What the server can see
This applies to our hosted server and to any server someone runs themselves.
| Data | Encrypted? | What the server can see |
|---|---|---|
| Locations and battery levels | Yes | Which group and epoch each one belongs to, who sent it from which phone, when it arrived, and its size. |
| Nicknames and group colours | Yes | Who nicknamed whom, that a colour is set, roughly how long each nickname is, and which key version protects it. |
| Recovery phrase | Never sent | Whether you have one, when you set it up and last changed or reset it, and when a phone fetches your recovery data. |
| Names and email addresses | No | Everything. |
| Groups, members and roles | No | Group names, who is in which group, roles, invitations and when people joined. |
| Profile and group pictures | No | The pictures. Anyone with a picture's address may be able to view it. |
| Device names and icons | No | The name and icon you give each phone or tablet. Members of your groups can see them too. |
| Phones and sessions | No | Which phones are signed in to each account, their model and platform, when each was added, set up, removed, last active and last shared a location, and the IP address and app details of each session and which phone it belongs to. |
| Adding a phone | Partly | When you add a phone, which phone approved it, and an encrypted copy of your history keys that only the new phone can open. Deleted a day after the code expires. |
| Time zone | No | Your time zone, if your server sends email, so alert emails show your local time. |
Emails
If your server sends email, its email provider and your own email provider see each email in full: your address, what kind of email it is, when it was sent, and any code. Emails never contain locations, IP addresses, recovery phrases or anything end-to-end encrypted, and they don't load anything from the internet.
Feedback
Feedback sent from the app goes to OpenBeacon's hosted server, even if you use another server. We can read it. It isn't linked to your account and includes your email address only if you add it.
When you sign out
When you sign out, or your session ends, the app clears decrypted locations, nicknames and member lists from memory and removes the group keys from your phone. Locations waiting to be sent stay on your phone, encrypted, until you sign in to the same account again.
When you remove a phone
A removed phone deletes its keys, saved locations and anything waiting to be sent the next time it reaches the server. The server keeps a record of a removed phone that was set up, marked as removed, until the account is deleted, so it can keep that phone signed out. A phone that was never set up is deleted 7 days after it first signed in or was removed.