Privacy Policy

20.07 — last updated 2026-08-10 (v0.7.28-dev)

Plain-language summary, before the detail below: 20.07 has no servers of ours, no accounts, and no company on the other end collecting anything. Everything the app processes — your location, photos you choose to share, who's in your group — either stays on your phone or goes directly, encrypted, to the other phones in your own group over Bluetooth. There is nothing for us (the developers) to see, sell, or hand over, because nothing is ever sent to us.

One optional exception, off by default: if you turn on Internet reach, your phone can also send your group's end-to-end-encrypted messages and live locations over the internet through public relay servers that other people run (not us), so group members who are out of Bluetooth range can still reach each other. See "Optional: Internet reach" below.

Who this is

20.07 is an open source project (MIT licensed) maintained on GitHub. There is no company operating this app, no server infrastructure of ours, and no data processor other than your own phone and the phones of people in your group, unless you switch on the optional Internet reach feature, in which case the public relay servers described below (run by others, not us) also handle your group's encrypted data. Contact details are at the bottom of this page.

What the app processes, and why

Data	What happens to it
GPS location	Read to power the radar (finding your group). Held in memory only, never written to disk, expires automatically after a short window even in memory, and is gone the instant the app is closed. Shared only with your group's other members, encrypted, over Bluetooth — never to any server, because none exists.
Photos	Only photos you explicitly pick to share. Compressed, encrypted, and sent to your group's other members over Bluetooth. Never uploaded anywhere; never processed by anyone but your group.
Bluetooth identifiers	The app advertises a rotating, meaningless-looking identifier over Bluetooth (changes every 60 seconds) so it can be found by other members of your group. This is deliberately not a stable, trackable device ID — it's designed so an outside observer can't follow one phone over time.
Nicknames / group membership	Whatever name you set is shared only with your own group's members, encrypted. Groups are ephemeral — they expire automatically (a lifetime you choose when creating one, 12 hours to 6 months) and everything about that group is deleted from every member's phone at that point.
Camera	Only used if you tap the QR-scan icon to join a group by scanning a code. No photo or video is ever saved from this — frames are read and discarded on the spot. Camera access isn't requested at all unless you use this specific feature.

What the app does not do

No accounts, no sign-up, no phone number or email collected, ever.
No analytics, no crash-reporting SDKs, no advertising SDKs of any kind.
No data is ever sent to the developers, to any server, or to any third party — there is no server for anything to go to.
No persistent device identifier is used or shared — Bluetooth identifiers rotate every 60 seconds specifically so nothing about your phone can be tracked over time by an outside observer.
No location history is ever stored — positions live in memory only and are never written to any database, log, or file.

Optional: Internet reach (off by default)

This feature is off until you turn it on, and the app works fully without it. When on, your phone connects over Wi-Fi or mobile data to public Nostr relay servers (a small, changing list, for example relay.snort.social and nos.lol) and sends them your group's messages and live locations so that group members who are out of Bluetooth range can receive them. It can also carry such messages for nearby group members who have no signal, and it works with Bluetooth switched off. Phones that are not in your group, but have Internet reach on, may carry your group's encrypted frames over Bluetooth and upload them for you; they can see rotating group tags, message sizes and timing, but never content, names or positions.

What the relays can see: your phone's internet (IP) address, the timing and size of what is sent, and a short rotating code that stands in for your group. They cannot read messages or locations: those are encrypted with your group's key before they leave your phone. We do not run these relays and cannot control how they handle or keep what they receive. Some relays keep what they are sent, possibly until a message's expiry (the app sets 7 days) or longer, which is why everything is encrypted for your group and the group codes are short-lived.
What we, the developers, see: nothing. No data is sent to us.
Your group members must also have Internet reach turned on to be reached this way.
Cost: it uses mobile data and some battery while on. You can turn it off any time with the Internet tile on the home screen; the app then behaves exactly as before.
It uses a throwaway signing key, replaced every 7 days, only to sign what it sends to relays. The key does not identify you and protects no message content.

Permissions the app requests, and why

Internet and network state — used only for the optional Internet reach feature above, and only when you turn it on.
Bluetooth (scan/advertise/connect) — the entire mesh network runs over this. Required for the app to work at all.
Location (including background) — powers the radar/navigate feature. Declining it still lets the rest of the app work, with a distance-only ("hot/cold") fallback instead of a directional radar.
Camera — opt-in, only for scanning a QR join-code. The app is fully usable without ever granting this.
Notifications — required to keep the mesh running reliably in the background (a persistent low-priority notification while the app is active), and for SOS alert sounds.

Full technical detail on all of this, including the actual cryptography used, is in the project's Security model and Permissions sections on GitHub — this page is a policy summary, that's the full engineering detail.

Data sharing and third parties

The only "sharing" that happens is phone-to-phone, over Bluetooth, encrypted, with the members of a group you created or explicitly joined with a shared code. Phones that are not in your group but happen to be running 20.07 nearby may relay your encrypted data for you (this is how the mesh extends beyond direct Bluetooth range) — they can pass your data along but cannot read it, since they don't hold your group's key. No one outside your group — including us — can read anything.

Data retention and deletion

Groups expire automatically at a lifetime you choose when creating one (12 hours to 6 months). When a group expires, or when you delete it manually, every member's own app deletes that group's key, messages, and photos on its own device — there is no server copy to separately delete, because none ever existed. Uninstalling the app deletes everything immediately and completely.

Children's privacy

20.07 does not knowingly collect any personal information from anyone, including children, for the simple reason that it does not collect personal information from anyone at all — there is no account system and no server to collect it into.

Changes to this policy

If this policy changes, the updated version will be posted at this same URL with a new "last updated" date above. Given how the app itself works (no accounts, nothing to notify you through), checking this page directly is the way to see updates.

Contact

Questions: open an issue on GitHub. Security concerns specifically: see SECURITY.md for private reporting instructions.