Skip to main content

Security

A location history is a record of where someone has been. This page says plainly what is protected, how, and what is not.

The full technical detail is in the Security reference. This is the summary.

Nothing leaves the phone unless you turn sync on​

Recording writes to a database on the device. Cloud sync is off until you switch it on, and the app is fully usable with it off — history, trips, zones, import and export all work locally.

In transit​

With sync on, points go over HTTPS to REITrack Cloud, and nowhere else. The destination is not configurable, so location data cannot be redirected to a third party by a misconfiguration or by someone with brief access to the settings.

Certificate validation accepts two trust sources: the system CAs that ship with Android, and a single CA you import inside the app. CAs installed into the Android system store are not honoured — so malware or a managed profile that plants a certificate on the device still cannot read REITrack's sync traffic.

Mutual TLS is supported. The client certificate's private key lives in the Android KeyChain, often hardware-backed, and cannot be extracted.

At rest, on the device​

Credentials are encrypted. Authentication details are held in Android's EncryptedSharedPreferences under AES-256-GCM. Sensitive header values are masked in log exports.

Location history is not encrypted. The SQLite database holding your tracks is stored unencrypted. Android's app sandbox keeps other apps out, but someone with physical access to an unlocked or rooted device could read it.

That is a real limitation and it is stated here rather than buried. If the threat you are guarding against is someone taking the phone, device encryption and a strong screen lock are what protect the database — the app does not add a second layer on top.

Backups​

Backups are a single archive encrypted with a password you choose: AES-256-GCM, keys derived with Argon2id, a fresh random salt per backup, and a 12-character minimum with a strength meter.

There is no recovery. No escrow, no reset code, no developer override. A forgotten password means an unreadable file.

Note that sync credentials are placed inside the encrypted archive in plaintext, protected by the backup password rather than by the device key. The mTLS client certificate is deliberately not included, because its private key cannot leave the device it was imported on.

What REITrack does not collect​

  • No analytics, telemetry or crash reporting
  • No advertising SDKs or tracking pixels
  • No device identifiers or advertising IDs
  • Nothing shared with the developer or any third party

Reporting a problem​

If you find a security issue, please report it before disclosing it publicly. Contact details are in the Privacy Policy.