The Android apps.

1 Who is responsible, and for what

The apps are published by [UZUPEŁNIJ: imię i nazwisko albo nazwa firmy], [UZUPEŁNIJ: adres]. For privacy questions write to [UZUPEŁNIJ: adres e-mail].

This policy covers two Android apps on Google Play: Chameleon SDR (pl.csdr.chameleon), a radio receiver for RTL-SDR receivers, and Chameleon SDR Driver (pl.csdr.driver), the USB driver for those receivers. The website and the Windows program have their own privacy policy.

2 What data we collect

None. The apps have no user accounts, no ads, no analytics and no tracking libraries, and they send no data to us. So there is nothing for us to store, share or sell.

Everything the apps save stays on your phone (section 3). Data leaves the phone only in connections you start yourself (section 4).

3 What stays on your phone

• Settings, memory channels, the band plan and the chosen theme.
• DMR keys, if you enter any: encrypted with your password (PBKDF2 and AES-256). Nobody but you knows the password. If you turn on biometric unlock, the password is also kept on the phone, encrypted with a key in the Android Keystore that the system releases only after your fingerprint or face check.
• Decoder logs (DMR, APRS, ISM, CW, SSTV) and received SSTV pictures.
• Recordings you start yourself (audio, IQ, video), in the Music, Movies and Download folders, in a "Chameleon SDR" subfolder. You delete them like any other file.
• Downloaded map tiles (a cache).

Uninstalling the apps removes everything except the recordings in public folders.

4 Connections you start yourself

• The RTL-SDR receiver: Chameleon SDR connects to the driver on the same phone (address 127.0.0.1) or to an rtl_tcp server at an address you enter.
• The map (APRS): tiles come from the provider you choose, with an API key you enter yourself (e.g. MapTiler, Stadia, Thunderforest, Mapbox, Geoapify, Azure Maps, USGS). That provider sees your IP address, your key and the map area you view, under its own privacy policy. Without a key the app contacts no map provider.
• The PRO purchase: handled by Google Play, which is the controller of the payment data. The app never sees card or payment details; it receives only Google's confirmation of the purchase and keeps it on the phone. See Google's privacy policy.
• The driver's rtl_tcp server: if you start it yourself, any program on your network that connects to the address you chose receives the receiver's samples. The driver shows the phone's addresses on its screen only so you know what to enter in your program; it sends them nowhere.

5 Permissions

• Internet and network state: rtl_tcp, map tiles, Google Play.
• Notifications and a foreground service: listening with the screen off (Chameleon SDR) and keeping the USB receiver connected (the driver), always with a notification that stops it.
• Wake lock: so reception does not stop with the screen off.
• USB (the driver): access to the receiver, always with your consent in the system dialog.
• Biometrics (Chameleon SDR, only if you turn it on): opening the key store with your fingerprint or face. Android does the check; the app gets only whether it succeeded and never sees any biometric data.

The apps do not use location, the microphone, the camera, contacts or the advertising ID.

6 Children and your rights

The apps are not directed at children and collect no personal data from anyone.

As we process none of your data, there is nothing to give you access to or to delete; you remove the data on your phone by uninstalling the app. Questions go to the address in section 1. You may also lodge a complaint with your data protection authority (in Poland: the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw).

7 The driver's source code

Chameleon SDR Driver is a modified version of rtl_tcp_andro (Signalware Ltd) under the GNU GPL, version 2 or later. Its source code: github.com/SP8UEV/RTL-SDR-ADriver.

8 Changes

If we change this policy, the new version will appear on this page with a new date. The Polish version is binding.