Document the attacker.
Hash everything of yours.
Exactly what leaves your device, when, in what form, and for how long it can be tied to you. No categories of convenience — the actual fields.
Three kinds of report. Three levels of guard.
Collection happens only when the app detects an attack, plus hashed observations of nearby networks during scans. What a report contains depends on whose hardware it describes.
When the app confirms an attack run from a rogue or fake hotspot — hardware that is not your network — the report documents that access point in full: its real network name (SSID), its hardware address (BSSID/MAC), technical radio details (channel, band, security mode, hardware vendor, signal data), and the approximate area where it was seen — a zone of roughly 150 m to 1 km, never an exact position.
When the attack targets your own network, the report contains only one-way cryptographic hashes of the network’s name and hardware address — the real WiFi name and router address never leave your device — plus the same technical radio details and an approximate area of about 1 km.
Networks the app merely observes while scanning are recorded as one-way hashes only, never real names.
Off the table, categorically
Only when an attack is detected
The app does not stream telemetry about your day-to-day use. Threat reports are created only when the app detects an attack, plus the hashed nearby-network observations made during scans. Contributing those reports to the shared threat database is a required, non-optional part of the free app — it cannot be turned off, because every warning in the database exists only because someone’s device reported it. That requirement is stated in the Terms of Service, not hidden here.
Full detail on the attacker. Hashes for you.
The two sides of a report are deliberately unequal. A rogue access point is the attacker’s equipment — naming it precisely (real SSID, BSSID, radio fingerprint, approximate area) is what lets other devices recognize the same hardware when it reappears and warn people before they connect. Your own network is the victim’s — so it crosses to our servers only as a one-way hash, a fingerprint that can be matched but never reversed into a name.
That is the line the guarded collection model walks: document the hunter, hash the hunted.
Linked for 90 days at most, then anonymous forever
Individual reports are linked to the reporting account internally for a maximum of 90 days. That link is used solely for abuse prevention — detecting accounts feeding false or malicious reports into the database — and for nothing else. After 90 days the link is removed and the report is permanently anonymized; from then on we keep only anonymous aggregate statistics: counts, severity, threat type, and area.
Threat warnings shown to other users never include the reporter’s identity — at any point, including inside the 90-day window. Nothing anyone can look up says who reported what.
What we hold about you directly
If you request early access or create an account, we hold the email address you give us, and use it to provide access, deliver the service, and tell you about material changes — like a new Terms version. Subscription billing is handled by our payment processor; we don’t store your card details.
Questions, or want your account and its data removed: [email protected]. Reports older than 90 days are already permanently anonymized and cannot be traced back to any account — including by us.
The binding commitments behind this page live in the Terms of Service (version 2026-07-08.2). How the shared database actually works is on the Shared Threat Intelligence page.