Privacy policy

1. Who we are

CloakDots is provided by Digital Commerce Guild, a sole proprietorship (eenmanszaak) established in the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 94972036.

• Address: Vlierweg 12, 1032 LG Amsterdam, The Netherlands
• Correspondence address: Postbus 79055, 1070 NC Amsterdam, The Netherlands
• VAT number (btw-id): NL005122477B37
• Privacy questions: privacy@cloakdots.com

Digital Commerce Guild is the controller for the personal data described in this policy. In this policy, "we" and "us" mean Digital Commerce Guild.

The name of the proprietor is recorded in the Dutch Commercial Register and is given on request. On the App Store, the seller of CloakDots is shown under the proprietor's personal name, because the developer account is held by the proprietor of Digital Commerce Guild.

2. The short version

• CloakDots works on your phone. What it finds around you stays on your phone.
• We do not receive your scan data, your history or your location. There is no account.
• The app has no advertising, no analytics and no tracking. It contains no third-party code that collects data.
• The only time the app goes online by itself is to download updated device-recognition rules from app.cloakdots.com, at most once a day. Like any internet request, this shows your IP address to Cloudflare, the company that hosts the file for us. Cloudflare uses it only to deliver the file. We do not receive or keep logs of these requests.
• If you email us, we use your message only to answer you.

3. What the app handles on your phone

CloakDots listens for signals that nearby devices broadcast over Bluetooth, and works out what kind of device each one is likely to be. All of this happens on your phone. None of the data in this section is sent to us.

Held in memory only, never saved. While a scan is running, the app briefly holds:

• the Bluetooth addresses of nearby devices, so it can follow one device during a scan;
• the raw signals and names those devices broadcast, so it can recognise the type of device;
• signal-strength readings, so it can place a device in a zone (Immediate, Nearby, Wider or Extended).

The app drops each device from memory 20 seconds after it last hears from it.

Saved on your phone. The app saves:

• What: For each encounter: a code made from a secret, random value (a salted hash), the device category (for example "smart glasses"), how sure the app was, the time it was first and last seen, the closest zone it reached, and whether you were moving or still. Why: To show your history and Insights without keeping any identifier of the device. How long: 30 days. You can set this to between 7 and 30 days.
• What: Daily totals per category. Why: To draw charts quickly. How long: 12 months.
• What: Your settings: range, units, theme, notification switches, quiet hours, history period, the device types you chose to show, and one-off flags (for example, that you have seen the intro). Why: To remember your choices. How long: Until you change them or delete the app.
• What: The time of the last rule-update check. Why: To check for updates at most once a day. How long: Replaced at each check; removed when you delete the app.
• What: The device-recognition rules (the built-in file and the latest downloaded file). Why: To recognise device types. How long: Replaced by each update.
• What: The secret value used for the salted hashes, and the key for the database. Why: To keep your history secure. How long: Until you delete the app.

Your history is kept in an encrypted database. The secret value and the database key are kept in the phone's secure storage (the iOS Keychain or the Android Keystore).

Never saved, anywhere. The app never saves your location, Bluetooth addresses, device names, raw broadcast signals, or the brand or model names of devices it detects. It has no access to your camera or microphone, and it saves no images, audio or video.

Notifications. Notifications are created on your phone. We do not use a push server, and we receive nothing when a notification is shown.

4. Backups and new phones

• iPhone: your settings (not your history) are part of your own iCloud or computer backup, and move with you to a new iPhone, like other apps' settings. Your history, the database key and the secret value are left out of backups and transfers.
• Android: nothing from CloakDots is included in cloud backup or in a transfer to a new phone.

In both cases, none of it reaches us.

5. Other people's devices

CloakDots only receives what nearby devices broadcast openly over Bluetooth. It never connects to other people's devices, and it never saves their identifiers. We never receive any data about other people's devices.

6. What reaches us, and why

(a) Rule updates. At most once a day, the app asks app.cloakdots.com whether new device-recognition rules are available, and downloads them if they are. The request is the same for every user. It carries a fixed, generic app description and language setting, and no cookies, parameters or identifiers for you or your phone. Like any internet request, it shows your IP address to our hosting provider. Your IP address is used only to deliver the file. Apart from this download, the app makes no internet requests.

(b) Our web pages. When you open the privacy policy, terms or support pages on app.cloakdots.com, your browser sends your IP address, its browser description and the page requested. The app opens these pages in your phone's browser, not inside the app. The pages use no cookies, no scripts and no analytics, and load nothing from other companies.

(c) Email. If you write to support@cloakdots.com or privacy@cloakdots.com, we receive your email address, your message and anything you choose to include. We use it only to answer you. Please do not send us exports of your history unless we need them to help you.

(d) App stores. Apple and Google handle your download of CloakDots under their own privacy policies. If you have chosen in your phone's settings to share diagnostics with app developers, Apple or Google may give us crash reports and statistics about the app, such as the number of downloads per country. These do not identify you to us, and we use them only to improve the app.

You do not have to give us any personal data to use CloakDots. We do not sell personal data, we do not use it for advertising, and we do not make automated decisions or profiles about you.

