Privacy policy

This page describes what WhisperTether does with your data. It is written to be plain-English-honest rather than legally elaborate; the short version is at the top, and each claim is expanded below.

What stays on your device

The app stores the following on your phone, in app-private storage that other apps cannot read:

• The Bluetooth MAC address and (if available) display name of the device you chose as the automation trigger.
• Your automation preferences (enable on connect, optional disable on disconnect, preferred control mode).
• A short record of the most recent Bluetooth connection/disconnection event and the hotspot action that followed, used for the "recent activity" section on the main screen.
• The current state of the in-app update checker (last successful manifest fetch, last attempt timestamp, whether you've dismissed a specific version).
• Your free-trial start date and, if you enter one, your license key. Both stay on the device. License validation is performed entirely on-device (the key carries a cryptographic signature the app checks offline); the key is never transmitted anywhere.

Uninstalling the app removes all of this. The app does not write to shared storage or any cloud backup target.

What is sent off your device

One HTTPS request, on launch and when you tap "Check for updates now":

• Endpoint: https://laupin.ca/apps/whispertether/updates.json
• Method: GET. The request body is empty.
• User-Agent header reports the app's version (e.g. WhisperTether/0.5.0-beta.1 (versionCode=15)) so server logs can distinguish builds.
• No cookies, no authentication tokens, no device identifiers, no hardware identifiers. Your IP address is visible to the web server as part of any HTTPS request; it is not specifically collected or analyzed.

The server (DreamHost, hosting laupin.ca) keeps standard access logs containing IP, timestamp, requested URL, and User-Agent. Those logs exist independently of this app and are subject to DreamHost's logging retention. No part of the app reads, exports, or analyzes them.

The update check can be disabled from About → Updates → Automatic checks. When disabled, the app makes no outbound network requests at all.

Buying a license

Buying a license happens on the web, not in the app. When you click Buy a license on the download page you are sent to a checkout hosted by Lemon Squeezy, which processes the payment and emails you the license key. Lemon Squeezy is the seller of record and handles your payment details and any tax; their handling of that data is covered by their own privacy policy, not this one. Laupin never sees your card number.

The license key you receive is tied to nothing but itself: the app validates it entirely offline (see below) and still has no account, no sign-in, and sends no purchase or identity information anywhere. Entering, copying, or removing a key never leaves your device.

Permissions

• Bluetooth (paired devices) — needed to read your paired-device list and detect when the device you chose connects or disconnects. The app does not scan for new Bluetooth devices and does not access Bluetooth Low Energy advertising data.
• Network state, Wi-Fi state, change Wi-Fi state — used by the hotspot control code path on Android versions that expose Wi-Fi tethering through these capabilities. No general-purpose network or Wi-Fi monitoring.
• Internet — used only for the update check above.
• Notifications — used to surface hotspot action results when the app is not in the foreground.
• Accessibility service (optional) — if you enable it, the app uses Android's accessibility framework to tap the Wi-Fi hotspot toggle in system Settings on your behalf as a fallback control path. It does not read, log, or transmit accessibility events for any other purpose. You can disable it any time from Android's system Accessibility settings.
• Shizuku permission (optional but recommended) — Shizuku is a separate app that runs an elevated process under your control. WhisperTether communicates with Shizuku locally to send hotspot enable/disable commands. The communication is entirely on-device; nothing about Shizuku connects the app to a network.

What the app does not do

• No analytics, telemetry, crash reporting, or usage statistics.
• No advertising or ad-tracking SDKs.
• No user account, no sign-in. (Licensing is a local, offline key check — there is no licensing server to phone home to.)
• No access to contacts, calendar, SMS, call logs, photos, files, microphone, camera, or location.
• No cloud backup of any app state.
• No data sold or shared with third parties; the operator has nothing to sell.

Security

The update check uses HTTPS only; the app rejects any non-HTTPS URL in the update manifest. The APK itself is signed by a long-lived Laupin signing certificate; Android refuses to install an updated APK signed by a different key over an existing install. The certificate fingerprint is published on the download page so you can verify it after install.

Changes to this policy

Material changes to this policy will be noted in the app's changelog (visible on the GitHub Releases page) and accompanied by an update of the Last updated date at the top of this document.

Contact

Questions about this policy can be raised as a GitHub issue at github.com/Laupin-ca/whispertether.