The short version
- We run no servers.There is no account, no sign-in, no analytics, no advertising and no crash reporting. Nothing BlueHeeler records is sent to us.
- Your scans stay on your phone.The devices it hears, your alerts, history and places are stored on the phone, unless you share them or turn on a feature that does.
- Location is off until you turn it on.Even then, positions are kept on your phone, and leave it only in the optional ways listed below.
- Google is involved in a few places.Google Play (installing the app and buying Pro), Android backup, and an address lookup that runs only when you ask. Each is explained below.
- You are in control.Every optional feature can be turned off, and Turn and Burn wipes everything BlueHeeler holds on your phone.
- We never sell or share your information.We do not have it to sell. We do not use advertising networks, data brokers or analytics companies.
Who we are
BlueHeeler is published by Blue Heeler Software ("we", "us"). This policy covers the BlueHeeler app for Android, distributed on Google Play with the package name com.kosheen.antistalker.
BlueHeeler does its work on your phone. We do not operate any server that the app talks to, and the app sends us none of what it records. When this policy describes information being "kept" or "stored", it means on your own phone, by software you control.
Questions about this policy can go to xredux@protonmail.com.
What BlueHeeler reads
Signals from devices around you
Bluetooth and Wi-Fi devices announce themselves over the air so that other devices can find them. BlueHeeler listens to those announcements and reads:
- device identifiers (Bluetooth and Wi-Fi addresses);
- device names and Wi-Fi network names;
- the kind of device or company a device says it is, and the services it advertises;
- signal strength, and the time each device was heard.
BlueHeeler uses these to recognise trackers, to tell one device from another, and to notice a device that keeps turning up wherever you go. It never looks these identifiers up online and never sends them to us.
Notifications from your security apps Optional, Pro
If you turn on the Security log and give BlueHeeler Android's notification access, it reads notifications only from the security apps you tick, such as a camera, doorbell or alarm app. For each one it keeps the app's name, the notification's title and text, and the time, next to the devices it heard at that moment. That lets you see, for example, that a camera spotted motion while an unknown device was nearby. It ignores every other app. You can withdraw notification access in Android's settings at any time.
What BlueHeeler does not read
BlueHeeler does not read your contacts, messages, photos, files, browsing, call history or accounts. It does not use your phone's advertising ID. The camera is used only if you choose to scan a QR code to join your phones into a Pack, and no picture is kept.
Your location
Use location is off when you install BlueHeeler. It stays off unless you turn it on in Settings and accept Android's location permission. If you do:
- While protection is running, BlueHeeler notes where you are when it hears devices, so it can tell whether one of them has moved with you.
- It asks Android for a fresh, precise position only when it hears a device that matters: a tracker, a device you flagged or pinned, a name you asked it to watch for, or a device that seems to be following you. It asks at most once every two minutes.
- Without Pro, the positions noted with devices are held in the phone's memory only, and are gone when BlueHeeler closes (apart from the rough areas described below).
- With Pro you can turn on Places. BlueHeeler then keeps a numbered point for each place where a tracker or flagged device was heard, so you can build a dated record over time, and you can name each place. Places is off until you turn it on.
- Spot devices you keep seeing works only while Use location is on. It keeps the rough area, to about 2 km, where everyday devices you hear often tend to stay, for up to 60 days, so BlueHeeler can offer to stop warning you about them. Trackers are never remembered this way.
Android, not BlueHeeler, works out your position. If Google Location Accuracy is on in your phone's settings, Android may use Google's location service to do so, as it does for every app on the phone. That is a setting of your phone, outside BlueHeeler.
Android 8 to 11. On these versions, Android shows Bluetooth devices only to apps that hold location permission, so BlueHeeler asks for it there simply to scan. Holding that permission does not turn on Use location. Until you confirm Use location's explanation, any position BlueHeeler sees on these versions is rounded to about 2 km.
