network-apps/

Who we are

JYDEV LTD is a company registered in England and Wales (company number 17506340). Our registered office is 128 City Road, London, United Kingdom, EC1V 2NX. We publish apps under the developer name JYDEV. For the data described on this page, we are the data controller under UK data protection law.

Apps this covers

This policy covers every network or diagnostic app JYDEV LTD publishes where the store listing links to this page. That includes netstack (Google Play package com.jydev.netstack) and any later app of the same kind: tools that inspect a network from your device, with optional features that use our servers.

Apps that never go online are covered by the offline apps privacy policy. The website is covered by our general privacy policy.

What stays on your device

There is no JYDEV account and no sign-in. The apps don't include advertising or an analytics SDK. We don't receive a copy of your scans unless you use a feature that sends one, as described below.

• Local network information. Device names, local IP addresses, MAC addresses, open ports and similar details the app finds on the network you're connected to. This stays in the app.
• Wi-Fi, Bluetooth and mobile. Nearby network names, signal readings, Bluetooth advertisements and, if you allow it, cell information. Used to show you what the phone can already see.
• Logs and reports. Ping logs, saved readings and reports you generate. Stored on the device. Uninstalling the app deletes them.
• Backups. Your phone may include app data in its own backups, for example Android backup to your Google account. Those backups are handled by your device and your account provider. We have no access to them.

Permissions

Android only reveals nearby Wi-Fi, Bluetooth advertisements and cell towers to apps that hold a location or nearby-devices permission. The apps ask for that so those screens can work. They don't record GPS tracks and they don't send your location to us.

A ping logger may run as a foreground service and post a notification so a long test can keep going while the screen is off. You start that yourself.

Purchases

Paid unlocks and subscriptions are processed by the store, usually Google Play. The store collects your account and payment details under its own policy. Google's is at policies.google.com/privacy. We don't receive your card number or your Google account email from the purchase.

To confirm a purchase, the app sends the store's purchase token to our server. We check it with Google. We store a hash of that token, not the token itself, so we can apply quotas and see when Google tells us a purchase was refunded or revoked. Our legal basis is the contract for the feature you bought, and our legitimate interest in stopping copied or refunded purchases from using paid features.

On some requests to our server the app also sends a Play Integrity token. Google uses it to say whether the request came from a genuine install. We use the result to reduce abuse. It isn't used to build a profile of you.

Google Play gives developers install numbers, ratings and, if you've allowed it on your device, crash reports. These show details like device model and Android version, and don't tell us who you are. We use them only to fix bugs and decide which devices to support.

When you use an online feature

Our servers for these apps sit behind a hostname such as netstack.jydev.online. Traffic goes through Cloudflare to an application we run on Google Cloud in the London region (europe-west2). A request includes your IP address, because that's how the internet delivers it. Cloudflare passes that address to our application so rate limits and the exposure check use your address rather than Cloudflare's.

We only receive the following when you use the feature:

• Vulnerability lookup. The product name, version and any vendor or identifier you submit. We ask the National Vulnerability Database and keep a short cache of the public result. We don't attach this query to your name.
• Internet exposure check. We use the public IP address of the connection to see whether common ports look reachable from the internet. The result is returned to the app. We don't build a location history from it.
• Email a report or digest. The addresses you type, an optional reply-to, the subject, any message, and the file or summary the app sends. The summary for a digest is worked out on the phone. We pass the message to our email service to deliver it. We don't keep a mailbox of these messages.
• Share link. The file you choose to share. It is stored privately and served to anyone who has the link, until it expires.

If an address bounces or is marked as spam, we or our email provider may keep it on a suppression list so we don't send there again.

The legal basis for sending a message or creating a link is that you asked us to. The legal basis for IP addresses, rate limits and integrity checks is our legitimate interest in running the service and stopping abuse.

Other services the app calls

Some features talk from your phone straight to another provider. They see your IP address as part of a normal request. We don't receive a copy of that traffic.

• Speed tests. Measurement Lab (M-Lab). Their policy is at measurementlab.net/privacy.
• Public IP and network information. Cloudflare (cloudflare.com/privacypolicy) and RIPEstat (ripe.net).
• MAC vendor list. A copy is included in the app. If you update it, the app downloads the public registry from the IEEE.

How long we keep it

• Share files. Deleted after 7 days, or sooner if the link has expired.
• Quota counters. A count against the hashed purchase, kept until the end of that quota window and then deleted.
• Revoked purchases. The hash of a refunded or revoked purchase token, kept for about 13 months so a refunded purchase can't be reused.
• Email. Not stored as messages. Suppression entries for bounced or complained addresses are kept so we don't email them again.
• Server logs. Short-lived operational logs (time, path, a shortened user key, and error text) so we can fix faults and investigate abuse. They are not used to build a marketing profile.

Who sees your data

We don't sell personal data and we don't share it for advertising. The companies that process it for these apps are:

• Google, for Play purchases, Play Integrity, Play Developer reports, and Cloud infrastructure (Cloud Run, Firestore, Cloud Storage)
• Cloudflare, for the public hostname, abuse protection, and sending email
• the services listed above, when you use a feature that calls them
• the people you address, when you email a report or give someone a share link

These providers may process data outside the UK. Where they do, they rely on legal safeguards recognised under UK law, such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

Children

These apps are not directed at children under 13, and we don't knowingly collect personal data from them. Don't use an email or share feature to send a child's personal data unless you have the right to do so.

Your rights

Under UK data protection law you can ask us for a copy of the personal data we hold about you, and ask us to correct it, delete it, or stop or limit how we use it. Email hello@jydev.online. We may need enough detail to find a record, because we don't hold your name against a purchase. We'll reply within one month.

Data that never left your device is deleted by uninstalling the app. A share link can be left to expire, or you can ask us to delete a file if you still have the link.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to sort it out first.

Changes

When this policy changes, we'll update it here and change the effective date at the top. If a change affects what an app collects, the app's store listing will be updated before the new version is released.

Contact

Email hello@jydev.online, call 020 4634 2039, or write to JYDEV LTD, 128 City Road, London, United Kingdom, EC1V 2NX.