in the Google consent form

This information is processed by Google under Google's own privacy policy. We do not control it, and we do not receive the underlying identifiers back.

9.2 Consent (UMP)

The App initialises Google's User Messaging Platform before any ad is requested. Where you are in the EEA, the UK, Switzerland, or a US state with an applicable privacy signal, UMP presents the appropriate consent or preference form and records your choice. If consent cannot be resolved, the App treats that as a refusal and does not request ads — it does not fall back to serving them anyway.

You can revisit your choice at any time from Settings → Privacy → Ad privacy options inside the App.

9.3 Mediation partners

AdMob mediation may be used to fill inventory from additional advertising networks. Where mediation is active, the participating networks receive the same categories of advertising data listed above under their own privacy policies. The current mediation partners are listed on the Data Safety Declaration page and kept up to date there.

9.4 Opting out

• Reset or delete your Advertising ID: Android Settings → Privacy → Ads. Deleting it stops personalised advertising; you will still see non-personalised ads.
• Change your consent choice in the App at Settings → Privacy.
• Remove ads entirely with a one-time purchase (§12).

9.5 How ads behave

Rewarded advertising is always opt-in, always states the reward before it plays, and always presents a decline option at equal visual weight. No core feature of the App sits behind an advertisement. No advertisement is shown on the consent screen, the prominent-disclosure screen, a permission screen, the paywall, or while a measurement is running.

10 Analytics & Diagnostics

The App uses Firebase Analytics, Firebase Crashlytics, Firebase Remote Config and Firebase Cloud Messaging.

Notifications made on your phone

Most notifications are created by the App itself, on your device, with nothing sent to us: chat messages; a short note when you join a Wi-Fi network (the App does not read the network's name for this); new spots on the public map around where you last opened the Map tab, checked against the same public map files the Map tab downloads; and occasional reminders if you have not opened the App for a while, which stop after 30 days. Reminders, Wi-Fi notes, new-spot alerts and "someone joined your Wi-Fi" alerts are limited to a few a day in total and are held back during quiet hours. All of these can be turned off individually, or all at once, in Settings → Notifications, or in Android's own notification settings. Delete everything cancels every scheduled notification.

Analytics events are not tied to your name, email or any identifier you supplied, because you never supplied one. Crash reports are used to fix defects and are not used to build a profile of you.

Turning analytics off

Analytics collection follows your advertising consent choice. If you decline consent in the Google-provided form — or if consent cannot be resolved — analytics is switched off along with advertising, and Firebase is instructed to reset the app instance ID. You can revisit that choice at Settings → Privacy → Ad privacy options, which appears wherever privacy law entitles you to change it.

You can also stop collection entirely by revoking the App's network access at the operating-system level, or by uninstalling. A dedicated analytics switch, independent of ad consent, is planned; this Policy will be updated when it ships.

11 Third-Party Services

Each service below operates under its own privacy policy. We have no control over their practices and encourage you to read them.

We do not sell personal information, and we do not share it for cross-context behavioural advertising beyond the advertising described in §9, which is subject to your consent choice.

12 In-App Purchases

WiFi Map & Chat offers two one-time, non-consumable products. There is no subscription and nothing auto-renews.

All payment processing is performed by Google Play Billing. We receive only the purchase state, product identifier and purchase token. We never see or store your card number, billing address, bank details or Google account.

Entitlement is stored locally and re-verified against Google Play. Refunds are governed by the Purchase & Refund Policy.

13 Data Retention

Where a longer period is required to comply with a legal obligation, to resolve a dispute, or to enforce our agreements, we retain the minimum necessary for that purpose and no longer.

14 Legal Basis for Processing

Where the EU or UK General Data Protection Regulation, India's Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025, or a comparable law applies, we rely on the following bases:

Under the DPDP framework, we act as a Data Fiduciary for the limited personal data described in §3, and the notice requirements of that framework are satisfied by this Policy together with the in-app disclosure and consent screens. Where processing rests on consent, you may withdraw it at any time — through the App's Settings, through Android's permission settings, or by writing to us. Withdrawal does not affect processing carried out before withdrawal, and may limit features.

15 Your Rights

Depending on where you live, you may have the right to access, correct, delete, restrict, port or object to the processing of your personal data, to withdraw consent, to nominate another person to exercise your rights on your behalf (DPDP), and to complain to a supervisory authority. Because the App holds almost everything locally and has no account, most of these you can exercise directly and instantly:

To exercise a right that needs our involvement, email contact@epsilondevelopers.xyz with enough detail to locate the record — for server-side data, that means your install ID, which is shown at Settings → About this app, then long-press the version number. We do not ask for identity documents; the install ID is the only thing that ties a server record to a device, and possession of it is what we can verify.

If you are unsatisfied with our response you may complain to your local supervisory authority — in India, the Data Protection Board of India; in the EEA or UK, your national data protection authority.

16 Deleting Your Data

There are three routes, and full instructions are on the Data Deletion page.

1. In-app, immediately. Settings → Privacy → Delete everything removes every local database — including all chats and your chat keys — the vault (including its encryption key), cached tiles and queued uploads, and asks our server to remove your leaderboard photo. If you are offline at that moment, the photo is removed the next time you open your profile with a connection.
2. Uninstall. Android's sandbox model removes all App data on uninstall.
3. Server-side records. Email us your install ID and we will delete the contributions, votes, reports, speed samples, leaderboard entry and profile photo associated with it, within 30 days. Published hotspot entries that other users have since corroborated may be retained in de-identified form, with your install ID severed from them, so that the community dataset does not lose verified public venue information — you may still request full removal of a specific entry and we will action it.