What stays on your phone
Everything BlueHeeler records is stored in its private storage on your phone. This table lists each kind of record, why it exists, how long it is kept, and whether Android backup copies it.
| Record | Why it is kept | How long | Android backup |
|---|---|---|---|
| Settings and your device listsTrusted, flagged and pinned devices, your notes on devices, and the names you asked it to watch for | So the app works the way you set it up | Until you change or delete them | Copied |
| Alert historyPro | A record of what was found, across sessions | You choose 7, 30 or 90 days, or forever; 30 days unless you change it. Trackers, flagged devices and other strong evidence are kept until you delete them. At most 1,000 records. | Copied |
| Security logOptional, Pro | Notifications from the security apps you chose, next to the devices heard at that moment | Up to 2,000 entries, trimmed to your history setting | Copied |
| Pack and safety settingsOptional, Pro | The passphrase that joins your own phones, and the Dead Man's Switch setup | Until you change them | Copied |
| PlacesOptional, Pro | Where trackers and flagged devices were heard, with the names and notes you add | Until you delete them, unless you choose 1 year, 90 days or 30 days. A month holding evidence you chose to keep is never removed automatically. | Never |
| Familiar device areas | To offer to stop warning you about everyday devices (needs Use location) | 60 days | Never |
| Positions without Pro | To notice a device that moves with you | Until BlueHeeler closes (memory only) | Never |
| Scanning record | When scanning was on or off, so a saved log can show which times it covers. It holds no device data. | About 2 MB at most; the oldest part is replaced first | Never |
| Diagnostic copiesOff unless you turn them on | Plain-text copies of recent alerts for a bug report. They are written to shared storage, where a file manager or a USB cable can reach them. | Replaced as they update, until you turn them off and wipe or uninstall | Never |
Files you save, such as a log in Downloads or a report you export, are your own files. BlueHeeler does not delete them, and they keep whatever you chose to put in them.
Android backup
Android can copy app data to your Google Account, so it comes back when you replace or reset your phone. If backup is on for your phone, Android copies the records marked "Copied" in the table above: your settings and device lists, alert history, the Security log (including the text of those notifications), your Pack passphrase, your Dead Man's Switch setup, and whether Pro is unlocked. Google stores this copy under its own privacy policy. The same records may also move across when you set up a new phone from your old one.
Places, positions, familiar device areas, the scanning record and diagnostic copies are never copied to a backup or a new phone.
We keep backup available on purpose: a backup has helped people recover a record they needed after their phone was lost or reset. If you would rather not have a copy with Google, turn off backup in your phone's settings (usually Settings, Google, Backup). You can delete an existing copy from the same place or from Google Drive's Backups list.
Versions before 1.0.170. Places, Suggest an address and Play sound arrive in version 1.0.170. In earlier versions, Android backup copies all of BlueHeeler's private data except the scanning record, so it also copies the familiar device areas (rough, to about 2 km) and, if you turned them on, the diagnostic copies. Earlier versions also remind you to turn protection back on after a restart, rather than restarting it themselves.
Good to know. Turn and Burn wipes BlueHeeler on your phone, not the copy held by Google. That copy is replaced the next time Android backs up BlueHeeler, which happens after you open it again. To remove it straight away, delete it in your Google Account.
When information leaves your phone
Nothing BlueHeeler records is ever sent to us. These are all the ways information can leave your phone, who receives it, and when.
| Feature | What is sent | Who receives it | When |
|---|---|---|---|
| Google PlayEvery user | Google Play installs and updates BlueHeeler and knows your Google Account has it. Each time BlueHeeler opens, it checks with Google Play on your phone whether you have Pro. Google's billing software, which BlueHeeler includes for this, may also send Google technical information about those checks, such as which billing steps ran and whether they worked. None of your scans, positions or places are part of this. | When BlueHeeler opens, and when you buy Pro | |
| Buying ProOptional | Google Play handles the whole purchase. We never see your card or payment details. BlueHeeler only learns whether Pro is unlocked. Google gives us the order details it gives every developer, such as the order number, date, price and country, which we use only for refunds, tax and accounts. | Google; order details to us | When you buy |
| Android backup | The records listed under Android backup | Google, in your Google Account | When Android backs up, if backup is on |
| Suggest an addressOptional, Pro | One place's map point. Android also tells Google that BlueHeeler asked, and your phone's language, as it does for every address lookup. Not the place's name, whose place it is, or what was heard there. More detail | Google, through Google Play services | Only when you tap Send to Google, which BlueHeeler asks every time |
| Open in another app | One position, never its name | The maps app you pick. For example, Google Maps may save it to your Google Account activity. | Only when you tap it |
| Save, share, AI Triage and reports | What you choose to include. A log lists device identifiers, names, signal strength, the scanning record, your history and Security log entries. Positions are included only if Include locations is ticked (it starts ticked for Save and unticked for Share), or if coordinates are on in a Places report. AI Triage, a log written for an AI assistant to read, never includes coordinates, place names or notes. | Whoever, or whatever app, you share it with. That app's own policy then applies; an AI chat app, for instance, may keep what you give it. | Only when you choose |
| PackOptional, Pro | A short Bluetooth heartbeat, described under Signals BlueHeeler sends | Your own phones nearby, and any receiver within Bluetooth range | While Pack is on and scanning |
| Dead Man's Switch distress actionOptional, Pro | Opens the message, call or link you set up. It adds no scan data. | The person or service you chose | Only if you miss a check-in you set up |
Suggest an address in detail
With Pro, a place's page can show a Suggest an address button; you can hide it in Settings, Location and Places. Each time you tap it, BlueHeeler first asks whether to send that place's map point to Google. Only if you tap Send to Google does it pass that one point to Android's address lookup, which Google Play services runs, so the point goes to Google over the internet, even with Location turned off. Google Play services makes the request from your phone, so Google may keep the point and link it to your phone, under Google's privacy policy. Once you tap Send to Google, the point may reach Google even if you then tap Cancel or no answer comes back.
