BanditKin Privacy Policy
BanditKin is a private, end-to-end-encrypted location app for your circle. It is built so that we cannot read your circle's locations or messages even if we wanted to — that is the product.
What the app collects, and who can read it
End-to-end encrypted (only your circle's devices can decrypt; our server stores ciphertext it cannot read):
- Your location (position, accuracy, speed, heading) and location history
- Your circle display name
- Text messages, encrypted reply/reaction metadata, and voice messages
- Place names and boundaries (e.g. "Home", "School") and arrive/leave alerts
- SOS and check-in contents
The initial encryption key is created on your phone and shared out of band by an in-person QR scan or an explicit text invite sent through a channel you choose. A rotation can carry a new key through the relay only inside ciphertext encrypted with the previous circle key. The relay never receives a readable circle key.
Visible to the server (operational metadata):
- That a device belongs to a circle (random device and circle identifiers — no ad IDs, no account names required)
- Timestamps and sizes of encrypted payloads
- Battery level, charging state, online/offline status, and app-health flags
- That an alert fired (but not where, or what it says)
We use this metadata only to run the service (delivering encrypted payloads to your circle, showing online status and battery). We do not sell data, use it for advertising, or include third-party analytics SDKs.
Google/Firebase wake-ups in the Play build. While a Play device is paired to the hosted service, the app registers a Firebase installation/messaging token with our relay. Google processes that delivery token and the timing/network metadata needed to deliver a wake-up. Our relay stores the raw token only while the device remains paired or until it is replaced. The FCM data message contains exactly wake=1: no circle/device identifier, location, query, destination, message text, audio, or encryption key. After waking, the app fetches the actual E2E-encrypted event from BanditKin. The token is removed from active storage on device/circle deletion or credential rotation. The self-host build contains no Firebase SDK and uses its direct held-poll transport instead.
Issue reports are different. If you deliberately use "Report an issue," the free text, selected feature, app/build/platform diagnostics, random device/circle id, and optional email address are sent so the BanditKin operator can read and answer them. The screen discloses this before send. Report text and the operator's copies are retained for a limited time (about 90 days). A configured mail provider may also process a delivered copy under its own retention policy.
Background location
To keep your circle updated on your location, BanditKin reads your device location even when the app is closed or not in use and shares it with the circle members you paired with. Your location is end-to-end encrypted on your device before it leaves — only your circle's paired devices can read it; BanditKin's servers store only ciphertext they cannot decrypt. This data is never used for ads or shared with third parties. You can stop sharing at any time (pause sharing in the app, revoke the location permission, or remove the device from the circle).
When your phone has no connection, recent location fixes are stored on your device (already end-to-end encrypted for E2E circles) and uploaded once a connection returns, so your trail is not lost while you are off-grid. Nothing new is collected or shared — this is the same location data going to the same relay, just sent later.
Maps and the optional camera layer
The base map is fully offline. Map tiles (derived from OpenStreetMap) are downloaded once as a pack and rendered entirely on your device. Viewing the base map itself sends no viewport request. However, the on-by-default camera layer described below makes anonymized OHTTP requests for fixed public cells in the visible map area; turn that layer off to stop those camera-data requests.
Flock/ALPR camera layer (on by default). On the official hosted service, public camera/U-turn reads use fixed map cells through the same OHTTP identity split described below. The Cloudflare relay sees your network address and a padded encrypted request; the camera gateway/service sees the requested public cell but no circle/device token. A custom Flock endpoint is an advanced trust choice and may receive your network address plus the requested map area directly. Camera data comes from OpenStreetMap and community reports. With the layer off, no camera request is made.
Reporting a camera (optional). You can choose to report an ALPR camera you see. Submitting a report sends that camera's location — often near your own location at the moment you report — through OHTTP to BanditKin's public camera service so other drivers benefit. Reports use a rotating scoped handle rather than an account/device/circle id. Camera reports are public facts, not circle E2E content. Do not submit one if you do not want that feature location shared.
Optional road reports. Traffic, crash, closure, construction, weather, road-hazard, and road-safety responder reports are off by default. The app snaps the report to about a 220-meter cell, allows no free-form text or circle token, uses a rotating scoped handle, and the report expires. The official feed/report/confirm path is padded and sent through OHTTP.
Map and camera data © OpenStreetMap contributors (ODbL).
Navigation and search
Turn-by-turn navigation, route calculation, and place/address search run entirely on your device in the app's two private modes. In those modes, your destination, the route you take, and the text you type into search never leave your phone — they are not sent to us or to any map provider.
"Anonymous Online" mode (selected by default). On a new install, or when no earlier navigation mode was chosen, BanditKin selects Anonymous Online for the most complete search, traffic-aware route, and traffic display. Before using search or requesting a route, you can switch Navigation privacy to Fully Private or Private Online Assist. An earlier explicit choice is preserved.
In Anonymous Online, the app sends the text typed into online search, a client-coarsened indication of the search area, and the exact start and end coordinates of each online route request to a third-party map provider (currently Mapbox) to return results. These requests pass through an Oblivious HTTP (OHTTP) identity split and contain no BanditKin circle/device token, account, advertising ID, or message content. The map provider sees the shared gateway, not the phone's IP address. The two private modes send no query or route endpoints to the map provider. "First Responder" routing changes route behavior but sends no extra identity or circle data.
Private Online Assist. If an offline area pack is missing, the app may fetch a fixed public area object through OHTTP. The destination and route remain on the device. The request fails closed when the official mirror lacks the object; it does not silently fall back to a route-shaped direct download. An explicit broad regional pack download can contact the selected HTTPS host directly, which lets that host see your network address plus the broad region; the app discloses this before the download.
OHTTP separates visibility: Cloudflare's relay sees your network address and an opaque encrypted request; the Fly gateway sees the decrypted operation from the relay, not your address; Mapbox/public-data hosts see the gateway. BanditKin currently operates both relay and gateway. We disable correlation/request logging, but the honest guarantee is split visibility — not that one operator is cryptographically incapable of correlating independently obtained logs.
Data retention and deletion
Location history and stale live pins are physically compacted after 24 hours by default. Messages, voice metadata/blobs, protected event-log copies, delivery rows, and acknowledgement tombstones are retained for 30 days by default; disappearing-message timers can shorten this. An active SOS record remains until it is cleared or its device/circle is deleted; its event-log copy follows the 30-day limit. Member labels, Places, and circle/device metadata remain until the related item, device, or circle is deleted.
Reset this device first asks the active relay to remove the device. If that cannot be confirmed, the app does not claim success: you may retry or explicitly choose a disclosed phone-only erase. A founder holding the circle admin key can delete the whole circle in-app. Active-store deletion remains available after a hosted subscription expires and removes the relevant rows/blobs/token indexes; member removal also rotates the circle key on remaining devices.
Provider volume snapshots expire within five days. An emailed issue-report copy follows the mail provider's retention; contact us to request deletion of that copy. Self-host operators control their own active data, snapshots, and backup schedule.
Children
BanditKin is intended to be set up and managed by an adult for their circle.
Contact
Questions: privacy@banditkin.com
We will update this policy as the product evolves; material changes will be noted in the app's release notes.