Privacy Policy

Last updated 21 October 2026

The short version. Your scans, your 3D room models, your measurements and your setup answers stay on your iPhone or iPad. There is no account. We cannot see your home, your network name or your address. The app sends usage events under a random identifier so we can see which parts of it work, and you can switch them off in the app at any time (You → Your data → Share usage stats).

Who is responsible

WiFi Heatmap is made by Rupangkan Kalita, an independent developer, who is the controller of the personal data described here. Contact: kalitaventures@gmail.com.

What stays on your device

Everything that describes your home. Specifically:

  • The 3D models produced when you scan a room.
  • Every measurement taken during a walk, and where in the room it was taken.
  • Your WiFi network name and the identifier of the access point you are connected to.
  • The answers you give during setup, and your name if you chose to give one in an earlier version.

This information is written to the app's private storage area on your device. It is not uploaded, and deleting the app removes all of it permanently.

What leaves your device, and why

Speed measurements

To measure throughput, the app downloads a block of test data from Cloudflare's public speed measurement endpoint. This is an ordinary internet request and reveals your IP address to Cloudflare, as visiting any website does. No information about your home, your scans or your network is included. Legal basis: necessary to provide the speed test you asked for (Art. 6(1)(b) GDPR).

Messages you choose to send

If you write a suggestion or send us a video link from inside the app, the message you typed is delivered to us by email through a form relay (FormSubmit). It is sent only when you press Send. Alongside your message we include the setup answers stored on your device (for example your WiFi setup and the speed you pay for) so a suggestion arrives with enough context to act on. If you add your email address to the message, we use it only to reply. Legal basis: your request (Art. 6(1)(b)). Kept until the conversation is finished, then deleted on request or after 12 months.

Purchases

Purchases are handled entirely by Apple; we never see your payment details. When a purchase is made or restored, the app passes Apple's confirmation of it to RevenueCat, a purchase-records service, under a random identifier created on your device. RevenueCat tells us which product was bought, the price and the country of the App Store account. It does not receive your name, your email address or anything about your home. Legal basis: necessary to deliver and restore what you bought (Art. 6(1)(b)). Kept for as long as the purchase can be restored and as tax records require.

Usage events

Unless you switch them off, the app sends short usage events to Plumb, an analytics service we run ourselves. Each event carries a random identifier created when the app is first opened. It is not linked to your Apple Account or your name, but because it stays the same on your device it counts as pseudonymous personal data under data protection law, so we treat it as such. The events say things like:

  • which setup screen you reached and the option you tapped on it (for example your WiFi setup and the speed you pay for);
  • whether the purchase screen was shown, which option was selected and whether a purchase completed;
  • whether a room scan was started, finished or left part-way, and whether it used LiDAR;
  • the app version, the device model, the iOS version, and the language and region settings.

Plumb does not look up where requests come from: the only country it records is the region set in your device's settings, and your internet address is not stored. The events never contain your scans, measurements, network name, location, the devices on your network or anything you type. We use them only to find where people get stuck and to improve the app.

Switching it off: You → Your data → Share usage stats. From that moment no new events are recorded on your device. Legal basis: our legitimate interest in understanding and fixing the app (Art. 6(1)(f)), which you can object to at any time with that switch. Kept for up to 24 months, then deleted.

Who processes data for us

  • RevenueCat (United States): purchase records.
  • Vercel (United States) and Supabase (servers in South Korea): host Plumb and its database.
  • FormSubmit: relays messages you send to our email.
  • Cloudflare: serves the speed test file.

Some of these are outside the European Economic Area and the UK. Where that is the case, transfers rely on the providers' standard contractual clauses or an adequacy decision.

Permissions, and why each one is needed

Camera

Used to build the 3D model of your room. No photographs or video are recorded or stored.

Location

Apple only reveals the name of the WiFi network you are connected to, and which access point you are on, to apps that have location access. That is the only reason the app asks. Your geographic position is never stored, never transmitted, and not used for anything else.

Local network

Used to measure the round trip to your own router, and to list devices that publicly announce themselves on your network. The app reads only the names those devices already broadcast. It does not connect to them, log in to them, or send them anything.

Notifications

Used only for the reminders you can see and switch off in You → Notifications. They are scheduled on your device; no notification server is involved.

Advertising and tracking

The app contains no advertising identifiers and no advertising SDKs, does not track you across other companies' apps or websites, and never sells or shares data for advertising.

Children

The app is not directed at children under 16, and we do not knowingly collect personal data from them.

Your rights

If you are in the EU, the EEA or the UK (and in many other places), you have the right to access the data we hold about you, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable form. To use any of these, write to the address above. For usage events, include the identifier shown under You → Your data if you want a specific install found; otherwise switching off Share usage stats, or deleting the app, stops them for good, because the identifier is deleted with the app.

You also have the right to complain to your local data protection authority.

Changes

If this policy changes in a way that affects what the app collects, the date at the top of this page will change and the update will be noted in the app's release notes.

Contact

Questions about this policy: kalitaventures@gmail.com