FlosForge Radar — privacy policy

FlosForge Radar passively receives the Bluetooth advertisements broadcast by nearby devices and stores its findings in two local JSON files on your computer. It has no network access: no accounts, no analytics, no crash telemetry, and no automatic update checks. It never connects to, pairs with, or transmits data to the devices it discovers, and your data never leaves your computer unless you explicitly choose to export it.

What FlosForge Radar collects about you

Nothing. There is no account, no telemetry, no analytics, no crash reporting and no identifier of any kind. The app has no server of its own to send anything to, and it does not phone home to check for updates — the app never checks for them — you download a newer release from GitHub, or pull the source and rebuild, when you decide to.

What it stores, and where

Settings, profiles, and encounter history: radar.json, located in your local app data folder, stores your settings, custom profiles, trusted devices, watched list, alert history, and recent encounter records. Encounters are forgotten after 48 hours, except for devices you are watching.
Signal logs for watched devices: watch.json stores timestamped signal strength readings for devices you have explicitly pinned to your Watch list. Unwatching a device deletes these records immediately.
Demo mode: The simulated demo environment keeps all mock data in a separate demo directory, completely isolated from real scans.
File exports: Exports are generated solely when you request them and saved strictly to the folder you choose in your system file dialog.

Everything it can connect to

FlosForge Radar makes zero background network connections. The only time your internet connection is used is if you explicitly choose to open a link in your web browser:

Web searches you initiate: Clicking “Search the web” opens your default browser on your chosen search engine with the device type, manufacturer ID, or service UUID. It never includes the device’s MAC address, and you can edit the query terms before searching.
Manufacturer prefix lookups: For devices with public Bluetooth addresses, the Identity tab lets you look up the vendor prefix on maclookup.app in your browser. This only transmits the standard three-byte manufacturer prefix (OUI), and only when you click the lookup button.
Documentation and safety guides: Links to official documentation, signature sources, the Bluetooth SIG registry, and Apple or Google tracker-safety support articles open in your default browser.

What never leaves your computer

No telemetry or tracking of any kind: no user accounts, no analytics, no crash reports, and no automatic background pinging.
Radar never pairs with, connects to, or sends data to discovered devices. Like every Bluetooth scanner, the operating system may send standard scan requests, which only ask a device for the rest of its advertisement.
A device’s full MAC address is never included in external links or web searches generated by the app.
The application window cannot initiate network requests, and the background process makes no outbound network connections.

Safeguards

Network-isolated user interface: The application window runs sandboxed and context-isolated, with Node.js integration disabled and a strict Content Security Policy of connect-src 'none'.
Strict link allow-list: The user interface cannot open arbitrary web addresses. Outbound browser links are constructed exclusively by the backend process using a strict allow-list of known search engines and reference guides.
Defensive handling of untrusted radio data: Broadcast names and payloads from nearby strangers’ devices are treated as untrusted input. They are rendered safely as plain text (never raw HTML), spreadsheet formulas in CSV exports are neutralized, Markdown exports sanitize HTML and links, and text exports strip invisible control characters.
Validated internal communications: Every message sent between the user interface and the core desktop process passes through an explicit whitelist of validated function calls.
No administrative or root privileges required: On Linux, Radar interacts with the BlueZ Bluetooth stack over standard D-Bus APIs, requiring no root permissions and leaving your other connected Bluetooth devices undisturbed.

Your rights, and who to ask

Because the app holds nothing about you, there is nothing for the controller to access, correct or erase on your behalf: everything it knows is in files on your own computer, under your own control. Uninstalling the app leaves its local data directory in place. To completely remove all records, delete the FlosForge Radar folder (~/Library/Application Support/FlosForge Radar on macOS, %APPDATA%\FlosForge Radar on Windows, or ~/.config/FlosForge Radar on Linux). This folder contains your settings, profiles, trusted tags, watched devices, alert logs, and encounter history. You can also clear your history anytime from the Alerts page, or unwatch individual devices to remove their signal logs on their own. For anything else, write to hello@flosforge.eu. The site-wide privacy policy covers this website, your rights under the GDPR, and the supervisory authority you can complain to.

Changes

This statement is checked against each release. If a version changes what the app stores or what it can connect to, the version and date at the top change with it.