FreqMapper Privacy Policy
Last updated: October 8, 2026
FreqMapper maps Meshtastic radio coverage. This policy explains, in ordinary language, what the Android and iPhone apps, website, public map, and supporting services collect; why they use it; what can become public; how long it is kept; and how to remove it.
This policy uses FreqMapper to refer to the app, website, public map, and related services operated by the FreqMapper project and its maintainers. If a different legal operator name is published later, this policy will be updated; until then, FreqMapper identifies the service responsible for the practices described here.
The short version
- FreqMapper has no advertising and does not sell personal information or use it for cross-company tracking.
- A user-started mapping trip records the phone's precise location, trip times, and limited radio-test or receive metadata. It does not turn an ordinary radio position report into the phone's mapping location.
- The public map shows coverage cells, aggregate contribution statistics, and public Watcher details. It does not show a mapper's precise route, account email, installation identifier, or individual Received here packet record.
- A linked profile can explicitly create a revocable public link for one finished trip. The link shows only that trip's date, summary counts, Watcher-verified TX cells, and privacy-filtered aggregate RX cells; it does not publish the route, exact TX or RX samples, sender identity, radio or account identity, packet details, or Watcher identities.
- Website accounts are optional. Sign-in providers give FreqMapper a verified email, display name, and provider-specific account identifier.
- Chat text stays on the phone for seven days and is not uploaded to the FreqMapper service. Radio transmissions are still heard and handled by the Meshtastic network independently of FreqMapper.
- Support reports are optional. The form lets you choose a public sanitized summary or a private-only report before it sends anything. Crash reports are private by default. On iPhone, Apple MetricKit may deliver a crash diagnostic to FreqMapper after a crash. It is privacy-filtered and saved locally; it is uploaded only after you allow private crash reporting. You can disable future uploads or delete diagnostics still saved on the iPhone in Advanced settings.
- You can delete an unlinked app's data or a linked account. Personal records are removed; privacy-safe community coverage remains without your account, installation, route, radio, or real trip identifier.
Data FreqMapper collects
Mobile installation and radio setup
The app creates a random FreqMapper installation identifier and sends its platform and app version to the service. When a radio is enrolled, FreqMapper associates that installation with the radio's Meshtastic node ID and optional radio name. It also keeps enrollment status, creation and last-seen times, and the region used for mapping. The identifier is a FreqMapper identifier; it is not the Android advertising ID, an Apple advertising identifier, a hardware serial number, or the phone's Bluetooth address.
BLE scanning, TCP endpoint entry, and Android USB discovery happen on the phone so you can select and use a Meshtastic radio. Saved connection details stay on that phone. FreqMapper does not upload the radio's Bluetooth address, TCP endpoint, or Android USB device path.
Mapping trips and precise location
During a trip you start, the app records:
- the selected region, trip type, start and finish times;
- phone GPS points, timestamps, and accuracy;
- tagged mapping-test positions and the minimum packet identifiers needed to compare the test with independent Watcher evidence; and
- the enrolled radio's node ID and optional name.
This data supports trip history, coverage verification, delayed upload, duplicate prevention, troubleshooting, and abuse prevention. A nearby IATA area, a radio's position, or a Watcher's position is never quietly substituted for the phone's mapping location.
The Android and iPhone apps may continue a trip you started while temporarily in the background, subject to the phone's operating-system rules. Closing or ending a trip stops the active mapping work described by the app.
Received here samples
During an active trip, Android and iPhone may upload a private Received here sample when the connected radio hears eligible text, position, node-info, or telemetry traffic on a configured channel it can decode. A sample contains the minimum data needed to place and compare that reception:
- event, sender, and packet identifiers;
- packet type and reception time;
- phone position and accuracy;
- the driving radio's RSSI, SNR, known hop count, and optional one-byte last-relay hint; and
- limited matching information from approved Watchers.
It does not contain the message text, sender's position payload, channel name or key, raw packet bytes, or Bluetooth address. A matching Watcher report is corroboration, not proof of a packet's route or of the phone's location.