7. Legal bases

• Rule updates and web pages (6a, 6b): our legitimate interest in keeping device recognition up to date and in offering support pages (Article 6(1)(f) GDPR). The data involved is minimal and short-lived, and we keep no logs.
• Email (6c): our legitimate interest in answering you, or taking steps you ask for (Article 6(1)(b) and (f) GDPR). When you use a privacy right, we use your request to meet our legal obligations (Article 6(1)(c) GDPR).
• App store statistics (6d): our legitimate interest in keeping the app working well (Article 6(1)(f) GDPR).

8. Who else is involved

Cloudflare. Cloudflare, Inc. (United States) hosts app.cloakdots.com for us as our processor, under a data processing agreement. Cloudflare's servers are located around the world, so your request may be handled in a data centre outside the European Economic Area, usually the one nearest to you. Transfers to the United States rely on the EU-U.S. Data Privacy Framework (and, for Switzerland and the United Kingdom, the Swiss-U.S. Data Privacy Framework and the UK Extension to it), with the European Commission's Standard Contractual Clauses as a fallback. Cloudflare may also keep limited technical records under its own privacy policy to secure and operate its network: www.cloudflare.com/privacypolicy/

Our email provider. Our email provider stores and delivers our email as our processor, under a data processing agreement.

Apple and Google. They run the App Store and Google Play under their own privacy policies.

We do not share personal data with anyone else, unless the law requires it.

9. How long we keep data

• Rule updates and web pages: we keep none of this data, and we have no access to Cloudflare's request records.
• Email: we keep emails for 12 months after the conversation ends, then delete them. If an email is needed to show how we handled a privacy request, we keep it for as long as that is needed.
• App store statistics: kept by Apple and Google in their developer tools, for the periods they set.
• Data on your phone: see section 3. You control it (section 11).

10. Permissions

• Permission: Bluetooth (iPhone) / Nearby devices (Android). Why: To receive what nearby devices broadcast over Bluetooth. On Android, the app declares that it never uses Bluetooth to find your location. If you say no: The app has nothing to scan.
• Permission: Notifications. Why: To tell you when something changes. If you say no: CloakDots shows changes only while it is open.
• Permission: Motion & fitness (iPhone) / Physical activity (Android, only if needed). Why: To tell moving from still, so patterns in Insights make sense, without location. If you say no: Insights shows patterns without the moving/still split.
• Permission: Internet (Android, granted automatically). Why: Only for the rule download in section 6(a). If you say no: Not applicable.

CloakDots never asks for your location, camera, microphone, contacts or photos, and never asks to track you.

11. Your controls

• History period: choose how long history is kept, from 7 to 30 days.
• Delete all history: removes every encounter and daily total from your phone straight away.
• Export: saves your history as a file that you can share or keep. The file contains categories, times and zones, never identifiers of other people's devices. Once you share it, it is under your control.
• Notification switches and quiet hours: choose what, if anything, CloakDots notifies you about.
• Deleting the app removes everything the app saved on your phone. On iPhone, an earlier backup may still hold your settings (never your history) until you delete that backup. If you reinstall CloakDots on an iPhone, the app replaces its secret value and removes any old data on first launch.

12. Your rights

You have the right to ask for access to your personal data, and to have it corrected, deleted or restricted. You also have the right to object to our use of it, and to receive it in a portable format. You can object at any time to the rule-update request; the practical way to stop it is to delete the app.

Because we receive almost no personal data, the honest answer to most requests will be that we hold nothing about you. We will still answer every request, within one month. We ask for extra information only if we need it to answer you.

To use a right, email privacy@cloakdots.com.

You can also complain to a supervisory authority. Ours is the Autoriteit Persoonsgegevens in the Netherlands (autoriteitpersoonsgegevens.nl). You can also complain to the authority in the country where you live or work. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). In Norway, it is Datatilsynet. In the United Kingdom, this is the Information Commissioner's Office (ICO). If you live elsewhere, you have the rights described here, plus any further rights that your local law gives you, such as Brazil's LGPD, and you can contact your local data protection authority.

13. Children

CloakDots is meant for people aged 16 and over. We do not collect personal data about anyone through the app, including children. If a child has emailed us and a parent or guardian wants that email deleted, please write to privacy@cloakdots.com.

14. Security

The app encrypts your history on your phone, and keeps its keys in the phone's secure storage. Rule updates are downloaded over an encrypted connection and are digitally signed, and the app checks the signature before using them.

15. Changes to this policy

When we change this policy, we publish the new version on this page with a new version number and effective date. Earlier versions stay available at app.cloakdots.com/privacy/versions/. For important changes, we will also tell you in the app, for example in a release note.

We plan to transfer CloakDots to a company that will continue it, CloakDots B.V. When that happens, CloakDots B.V. will become the controller. We will tell you in advance with a new version of this policy and a release note in the app. The way the app handles your data will not change because of the transfer.

16. Contact

• Privacy questions: privacy@cloakdots.com
• Other questions: support@cloakdots.com
• Post: Digital Commerce Guild, Postbus 79055, 1070 NC Amsterdam, The Netherlands
• Address: Digital Commerce Guild, Vlierweg 12, 1032 LG Amsterdam, The Netherlands