The answer is Android's best guess at the nearest street address. It stays a suggestion until you save it as the place's name, and every log and report marks a name that started from one. BlueHeeler never looks up an address by itself: not while recording, and not when you save, share or delete anything. It shows the button only where the phone's address lookup is Google's, or where it cannot tell. A replacement for Google Play services that presents itself as Google's, such as microG, would receive the point instead of Google.
Links in the app, such as this policy or the Google Play page, open in your browser only when you tap them. The in-app help is built in and loads nothing from the internet.
Signals BlueHeeler sends
BlueHeeler mostly listens. It sends radio signals of its own only in these cases:
- Pack Optional, Pro lets your own phones work together over Bluetooth, with no internet and no cloud. While it is on, each phone broadcasts a heartbeat holding a random Pack ID, its compass heading and signal calibration, its Tripwire state, and up to 16 recent sightings, each made of the last half of a device's Bluetooth address with its signal strength and age. If Use location is on, the heartbeat also carries your position, rounded to about 2 km. If you turn on trust sharing, it also shares which devices you trust or labelled. Heartbeats are signed with your Pack passphrase, so a stranger cannot inject fake ones, but they are not encrypted: anyone nearby with the right equipment can read them. Leave Pack off if you do not want this on the air.
- Play sound: when you tap it, BlueHeeler connects to that tracker and sends the command that makes it ring, and a stop command if you ask. It never pairs with the tracker.
- Read tracker details Off unless you turn it on: connects briefly to a known tracker to read its maker, model and firmware, at most once a day per device. It reads only; the tracker may log your phone's Bluetooth address.
- Wi-Fi scans: to see Wi-Fi devices, BlueHeeler asks Android to scan, and Android asks nearby networks to identify themselves, as it does for any Wi-Fi scan.
The version on Google Play never transmits Wi-Fi frames of its own.
Google and other companies
BlueHeeler shares nothing with advertising networks, analytics companies, data brokers or crash reporting services, and has none built in. The only company that receives anything because of BlueHeeler is Google, in the ways listed above: Google Play and its billing software, Android backup, the optional address lookup, and, if Google Location Accuracy is on in your phone, Android's location service. Google handles that information under the Google Privacy Policy, and you can review and manage much of it at myaccount.google.com.
When you share something from BlueHeeler to another app, that app's own privacy policy applies.
Permissions
These are the permissions BlueHeeler holds and why. Android asks for your agreement before BlueHeeler can use most of them. You can withdraw any of them in Android's settings; the features that need them then stop.