Individual samples remain private. The public map receives only an aggregate 100 m or 300 m cell, quality, sample count, and mapper count. Public leaderboards count a separate RX point per mapper and distinct 300 m receive area without publishing packet, sender, trip, installation, exact sample position, or Watcher-comparison details.
Optional website accounts
You can use the mobile app without a website account. If you choose to sign in with Google, Apple, Discord, or GitHub, FreqMapper receives the provider's stable account identifier, verified email, and display name. It stores the provider used, when the method was added, and the last sign-in time. Apple may provide a private relay email when you use Hide My Email. FreqMapper does not request Discord servers, GitHub repositories or organizations, provider roles, contacts, or social graphs.
For Sign in with Apple, an encrypted server-side refresh token may be kept only so FreqMapper can revoke the Apple credential when the method or account is removed. Browser sign-in uses secure, HTTP-only session cookies. An account session lasts up to 30 days unless you sign out or a security change ends it.
When you link a phone, the account stores the link time and any private device label you choose. Your profile can show your private trip history, linked apps and radios, sign-in methods, and regional roles. Regional administrators' authorized changes are recorded for accountability.
Profiles are private by default. If you separately opt in to the public leaderboard, the chosen driver name, contributing radio names, aggregate totals, regions, and recent contribution activity can be public. You can turn that off in the website profile.
You can also separately choose Share trip for an individual finished session. FreqMapper then creates a random, revocable link to that trip's date, duration, summary counts, derived Watcher-verified TX cells, and privacy-filtered aggregate RX cells. The link is not created for every trip, is not intended for search indexing, and does not include the route, exact TX or RX samples, sender identity, radio or account identity, packet details, or Watcher identities. Anyone with the link can view it until you stop sharing it. Unlinking the app that recorded the trip revokes its active trip links.
Chat and radio traffic
Chat text sent or heard on the connected radio's configured channels is stored only on that phone for a rolling seven days, with local delivery or relay status, and is then removed automatically. Android and iPhone do not upload the chat body or chat delivery state to FreqMapper. A Received here sample can say that a text packet was heard, but never includes the message body.
Sending through a Meshtastic radio is still a radio transmission. Other radios, gateways, channel participants, and services connected to that mesh may receive or retain it under their own practices. FreqMapper does not control those independent participants. Do not send information you are not permitted to share over the radio channel.
Support, feedback, and diagnostics
Support and crash reports are optional. If you choose to submit one, FreqMapper receives the title, description, optional reply contact, and any diagnostics or attachments you select. Redacted diagnostics can include app and operating system version, device model, crash stack or fingerprint, and a bounded recent timeline of app, Bluetooth, radio-sync, and trip events. Optional radio diagnostics can include a shortened node identifier, firmware and hardware labels, Bluetooth signal strength, pairing state, connection duration, channel count, enrollment state, recovery path, and server status.
The apps are designed not to include route samples, current location, chat text, channel keys, Bluetooth addresses, or raw radio packets in diagnostics. Screenshots and files are controlled by you, so review them before sending.
The form offers Public summary and Private report. With Public summary, the sanitized title and user-written request text may be published in the public FreqMapper Feedback project. With Private report, no report content is intentionally sent to the public feedback repository. Crash reports default to Private report.
Redacted diagnostic evidence may be copied to a private GitHub issue that is visible only to authorized maintainers. Optional reply contact, full attachments, and operator notes remain only in FreqMapper's protected support record. Private issue text and diagnostic comments are blocked from automatic public synchronization. GitHub content is also handled under GitHub's terms and privacy policy; a public choice cannot guarantee later removal of copies made while the content was public.
On iPhone, crash diagnostics supplied by Apple MetricKit are filtered before local storage or upload. The filter removes coordinates, server addresses, access tokens, channel keys, contacts, Bluetooth addresses, and private app container paths. FreqMapper asks before the first private upload and remembers the choice so a failed upload can retry without repeatedly prompting. Matching fingerprints are grouped where possible. Choosing not to send deletes the saved diagnostic and disables future automatic uploads until you enable them again.
