SurfScan Privacy Policy

Effective date: 5 August 2026
Applies to: SurfScan for Android (com.waveriders.surfscan), published by Waveriders Collective (“Waveriders”, “we”, “us”).

SurfScan is a professional tool for operating SurfScan cellular network scanners and running cellular coverage walk tests. This policy explains what data the app handles, why, where it goes, and what stays on your phone. We collect only what the product needs to work; we do not sell data, and the app contains no advertising or third-party analytics SDKs.

Data we collect and why

Account information

• Email address. You sign in with a one-time email code (via our backend provider, Supabase). Your email identifies your account and organization. Required for the app to function.

Precise location

• During a walk-test session, the app records your precise GPS position — sampled continuously (about once per second) for live display and persisted in snapshots (about every 10 seconds). Recording continues while the app is in the background only during an active session, via a foreground service with a persistent notification; ending the session stops collection.
• When you run a scan on a connected SurfScan device, your phone’s location may be used to geotag the scan session.
• Walk-test location data is uploaded, with the measurements below, to Waveriders’ backend so you and your organization can view coverage results.

Cellular and RF measurements

• Radio telemetry from your phone during walk tests: signal strength and quality (RSRP, RSRQ, SINR), serving cell identifiers (PCI, EARFCN/NR‑ARFCN), bandwidth, carrier name, and network codes (MCC/MNC). This is the product’s core data and is uploaded with the associated location.

Device information

• A device identifier (Android’s ANDROID_ID) plus the phone’s manufacturer and model, sent with walk-test uploads to distinguish measurement sources.

Physical activity

• With your permission, the app uses step detection to improve indoor position estimates (pedestrian dead reckoning). Raw activity data is processed on the phone; only the derived positions are part of session data.

Wi-Fi information

• The app scans for and connects to SurfScan devices’ Wi-Fi networks and reads local network details (e.g. gateway address) to talk to your scanner hardware. This is used on-device for connectivity.

Data that never leaves your phone

• Scanner credentials — router admin passwords and device update tokens are stored only on your phone, in Android’s encrypted storage (EncryptedSharedPreferences), and are sent only to your own scanner hardware on your local network. They are never transmitted to Waveriders.
• When you claim a scanner, your email, organization name, and the device nickname are written to your own device so it can identify its owner.

Where data goes

Uploaded data (walk-test measurements, scan sessions) is stored in Waveriders’ backend, operated on these infrastructure providers:

• Supabase — authentication and database hosting.
• Cloudflare — edge ingestion and hosting for our services.
• OpenFreeMap — the in-app map loads tiles from tiles.openfreemap.org; like any web server, it receives your IP address and the map area requested. No measurement data is sent to it.
• OpenStreetMap Foundation — the device location-confirmation preview loads a small grid of map tiles from tile.openstreetmap.org; it receives your IP address and the map area requested (which corresponds to the scanner location being confirmed). No measurement data is sent to it. Use is subject to the OSMF tile usage policy.

Device software updates

When you update a scanner’s software from the app and the scanner has no internet connection of its own, the app relays the scanner’s download traffic through your phone’s connection (which may be mobile data). During an update, the package servers involved — pkgs.surfscan.net, deb.debian.org, security.debian.org, archive.raspberrypi.com, packagecloud.io, and github.com — receive your phone’s IP address, as with any download. No personal or measurement data is sent to them; the relay is active only while an update you started is running.

These providers process data on our behalf. We do not sell your data, and we do not share it with advertisers or data brokers. Your measurement data is visible to your own organization’s account(s) in our reporting tools.

Retention and deletion

We retain uploaded measurement data while your account or organization is active, so historical coverage results remain available.

To request deletion of your account or your uploaded data, use our deletion request page at surfscore.live/delete-account — no sign-in needed, and it works even if you have already uninstalled the app. You can also email support@waveriders.live. Either way, we complete the deletion within 30 days.

When your account is deleted, your account and personal details are removed. The anonymous signal measurements you contributed remain in the coverage map.

Security

Data in transit to our backend uses TLS. Credentials stored on the phone use Android’s encrypted storage. Connections from the app to your own scanner hardware occur over your local network (your scanner’s Wi-Fi or a direct USB link).

Children

SurfScan is a professional tool and is not directed at children under 13. We do not knowingly collect data from children.

Changes

We will update this policy as the product changes and revise the effective date above. Material changes will be noted in the app’s release notes.

Contact

Waveriders Collective — support@waveriders.live