Skip to content

Privacy

Last updated 13 November 2026

This text is written in English. Translations into other languages are provided for convenience; where a translation differs, the English text applies.

This policy covers the TrackerScan app for Android, the account service behind it and this website.

In short

TrackerScan looks for Bluetooth trackers near your phone. Everything it finds, and every place where it found it, stays on your phone. Our server knows your Google account e-mail address and whether you have a trial or a subscription. Nothing else.

Who we are

TrackerScan is a product of OID4Pay B.V. (“we”), which decides what happens to the data below (the “controller” under the GDPR). OID4Pay B.V., Nassaukade 51-2, 1052 CN Amsterdam, the Netherlands. KvK 42074824. hello@trackerscan.app

On your phone only

  • Trackers TrackerScan has heard: their type, their changing Bluetooth address, signal strength, and the time.
  • Your location at the moment a tracker was heard, so the app can tell whether the tracker moves with you. This is why the app asks for location, also in the background.
  • Alerts, and the trackers you marked as ignored or not a threat.

This data is never sent to us or to anyone else. It is deleted automatically after 30 days. You can delete it at any time in the app (Settings, Detection, Delete tracker data) or by uninstalling the app. If you export a tracker, the app hands a file to the app you choose; that is your decision and your file.

On our server

  • Your account: the identifier Google gives us for your Google account, and the e-mail address Google confirmed. You sign in with Google; we never see your password.
  • Your free trial: when it started and when it ends.
  • Your subscription: the Google Play purchase token, its state and when the period you paid for ends. Google Play handles the payment; we never see your payment details.
  • Sign-in sessions: one per signed-in phone, kept only as a one-way hash, ending after at most 30 days unused.
  • Preferences: settings the app keeps for your account.
  • If notifications are on: the Firebase Cloud Messaging token of your phone, to send you notifications about your account.

We use this to run your account, your trial and your subscription (performance of a contract, GDPR art. 6(1)(b)). It is kept until you delete your account, and then deleted at once.

To keep accounts safe, the server counts sign-in attempts and requests per phone for a short time, in memory (legitimate interest, GDPR art. 6(1)(f)). Its operational logs note sign-ins, trials and subscriptions by an internal account number, not by e-mail address, and are kept only as long as needed to run and secure the service.

One free trial per Google account

When you start using TrackerScan we keep a keyed hash (HMAC) of your Google account identifier and of your e-mail address, also after you delete your account, so that a new account for the same login does not get a second free trial. It holds no e-mail address and cannot be turned back into one without our key. We keep it for as long as TrackerScan offers a free trial (legitimate interest, GDPR art. 6(1)(f)).

Crash reports

When the app crashes, it sends a crash report to Firebase Crashlytics (Google): the error, your phone model, Android version, app version and a random installation identifier. No tracker data and no location. We use it to fix bugs (legitimate interest, GDPR art. 6(1)(f)). You can turn it off in the app's Settings.

Who else handles data

  • Google: Sign in with Google, Google Play billing, Firebase Crashlytics and Firebase Cloud Messaging.
  • MailOdds, our mail provider, receives e-mail you send to trackerscan.app addresses.

Google (Google LLC) may process data in the United States, under the EU–US Data Privacy Framework, and under the European Commission's standard contractual clauses where that does not apply. The account service and this website run on yourglobal.store, a service of OID4Pay B.V., on servers in the European Union. We do not sell data, show ads, or use analytics or advertising SDKs in the app.

This website

This website shows no ads and loads no third-party trackers or scripts. It sets cookies of its own, each holding a random number or a code from the link you came in by:

  • yg_v lets the website know your browser when you come back. It lasts 400 days.
  • yg_s holds one visit. It ends 30 minutes after your last page.
  • yg_ps lasts 30 days. It remembers that your browser went, for a moment, through the address of yourglobal.store, which sets its own cookie there, yg_pd, for 400 days. Shops on yourglobal.store use it to know a browser that opens a link in one of their emails; this website sends no such emails.
  • yg_adclick keeps the click id of an ad you came from, for 90 days, and yg_aff the code of a partner's link, for 30 days. Each is set only when the link you opened carries one.

With them, the website records which of its pages were opened in a visit, when, in which language, and the country your internet address belongs to. On the first page of a visit it also keeps a scrambled form of the part of your internet address that your whole network shares. These records are kept for at most 400 days, and we use them to see how people find and use this website (legitimate interest, GDPR art. 6(1)(f)). If your browser sends the Global Privacy Control signal, the website records none of your visits, never sends your browser through yourglobal.store and keeps no ad click id; it still sets yg_v, which keeps showing you the same version of a page.

Your rights

  • Access and portability: in the app, Settings gives you a copy of everything our server keeps about your account, in a machine-readable file.
  • Deletion: delete your account in the app, or as described here. It is immediate, apart from the trial hash above.
  • Correction, restriction, objection, or a question: write to hello@trackerscan.app, from the address of your Google account if it is about your account. You get an answer within one month.
  • A complaint: you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the one where you live.

TrackerScan makes no automated decisions about you with legal or similar effect. Its risk level for a tracker is a hint for you, computed on your phone.

Children

You must be 18 or older to use TrackerScan. It is not directed at children.

Changes

When this policy changes, the date at the top changes with it. If a change affects what we do with your data, we tell you in the app before it applies.