Watchers, regional sources, and public regional information
Approved Watchers and regional data sources provide packet metadata used to verify coverage and compare private RX samples. That can include packet and sender identifiers, receipt time, signal values, hop information, and an operator-approved Watcher name and position. It does not make a Watcher a radio repeater or authorize FreqMapper to publish credentials, channel keys, or private setup details.
The public service can display regional names, boundaries, public descriptions and links, coverage cells, statistics, public Watcher names and positions, and opt-in contributor names. Regional contact and role information stays private unless the person or regional team publishes it themselves.
Service and security records
Like most internet services, FreqMapper's hosting and security systems process IP addresses, request time, requested path, response status, browser or app metadata, and security signals needed to deliver the service, prevent abuse, and investigate failures. FreqMapper does not use those records for advertising or cross-company tracking.
Data kept only on the phone
Map appearance, radio selection, trip summaries, and similar preferences stay on the phone unless a section of the app says otherwise. The installation identifier is also stored on the phone; iPhone protects it in the Keychain.
When internet access is unavailable, pending GPS points, packet identifiers, timestamps, Received here samples, and the trip-finish request are encrypted with an app-specific key in the app's private storage. Accepted records are removed from the queue after upload. Erasing local trip history removes local history and waiting uploads. Uninstalling removes records that have not reached the service. Deleting local history cannot remove records already uploaded.
When data goes to another provider
FreqMapper uses only the providers needed for the feature you choose:
| Provider or recipient | What it receives and why |
|---|---|
| Google, Apple, Discord, or GitHub | If you choose that sign-in method, the provider handles the sign-in and returns the verified identity fields described above. Its own privacy policy applies to its side of the transaction. |
| OpenFreeMap and its delivery network | Android and iPhone light/dark maps request a style and tiles. The request reveals normal network metadata and the area of the map being viewed, which may be near you when follow-location is on. FreqMapper does not add your installation ID, radio identity, messages, or channel data. |
| Esri ArcGIS imagery and its contributors | The Android and iPhone satellite maps directly request the tiles for the area you view. The public website requests satellite tiles through FreqMapper's server. The provider receives the requested tile area and normal network metadata for the request it handles. |
| OpenStreetMap and OpenTopoMap tile services | The public website requests these maps through FreqMapper's server. They receive tile requests from the service rather than a FreqMapper account profile. Map attribution remains visible. |
| Hosting, content-delivery, and security providers | They process ordinary connection and request metadata to deliver and protect the website, API, downloads, and Help center. |
| GitHub | For Public summary, GitHub receives the sanitized public feedback text described above. For private reports or private diagnostic evidence, the private source repository receives bounded redacted report content visible only to authorized repository members. Full attachments and reply contact are not copied to GitHub. GitHub also handles visits and repository content under its own policy. |
| Authorized project operators and regional administrators | They receive only the access needed to operate support, accounts, regions, evidence, or abuse controls. Regional roles do not grant access to unrelated private accounts or routes. |
| Government or legal recipients | Information may be preserved or disclosed when required by valid law or when reasonably necessary to protect users, the service, or the public from fraud, abuse, or imminent harm. |
FreqMapper requires providers and authorized people handling private data to use it only for the service purpose and to protect it appropriately. No internet service can promise absolute security.
