Privacy Policy

Scope and who we are

This policy applies to the RtiTek app (the "app") on iOS and Android. The app is developed and operated by Shenzhen Rti-Tek Co., Ltd. ("we", "us"). If you have any questions about this policy, email [email protected].

Data stored on your phone

The following data is kept in the app's own storage and is not sent to us automatically:

• Your devices: device names, product models, Bluetooth identifiers (the device's Bluetooth address on Android, an identifier assigned by the system on iOS), the device state last read (such as temperature and mode) and related times.
• Pairing credentials: the keys the app uses to talk to your devices, kept in the secure storage provided by the system (the Keychain on iOS, the Keystore on Android).
• Settings and cached files: theme, language and applet automatic update settings, plus downloaded product icons, applets and firmware files.
• Logs: records the app writes while running, used for troubleshooting. They include the screens you opened and the buttons you tapped, the communication with your devices (including their Bluetooth identifiers and the commands sent and received), the addresses and results of internet requests, and errors. Logs take up at most about 50 MiB; beyond that, the oldest entries are deleted.

The device list and settings are stored encrypted, with the encryption key kept in the system's secure storage. Logs are not separately encrypted and are protected by the system's isolation of app data. If you use system backups (such as iCloud or Google backup), this data may be included in them, depending on your phone and your backup settings.

When the app connects to the internet

Adding, controlling and sharing devices does not need an internet connection. The app contacts our servers in these cases:

• Product icons and names: when you open or return to the app, it checks for updates and downloads icons for the products you have added.
• Applet updates: when you open or return to the app, it checks whether the controls (applets) used by your devices have a new version and downloads it. You can turn off "Automatic updates" in the device settings.
• Firmware: when you open a device's firmware update screen, the app downloads the firmware for that product to compare it with the version on the device and to install it.

These requests do not contain an account, your name, the installation ID, your devices' Bluetooth addresses or serial numbers. The request addresses include product models, applet identifiers and version numbers, so the server can tell which product a file is for. As with any internet request, the server also sees your IP address. We use this information only to deliver the files to you.

The files are served from api.rti-tek.fr and api.rti-tek.org, which are hosted on Cloudflare.

Uploading logs

Log upload exists for troubleshooting and is hidden by default: in Settings, tap "Version" 7 times to unlock Developer Options, then turn on "Show Log Upload Button" to show the upload button at the bottom right of the screen (see Help for the steps). The app uploads logs only when you tap this button and choose a time range.

An upload contains the logs from the chosen time range (described in the previous section), plus:

• the app version, the operating system and its version, and on Android the phone's brand and model;
• the installation ID: a random number created the first time the app is used after installation, used to tell uploads from the same phone apart;
• the name you entered in the "Operator" field under Settings → Diagnostics (optional).

The app first asks our server fabric.rti-tek.net for permission to upload, then uploads the log file to Alibaba Cloud object storage. When the upload finishes, the app shows a 6-character upload ID that is used to find these logs; it contains no information about you.

Uploaded logs are used only for troubleshooting and are deleted once the problem has been dealt with. To have them deleted sooner, send the upload ID to [email protected].

Permissions the app asks for

• Bluetooth: to scan for and connect to your devices.
• Location (Android 11 and earlier): these Android versions require location permission to scan for Bluetooth devices. The app does not read your location because of it.
• Location (when an applet asks): a product's applet can read your location with your consent (for example, to show local weather); the system asks you first. None of the applets built into the app currently asks for location.
• Camera: only to scan QR codes (to add or share a device). The image is processed on the phone and is neither stored nor uploaded.
• Notifications (Android 13 and later): to show progress while a firmware update runs in the background.

The app does not access your contacts, photos or microphone.

Sharing devices and exporting

Sharing a device: two phones scan the QR codes on each other's screens. The device's pairing credentials are encrypted and pass only between the two phones through their screens, without any server; the QR code for receiving a device is valid for 5 minutes.

Exporting the device list: the exported JSON file contains device names, Bluetooth identifiers, products and the last device state, but no pairing credentials.

Exporting logs: the exported file contains the logs from the chosen time range, with the installation ID, phone model, operating system version and app version at the top.

Exported files are handed to the app you choose in the system share menu; the app does not send them to us.

Developer options

Developer options are meant for testing and development and are hidden by default. Besides log upload, they include a "Debug bridge": when turned on, the app sends its logs and the device list to the computer address you scan or enter, without going through our servers.

Third-party services

The app contains no third-party advertising, analytics or crash reporting services, and we do not sell your data. The app uses these outside services:

• Cloudflare: hosts the servers that provide product icons, product names, applets and firmware.
• Alibaba Cloud: stores the logs you choose to upload.
• Google ML Kit (Android only): the Android app uses Google ML Kit to recognize QR codes on the phone. Camera images are not sent to Google. According to Google, ML Kit sends Google diagnostics and usage data such as the phone model, operating system version, the app's package name and version, processing time, and a per-installation identifier that is not used to identify users. See Google's disclosure.

Children

The app is not designed for children, and we do not knowingly collect personal information from children.

Viewing and deleting your data

• Removing a device also deletes its pairing credentials; Settings → Data → Remove All Devices removes them all at once.
• Settings → Diagnostics → Clear Logs deletes all logs on the phone.
• You can turn off applet "Automatic updates" in the device settings.
• Uninstalling the app deletes all the data it keeps on the phone (except copies in system backups).
• For logs you have uploaded, you can ask to see or delete them by emailing [email protected] with the upload ID. Depending on where you live, you may have other rights, such as asking us to correct your personal information or restrict how we process it; contact us at the same address.

Changes to this policy

When the way the app handles data changes, we will update this policy and the date at the top of this page.

Contact us

Shenzhen Rti-Tek Co., Ltd.
Email: [email protected]
Website: www.rti-tek.com