LocationNinja Privacy Policy
iPhone companion, camera and App Store purchases
The iPhone app uses a companion on your trusted computer for simulation. Pairing uses a local-network WebSocket carrying a private token. QR camera frames are processed on the phone and are not saved or uploaded. The pairing credential and reconnect preference are stored in device-only Keychain; they are not synced through iCloud Keychain or migrated to another device. Keychain data may remain after uninstalling: use Forget computer before uninstalling if you want to remove it. Other app-private files may be included in your Apple device backups under your backup settings.
Simulation commands and destination coordinates travel to your paired computer over your private network. This local connection is unencrypted and requires the private pairing token. The computer uses Apple's developer channel through USB. The companion does not send pairing credentials or simulation commands to our server. Location permission supports the map, return and session operation; Follow Me is unavailable on iPhone. Background location access lets a running session continue while the phone is locked.
For iPhone subscriptions, Apple handles payment; we never receive your card details. The app sends its Apple-signed transaction to our Cloudflare verifier, which verifies its signature, bundle and store environment, then asks Apple for current subscription status. Signed transaction and renewal data include product, purchase/expiry dates, transaction identifiers and renewal or revocation state. Our persistent ledger retains only the credential's SHA-256 hash, product, status, expiry and last-check time, for the purchased term plus 90 days. Raw transaction credentials, account names, email, coordinates and routes are not logged or stored by the verifier. Apple and Cloudflare process connection and service metadata under their policies. Restoring purchases uses the Apple Account that purchased them. Manage or cancel in iPhone Settings → your Apple Account → Subscriptions; uninstalling does not cancel. Custom complimentary access codes described for Android below are not supported in the App Store version.
Who operates LocationNinja
LocationNinja is offered as "LocationNinja by Bridivo". Bridivo is a software brand within the Alsaheel portfolio, not a separate legal entity. The operator of the Android and iPhone apps and the data controller is ABDULELLAH ABDULAZIZ ALSAHEEL ESTABLISHMENT, the organization registered in the existing Google Play developer account (public developer name: Alsaheel Establishment). That same publisher operates the purchase-verification service and the optional anonymous counters described below. Privacy and support contact: support@bridivo.com.
No account, no advertising, no tracking SDK
LocationNinja has no user account, no advertising SDK and no cross-app tracking SDK. It does not read your contacts, messages or the activity of other apps.
What stays on your phone
The app keeps the following in app-private storage on your phone only: settings, saved places, up to ten recent places, saved routes, a bounded cache of routes, a session-restore marker, and the purchase credentials and signed access leases needed for a Pro subscription. Android cloud backup and device-to-device transfer of this data are disabled. Uninstalling the app or clearing its storage deletes this data; it does not cancel a Google Play subscription, which you manage in Google Play. Saved places and routes are not deleted when Pro ends.
Diagnostics are off by default. When you turn the diagnostic log on, a history of simulated fixes is kept in memory only while the app runs. Motion sensor readings used by the experimental dead-reckoning option never leave the device.
What is sent to online services, and why
| Recipient | Data and purpose | When |
|---|---|---|
| Map tile provider you selected (Geoapify by default in 0.3.5 and later; OpenStreetMap Foundation tiles in older defaults) | The map area you look at and connection metadata, to draw the map | While a map is shown |
| Place search provider you selected (Geoapify by default in 0.3.5 and later; Nominatim in older defaults) | The text you submit, your app language, a bias area or a selected point, to find or name places | Only when you submit a search or tap a point |
| Routing and road-snapping provider you selected (Geoapify routing by default in 0.3.5 and later; FOSSGIS Valhalla/OSRM in older defaults or custom configurations) | Your real or simulated start, your chosen destination or waypoints, the travel profile, or candidate offset points, to compute realistic routes, stops and optional road snapping | When you start a travelling simulation, plan a route, assess a stop or enable road snapping |
| Bridivo purchase verifier on Cloudflare, which in turn calls Google Play | Your Google Play purchase token, to check and acknowledge paid access | On purchase, Restore, app start or resume, and periodic rechecks |
| Bridivo anonymous counters on Cloudflare | One event name per request (see "Optional product counts") | Only after you turn measurement on |
Map, search and routing providers receive the locations needed for the feature you use and may keep their own request logs under their own policies. Follow Me with the exact-distance offset computes its offset on the device; its real position is still needed for Return, and a routed transition sends that real start to the routing provider. Optional road snapping sends candidate offset positions. All connections use HTTPS. Cloudflare and Google process connection metadata under their own policies; we do not claim that no infrastructure metadata exists.