Retention
Retention is based on the kind of record:
| Record | How long it is kept |
|---|---|
| Local chat | Seven days on the phone. It is not uploaded to FreqMapper. |
| Local offline queue | Until accepted by the service, erased with local history, or removed by uninstalling the app. |
| Account, sign-in methods, linked devices, and roles | While the account or method remains active, then removed through the account-deletion or method-removal process. |
| Precise server trip routes, TX tests, and individual RX samples | There is currently no automatic trip-expiration period. They remain while the owning installation/account remains, unless an authorized operator removes invalid data or the user completes deletion. |
| Public profile | Until you turn off public display, change the public name, or delete the account. Short-lived caches can take time to refresh. |
| Shared trip link | Until you stop sharing it, unlink the app that recorded it, or delete the owning account or trip. Revoked URLs are not reused. |
| Support attachments | Removed from protected storage after 90 days by default, or earlier when the associated installation/account is deleted. Attachment metadata can remain with the support record to show that a file existed and expired. |
| Support report text and status | Until the associated installation/account is deleted or an authorized operator removes the record. Public and private GitHub copies follow GitHub's retention and the applicable repository's moderation and access process. |
| Browser account session | Up to 30 days, unless you sign out or a credential/security change ends it sooner. |
| De-identified community coverage | May be kept indefinitely so deletion does not erase the shared map's history. It has no account, installation, original trip, radio, real ping, or precise route identifier. |
| Routine application and security logs | Up to 30 days. Hosting and security providers can apply their own documented retention to records they control. |
| Administrator change history | Up to two years for security, accountability, dispute handling, and abuse investigation. |
| Encrypted database backups | Up to 30 days in isolated recovery storage. If a backup is restored, completed deletion requests newer than that backup are reapplied before normal service resumes. Deleted personal information can remain in an isolated backup only until that backup expires. |
| Deletion replay receipts | Up to 30 days. These minimal records contain only the deleted account or installation UUID, target type, and deletion time so a deletion can be reapplied after a restore. |
Your choices and rights
You can:
- deny or later remove Bluetooth, photo/file, and location permissions in phone settings, understanding that the related feature will stop working;
- stop a mapping trip at any time;
- erase phone-only trip history and waiting uploads;
- keep the app unlinked, link it to an optional account, or unlink a device;
- change your private device label and public leaderboard choices;
- add or remove sign-in methods, while keeping at least one working method on an active account; and
- delete an unlinked installation or your entire linked account.
Depending on where you live, law may also give you rights to access, correct, delete, restrict, or receive a copy of personal information, or to object to or withdraw consent for certain processing. FreqMapper will honor applicable rights after reasonably verifying the request. Withdrawing permission does not undo processing that was lawful before withdrawal.
Account and installation deletion
The public account and app-data deletion page explains the available paths and what each request removes without requiring sign-in.
Open Settings → Profile & data in the mobile app. A linked app opens the signed-in website deletion page; an unlinked app can request deletion directly.
You can choose Delete now or Delete in 7 days. Delete now begins immediately and cannot be cancelled. The seven-day option can be cancelled before its deadline. If you need to move a linked device to another account, ask for help before deletion begins.
When deletion finishes, FreqMapper permanently removes the account, sign-in methods, provider credentials held by FreqMapper, linked devices, private roles, precise routes, individual RX samples, support records and attachments, and other person-linked records covered by the deletion. An unlinked deletion removes the corresponding installation and its person-linked data.
Community coverage remains, but it is rewritten as privacy-safe evidence that cannot be traced through FreqMapper to the deleted account, installation, radio, original trip, ping, or exact route. Shared regions, Region Groups, boundaries, Watchers, and regional settings are not personal account data and are not deleted with one mapper's account.
Local data on a phone is separate. Erasing local history or uninstalling clears records still on that phone. Cancelling a scheduled server deletion cannot restore phone data that was already erased.
Children
FreqMapper is for people age 16 or older and is not directed to children under 16. People under 16 must not create or link an account, submit precise location, use the mapping and radio features, or send support content. A higher minimum age applies where local law requires it. If FreqMapper learns that it collected personal data from someone under the applicable minimum age, FreqMapper will remove it.
International processing
FreqMapper and its providers may process data in the United States and other countries where they operate. Privacy protections can differ from those in your home country. FreqMapper uses the safeguards required by applicable law for the processing it controls.
Changes to this policy
The Last updated date shows when this page changed. Material changes will be announced in the Help center, app, or service before they take effect when reasonably possible. If a change materially expands how previously collected personal information is used, FreqMapper will request permission when required instead of relying only on an edited page.
Questions or privacy requests
Do not put private information, channel keys, invite keys, broker credentials, or precise locations in a public issue. The public FreqMapper Feedback project is appropriate only for non-sensitive product questions and feedback.
For a private privacy, data-access, or deletion request, email [email protected]. Keep the initial message brief and do not include sensitive details until the request is being handled through a verified private exchange.