17 Children's Privacy

The App is not directed to children. It is rated for a general audience, is not enrolled in Google Play's Designed for Families programme, and is not tagged for child-directed treatment in AdMob.

We do not knowingly collect personal data from a child under 13, or under the higher age of digital consent applicable where you live — 16 in several EEA states, and 18 under India's DPDP Act, which requires verifiable parental consent for a child's personal data and prohibits behavioural advertising directed at children.

WiFi Chat lets people talk with others nearby whom they may not know. It is intended for users aged 13 and over (or the higher age above, where it applies), and the App's content rating reflects that users can interact.

If you believe a child has used the App and that personal data has been collected, write to contact@epsilondevelopers.xyz and we will delete it promptly.

18 International Data Transfers

We are based in India. The infrastructure we use is globally distributed:

• Cloudflare Workers, D1, R2 and KV run at edge locations worldwide; requests are typically served from the point of presence nearest to you.
• Google (AdMob, Firebase, Play Billing, Maps) processes data in Google's global infrastructure, principally the United States and the EEA.
• Vercel serves this website from its global edge network.

Where personal data is transferred out of the EEA or UK, the transfer relies on the safeguards our processors maintain — principally the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where applicable, the EU–US and UK–US Data Privacy Framework certifications held by those providers. Under the DPDP Act, transfers are made to jurisdictions not restricted by the Central Government.

19 Security

Measures in place include:

• TLS on every network request the App makes.
• AES-256 encryption with HMAC-SHA256 authentication for vault entries, under a key held in Android's hardware-backed Keystore (§8).
• HMAC request signing and per-install rate limits on every write to our server.
• Signed chat packets (Ed25519) and end-to-end encryption for direct and group chats (X25519 + HKDF-SHA256 + AES-256-GCM), with keys held in Android's Keystore (§7A).
• Server-side encryption of community venue credentials, delivered per hotspot rather than embedded in public tiles.
• Data minimisation by design — coordinates rounded before transmission, full BSSIDs rejected at the server, no accounts to breach.
• Android application sandboxing, which keeps local data inaccessible to other installed apps.

No method of electronic storage or transmission is perfectly secure. We do not claim absolute protection, and you remain responsible for the security of your own device, screen lock and network.

20 Breach Notification

If a personal data breach occurs that affects data we control, we will:

• notify each affected user without undue delay, by in-app notice and — where we have an address — by email;
• notify the Data Protection Board of India as required by the DPDP Rules 2025, including an initial intimation without delay and a detailed report within the prescribed period;
• notify the competent supervisory authority within 72 hours where the GDPR or UK GDPR applies;
• describe what happened, what data was involved, what we are doing about it, and what you should do.

Because the App holds no accounts, no passwords of ours, no email addresses and no payment data, the realistic blast radius of a breach of our systems is the community hotspot dataset and the install IDs attached to it.

21 What This App Cannot Do

These limits are technical facts about Android, stated here because apps in this category frequently imply otherwise:

The word "Unlocker" in the App's name refers to unlocking access to public and community-shared WiFi — venue passwords contributed by people entitled to share them, and QR codes you scan yourself. It does not refer to defeating anyone's security.

22 Authorized Use Notice

The App is intended for educational, diagnostic, security-awareness and authorized network administration purposes. You are solely responsible for obtaining every permission, consent and authorization required before analysing, probing, monitoring or connecting to any network, device or host using the App.

By using any feature — the WiFi Scanner, Channel Analyzer, Who's On My WiFi, Ping & Traceroute, DNS & IP Info, Router Access, Network Deep Scan, the Vault or the community map — you confirm that you have the legal right to use that feature against the target in question. Detailed rules are in the Acceptable Use Policy.

23 This Website

This website is a set of static pages hosted on Vercel. It:

• sets no cookies and uses no local storage;
• runs no analytics, no tag manager, no advertising pixel and no third-party tracker;
• loads no third-party fonts or scripts — the stylesheet and the small amount of JavaScript are served from this domain;
• embeds no social widgets and no comment system.

Vercel, as our hosting provider, processes ordinary web server request logs — IP address, user agent, requested path, timestamp — for delivery, security and abuse prevention. That processing is governed by Vercel's privacy policy. We do not receive or analyse those logs for marketing.

Because no cookies are set, no cookie banner is required or shown.

24 Changes to This Policy

We may update this Policy as the App changes or the law does. When we do, we update the "Last updated" date at the top of this page. For material changes — a new category of data, a new recipient, or a new purpose — we will also show an in-app notice and, where consent is legally required for the change, ask for it again rather than assuming it.

Changes take effect on publication. Continuing to use the App after a change means you accept the updated Policy; if you do not, you can stop using the App and uninstall it.

25 Contact & Grievances

Publisher

Epsilon Developers — independent software publishers

Operated by

Satyam Kushwaha & Anurag Mahajan

Country

India

Role under DPDP

Data Fiduciary

Grievance contact

contact@epsilondevelopers.xyz

Response time

Within 7 business days; formal grievances resolved within 30 days

Please put "Privacy request" in the subject line, and include your install ID if the request concerns server-side data. If you are dissatisfied with the outcome, you may escalate to the Data Protection Board of India or to your local supervisory authority.