| Permission | What BlueHeeler uses it for |
|---|---|
| Nearby devices (Bluetooth) | Finding Bluetooth devices and trackers; Play sound and Read tracker details; the Pack heartbeat. Android 12 and later; BlueHeeler declares that it does not use Bluetooth scans to work out your location. |
| Nearby Wi-Fi devices and Wi-Fi state | Finding Wi-Fi networks and devices, and starting Wi-Fi scans. On Android 13 and later, declared as not used for location. |
| Location (precise or approximate) | Use location and Places, as described under Your location. On Android 8 to 11, also required by Android just to see Bluetooth devices. BlueHeeler never asks for "all the time" background location. |
| Notifications | Showing alerts and the ongoing notice that protection is running |
| Foreground service, including location | Keeping protection running with the screen off, and noting positions while it runs when Use location is on. On Android 10 and 11, Android also requires it for scanning while BlueHeeler is closed; that reads no position unless Use location is on. |
| Start at boot | Bringing protection you had on back after your phone restarts or BlueHeeler updates. Stopping it yourself always wins. |
| Battery optimisation exemption | Asking Android not to stop protection to save battery. Only if you agree. |
| Notification access Optional | The Security log, from the apps you tick only |
| Camera Optional | Scanning a QR code to join a Pack. No picture is kept. |
| Fingerprint or face | Unlocking Places. Android checks it; BlueHeeler never sees your fingerprint or face. |
| Internet and network state | Not used by BlueHeeler's own code. Included by Google's billing software, which uses it to reach Google Play. |
| Glyph lights | On Nothing phones, flashing the rear lights for an alert |
How your information is protected
- BlueHeeler's records sit in its private storage, which Android keeps apart from other apps and encrypts along with the rest of your phone.
- Places can be locked behind your fingerprint, face or screen lock. The lock is on when you start using Places, and locks again after 10 minutes without use. Reports and logs that include places ask for it too.
- Pack heartbeats are signed (HMAC-SHA-256), so a stranger cannot inject false data. They are not encrypted, as explained above.
- Diagnostic copies, if you turn them on, are written where other apps with file access and a USB connection can read them. Leave them off unless you need them for a bug report.
- Anyone who can unlock your phone can open BlueHeeler. If you are worried someone has access to your phone, use the Places lock and consider Turn and Burn.
No security is perfect, and files you save or share are outside BlueHeeler's protection once they leave the app.
Your choices and deleting data
- Turn features off at any time in Settings: Use location, Places, Spot devices you keep seeing, Pack, the Security log, Read tracker details, diagnostic copies and Suggest an address.
- Delete selectively: one place or all places, your history, or a device from any list.
- Choose how long history and places are kept.
- Turn and Burn (switched on in Settings before use) stops protection, then overwrites and deletes everything BlueHeeler holds in its storage on your phone: settings, lists, history, the Security log, places, familiar device areas, the scanning record and diagnostic copies. It does not remove files you saved to Downloads, the copy in your Google backup, your Pro purchase (Google Play restores it), or a random Pack ID that means nothing on its own. Phone storage spreads writes around to protect itself, so no app can promise every trace is physically erased.
- Uninstalling removes everything BlueHeeler stored on your phone, except files you saved to Downloads or shared. The Google backup copy is removed by Google in time, or straight away by you.
Your privacy rights
Depending on where you live, privacy law, such as Australia's Privacy Act, the GDPR in the European Union and United Kingdom, or California's privacy laws, may give you the right to see, correct, delete or take a copy of personal information about you, and to object to how it is used.
Because BlueHeeler keeps your information on your phone, you can use those rights yourself, straight away: view everything in the app, export it with Save log or a report, and delete it as described above. We hold nothing about you from the app, so a request to us would find nothing to return. We do not sell or share personal information, and we make no automated decisions about you.
For information Google holds, such as your Play purchases, backups and address lookups, use Google's tools at myaccount.google.com.
If you email us, we receive your email address and whatever you write. We use it only to reply and help, and keep it only as long as that takes. If you are unhappy with how we handled your information, please tell us first; you can also complain to your local privacy regulator, which in Australia is the Office of the Australian Information Commissioner (oaic.gov.au).
Information about other people
The devices BlueHeeler hears belong to the people around you. It uses their broadcast signals only to protect you, and only on your phone. If you save or share a log or report, it may contain identifiers of other people's devices, so please share it only with those who need it, such as the police, a lawyer or a support service.
Children
BlueHeeler is made for adults and is not directed at children. We do not knowingly receive information from children, and the app sends us nothing from anyone.
Changes to this policy
When BlueHeeler changes how it handles information, we update this page and the date at the top no later than the new version reaching Google Play. Significant changes are also described in the app's release notes.
Contact us
Blue Heeler Software
Email: xredux@protonmail.com