The default provider in version 0.3.5 and later is Geoapify. It processes request bodies, headers, IP addresses and timestamps for access control, usage measurement and troubleshooting. Its policy generally retains successful-request data for no longer than 24 hours. See Geoapify’s privacy policy. Default Geoapify routing does not include road snapping or road-aware stopping-place checks; those checks show unavailable. You can configure your own compatible services in Settings.
Purchases and the verification service
Pro features are sold as Google Play subscriptions. Google Play handles payment; we never see your card details. To confirm that a subscription is paid, the app sends the Google Play purchase token to our verifier, which asks Google for the subscription state and acknowledges valid purchases. The verifier stores only a SHA-256 hash of the token, the product, the subscription state, the expiry time and the time of the last check. It does not store the raw token, orders, your e-mail, locations, routes or anything about other apps. Records are removed 90 days after they expire. The verifier's own application logging and log export are switched off; Cloudflare, which hosts it, still processes connection metadata such as IP address and request time under its own privacy policy, and Google processes the verification call under Google's. Restoring a purchase relies on the Google account that bought it.
Complimentary access codes
From version 0.3.4 (16), a reusable code supplied by Bridivo can grant complimentary Pro access without a purchase or account. The app stores the code in app-private storage and sends it over HTTPS to our Cloudflare verifier on activation, app start/resume and periodic rechecks. The server compares a SHA-256 hash to a configured credential hash and returns a signed lease lasting at most 15 minutes. It does not store the submitted code, associate it with a person, or record it as a purchase or analytics event. Codes can be revoked; a fresh online check is required after restarting the app. Remove a saved code in Settings → Access code. This does not cancel a Google Play subscription. Cloudflare connection metadata processing described above also applies.
Optional product counts
Measurement is off by default. If you turn it on in Settings, the app sends one event name at a time from a fixed list: setup completed, first successful simulated fix, upgrade offer viewed, purchase started, verified access, observed renewal, cancellation or expiry, and first use on a later day. No event contains coordinates, routes, the activity of other apps, your purchase token or any identifier. The server keeps only daily totals, for up to 400 days. Turning the switch off stops sending and clears the local counts. Totals already sent carry no identifier, so an individual contribution cannot be found or removed afterwards.
Permissions and visible operation
Location permission is used in the foreground to read your real position for Follow Me and for returning to it. Simulated locations are injected through Android's mock-location mechanism, which only works after you select LocationNinja in Developer options; Android marks these fixes as mock and the app does not hide that flag. A persistent notification shows that the location service is active without showing coordinates or place names. Version 0.3.4 (16) no longer requests background ("all the time") location. A session you start can continue through the foreground service while another app is open. If Android cannot restart the service while the app is closed, a notification asks you to tap to resume. The battery-optimisation exemption is an optional, user-initiated setup step. Older versions offered optional background-location permission for unattended restart.
Your choices and deletion
- Change or remove map, search and routing providers, or use your own Geoapify key, in Settings.
- Turn measurement off at any time in Settings; local counts are cleared immediately.
- Delete all local data by clearing the app's storage or uninstalling.
- Manage or cancel subscriptions in Google Play; verifier records expire and are removed 90 days later.
- For questions or requests, write to support@bridivo.com. Please do not include coordinates or purchase tokens in support mail.
Support email
Support email is optional. Messages to support@bridivo.com are forwarded by Cloudflare Email Routing to the operator’s Google Gmail inbox. The operator and these providers process the sender address, message contents and delivery metadata to handle support. Please do not send coordinates or purchase tokens. Support messages are separate from anonymous product counts and remain in the support inbox until the operator deletes them; the verifier’s automatic retention job does not delete email. You can request deletion through the same support address.
Children
LocationNinja is a general-audience utility and is not directed at children. We do not knowingly collect personal data from children.
Update checks
From version 0.4.1, the app checks our Cloudflare service for the minimum supported Android version, and asks Google Play whether an update is available to your device. The policy request contains no location, purchase token or account identifier; Cloudflare handles connection metadata as described above. Google Play processes device metadata, app version, and installed modules/asset packs to determine update availability and size, under Google’s policies. Google states this data is encrypted, is not shared with third parties and is deleted after a fixed retention period. A last successful check is cached privately on your device. Checks run at startup, on return to the app and periodically while it is open; you can also check in Settings. Installation opens Google Play after you finish any running simulation.
Changes
When data handling changes, this page is updated with a new effective date and the app version it applies to. Earlier versions of the app are described by the policy in effect at their release.