PWNDROID

Applies to: PwnDroid for Android (package com.pwnagotchi.pwndroid), published by xBitsNL Gaming.
Effective date: 5 November 2026  ·  Last updated: 5 November 2026

1. Who we are

The data controller is xBitsNL Gaming (Jeroen Oudshoorn), the developer and publisher of PwnDroid. Contact: support@xbitsnlgaming.com.

2. Location

PwnDroid asks for the precise location permission for two features:

• Share GPS. Only while you have turned it on, a foreground service with an ongoing notification reads your location and sends it over a local WebSocket connection to the Pwnagotchi units that connect to your phone. Your unit uses it to record where each Wi-Fi network was seen. Sharing stops when you switch it off, tap Stop in the notification or close the app. The location goes to your own device on your local connection and is not sent to us or to any other party.
• Map. The map can show your current position. That position is used on your phone only.

The app does not request location access in the background (ACCESS_BACKGROUND_LOCATION).

3. Data stored on your phone

PwnDroid stores the following in the app’s private storage. It is not sent to us:

• the Pwnagotchi units you add: name, address and, if you enter them, the username and password of the unit’s web interface. These are encrypted with a key held in the Android Keystore and are excluded from Android backups;
• your captured handshakes as reported by your units: network name (ESSID), access point address (BSSID), file name, time of capture and the location where it was captured;
• your settings, such as the app theme, and a launch counter used to decide when to ask for a Google Play review;
• a cache of map tiles.

Except for the device list, this data may be included in your phone’s own Android backup to your Google account, if you have turned that on. It is removed when you clear the handshake list, clear the app’s storage or uninstall the app.

4. Communication with your Pwnagotchi

PwnDroid connects directly to the units you add, at the addresses you enter, to show their screen and status, list handshakes and send commands such as restart and shutdown. This traffic stays between your phone and your unit and does not pass through our servers. The app asks for Android’s local network (“Nearby devices”) permission for this. It only connects to the addresses you have entered and does not scan your network for other devices.

5. Map tiles (OpenStreetMap)

The map uses tiles from the OpenStreetMap tile servers. To download a tile, your phone sends the server your IP address, the app’s package name as user agent and the tile requested, which shows which area of the map you are viewing. Tiles are cached on your phone, so areas you have already viewed are not downloaded again. This is governed by the OpenStreetMap Foundation Privacy Policy.

6. Usage statistics and crash reports (Google Firebase)

The first time you open PwnDroid, it asks whether it may send usage statistics and crash reports. Both are off until you choose “Allow”; the app works the same whichever you choose. You can change your choice at any time in Settings → Usage statistics and crash reports. When you turn it off, collection stops and crash reports that have not been sent yet are deleted. If you allow it:

• Firebase Analytics collects aggregate, pseudonymous usage statistics, such as app opens, screen views, session length, app version, device model, operating-system version and coarse region derived from your IP address. These are tied to a random app instance identifier, not to your advertising ID, which PwnDroid does not collect. We use this only to understand how the app is used and to improve it.
• Firebase Crashlytics sends a report when the app crashes or hits a serious error: the stack trace, the error message, app version, device model, operating-system version and a Crashlytics installation identifier. An error message about a failed connection can contain the address of your Pwnagotchi. Crash reports do not contain your location or your handshakes.

Google processes this data as our processor, according to Firebase’s privacy and security terms and the Google Privacy Policy. Clearing the app’s storage resets the Firebase identifiers (and asks you again).

7. Google Play updates and reviews

PwnDroid uses Google Play’s in-app update and in-app review features. When a new version is available, Google Play can download it inside the app. Occasionally the app asks Google Play to show its rating dialog. Any rating you give is handled by Google under its own terms; we do not see which user wrote it.

8. Permissions

• ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION: Share GPS and the map (section 2).
• FOREGROUND_SERVICE / FOREGROUND_SERVICE_LOCATION: keep GPS sharing running while it is on, with a notification.
• POST_NOTIFICATIONS: show that GPS sharing notification.
• ACCESS_LOCAL_NETWORK (Android 17 and later): connect to your Pwnagotchi (section 4).
• INTERNET / ACCESS_NETWORK_STATE: map tiles, Firebase (if you allow it) and Google Play.

PwnDroid does not request camera, microphone, contacts or storage permissions, and does not declare the advertising ID permission (AD_ID).

9. Legal bases (EEA / UK)

• Consent: your location, which is only used once you grant the permission and turn on a feature that needs it; and usage statistics and crash reports, which are only sent once you allow them (section 6).

10. Children

PwnDroid is not directed at children under 13 (or under the age of digital consent in your country), and we do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it.

11. Data retention

Data on your phone is kept until you delete it. Analytics and crash data held by Google is retained and deleted according to Google’s policies and our Firebase settings.

12. International transfers

Google processes Firebase data on servers that may be outside your country, including in the United States, under the safeguards (such as the EU Standard Contractual Clauses and the EU–US Data Privacy Framework) described in Google’s Privacy Policy.

13. Your rights

If you are in the EEA or UK, you have the right to access, correct, delete, restrict or object to the processing of your personal data, to withdraw consent and to data portability.

• Location: turn off Share GPS, or withdraw the location permission in Android settings.
• Data on your phone: delete devices or handshakes in the app, or clear the app’s storage / uninstall.
• Usage statistics and crash reports: turn them off in Settings, which also deletes unsent crash reports. For data already sent, contact us and we will have it deleted from Firebase.
• For any question or request, contact us at support@xbitsnlgaming.com. You also have the right to lodge a complaint with your local data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

14. Changes to this policy

We may update this Privacy Policy. Material changes will be reflected by an updated date above and, where appropriate, announced in the app or on the Google Play listing. The Google Play Data safety section is kept consistent with this policy.

15. Contact

xBitsNL Gaming — Jeroen Oudshoorn
support@xbitsnlgaming.com