Privacy Policy

“Stalker” app for iOS and Android · Last updated: 12 November 2026 · Deutsche Fassung

In short: Stalker works without an account and without servers of our own. All device findings, locations and settings are stored only on your phone. We have no access to them. No ads, no tracking, no analytics.

1. Controller

ALPTEC, owner: Berk Alp
Postfach 20251, Justus-Liebig-Straße 2-4
41564 Kaarst, Germany
Email: [email protected]

2. Data the app processes on your device

To detect whether a device is following you, the app processes locally on your device:

Bluetooth signals from nearby devices: technical identifier (often random and rotating), signal strength, device type and – if broadcast – the device name.
Nearby Wi-Fi networks (Android only): network name (SSID), access point identifier (BSSID), signal strength and frequency.
Your phone's location at the time of a finding – also in the background, but only while a scan is running and you have enabled background scanning.
Your input: safe places (e.g. home), devices marked as “known”, and settings.

Purpose: detecting location trackers and devices that follow you across several places, for your personal safety. Legal basis: Art. 6(1)(b) GDPR (providing the app feature you requested) and – where identifiers of other devices are concerned – Art. 6(1)(f) GDPR (legitimate interest in your personal safety). Identifiers of other devices generally do not identify people and never leave your device.

Retention: unremarkable devices are deleted automatically after 48 hours, all other findings after 30 days at the latest. You can delete the history or all data at any time under Settings → Your data.

3. What the app does not do

No user account, no registration.
No transfer of your findings or locations to us or third parties.
No advertising, no tracking, no analytics or statistics services.

4. Third-party services

Apple App Store / Google Play: Apple or Google handle the purchase and payment of your subscription under their own privacy policies. We receive no payment data.

RevenueCat, Inc. (USA): We use RevenueCat to manage your subscription (trial, status, restore). Transferred are a random, anonymous app user ID, App Store receipts, app version, device type, country/currency and, for technical reasons, your IP address. No locations and no device findings. Legal basis: Art. 6(1)(b) GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses. More: revenuecat.com/privacy.

Apple Maps (iPhone only): On iPhone the app shows the map using Apple's map service (MapKit). When you open the map, your iPhone loads map data from Apple; Apple processes, among other things, your IP address and the visible map area under its own privacy policy. Your device findings are not transmitted. More: Apple Maps & Privacy.

OpenStreetMap (Android only; OpenStreetMap Foundation, UK): When you open the map on Android, the app loads map tiles from OpenStreetMap servers. Your IP address and the visible map area are transmitted – but not your device findings. Legal basis: Art. 6(1)(f) GDPR (displaying a map). The UK benefits from an EU adequacy decision. More: osmfoundation.org/wiki/Privacy_Policy.

5. Permissions

Bluetooth: finding nearby devices; connecting only when you choose “Play sound” on a tracker.
Location: linking findings to places. In the background only while a scan is running.
Notifications: alerts when a device follows you.
Live Activities (iPhone): showing scan status on the lock screen.

You can revoke any permission at any time in your system settings.

6. Export and sharing

The app creates PDF reports and data exports (JSON) only when you request them. You decide where to share them.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). Since app data is stored only on your device, you can exercise access, export and erasure directly in the app under Settings → Your data. You may also lodge a complaint with a data protection supervisory authority.

9. This website

This website itself sets no cookies and uses no analytics, tracking or advertising services and no third-party fonts.

When you visit, the hosting provider stores technically necessary server logs (IP address, date and time, page requested, browser identifier) to deliver the site and fend off attacks. Legal basis: Art. 6(1)(f) GDPR. The website runs on a server operated by IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) in a data centre in Germany. Logs are deleted after a short time.

For protection against attacks and fast delivery, Cloudflare (Cloudflare, Inc., USA) sits in front of the server. Your IP address and technical connection data are routed through Cloudflare servers. Legal basis: Art. 6(1)(f) GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses. Cloudflare loads a check script to detect automated access (bots) and may set a strictly necessary security cookie for this (e.g. __cf_bm or cf_clearance); the email address on this site is also obfuscated against spam bots. These functions serve security only, not analytics. Legal basis: Art. 6(1)(f) GDPR. More: cloudflare.com/privacypolicy. Data processing agreements are in place with both providers.

If you contact us by email, we process your details only to answer your request and delete them once no longer needed.

10. Changes

We update this policy when the app or the law changes. The version published here applies.