Android Privacy Policy

This policy covers the PopTrace Android app (app.poptrace). PopTrace helps you save and review clues about unexpected pop-ups. An app appearing in a record is a clue, not proof that it caused an advertisement. PopTrace does not require an account or show ads. The separate PopTrace WebUSB tool has its own privacy explanation on this website.

1. Window activity stays on your device

After you enable Android Accessibility access and start a recording session, PopTrace observes window-change metadata: the app package name, window class name and time. This can include activity from other apps while your recording session is active. The recorder cannot retrieve window contents or perform gestures. It does not read page text, screenshots or typed content. Enabling Accessibility access alone does not start a recording session.

Optional Usage Access adds recent foreground-app transitions to help explain a saved interval. You can decline this permission and still record window changes. These window and foreground-app records stay on your device; they are not included in the optional diagnostic events described below. If optional diagnostics are enabled, recording-verification signals and window-event count categories derived from this activity are sent to Google. The underlying window records, package names and class names stay on your device.

Live events are held in memory, with a maximum of 300 events. A saved capture covers the most recent 60 seconds and can include app names, timestamps, foreground context, your feedback and follow-up references. Only captures you choose to save are kept as history, up to 20 captures for 7 days. Expired captures are removed as PopTrace uses its history, with cleanup saved when the app next starts. Stopping clears the live buffer and keeps saved history. Clear history stops recording and removes saved captures. Android also removes app-private data when you uninstall the app.

Saved capture history is in app-private storage excluded from Android backup. This is separate from the optional cloud diagnostics and their retention periods.

2. Optional usage and crash diagnostics

Before enabling diagnostics, PopTrace asks you to choose whether to keep them on or turn them off. Firebase initialization is paused until you make this choice. Core recording, saving and history features work with diagnostics off. You can change your choice in Settings.

If you keep diagnostics on, Google Firebase Analytics and Crashlytics receive app interactions and lifecycle events, recording/capture workflow categories and counts, bounded recording-duration values, crash and ANR reports, technical stack traces, device/app information, random installation or app-instance identifiers, and approximate location inferred by Analytics from network addresses. PopTrace's own diagnostic events use fixed categories, counts and bounded duration values. They do not contain saved window records, other apps' package or class names, capture identifiers, search terms, page text, screenshots or typed content. Automatic crash reports can include technical stack traces.

We use diagnostics to understand feature use and improve reliability. Our Google Analytics account also allows Google to use Analytics data to improve Google products and services (including detecting and removing invalid advertising traffic in Google Ads), produce aggregated and de-identified modeling and business insights, provide technical support and offer business recommendations. For its own product-improvement use, Google acts under its applicable independent-controller terms. This additional use is part of the optional diagnostics choice.

PopTrace does not collect the Android advertising ID. Its advertising storage, advertising user-data and advertising-personalization consent settings remain denied when optional analytics is enabled. These app settings are distinct from the Analytics account's sharing settings.

3. Providers and processing locations

Optional diagnostics are processed by Google Firebase and Google Analytics under their applicable terms. Google may process them outside your country. Read Google's information about its processing and data-sharing practices:
https://firebase.google.com/support/privacy
https://support.google.com/analytics/answer/1011397
https://policies.google.com/privacy

We do not sell your personal data. We do not upload saved local window-history records through PopTrace's diagnostic event code. If you contact us by email, we receive the address and information you choose to include so we can respond; do not include sensitive window records unless needed for your request.

Website visits

When you view this policy or visit poptrace.app, Cloudflare delivers and protects the website and processes connection, request and security information. Its Web Analytics beacon measures page visits, referrers and browser performance. Browser security checks may run on HTML pages and may store their result in a cf_clearance cookie. The Cloudflare Web Analytics beacon itself does not use cookies or localStorage to collect its metrics; that does not mean the whole website is cookie-free. This website processing is separate from optional Firebase diagnostics inside the Android app, and the app diagnostics switch does not control it. Learn more: https://developers.cloudflare.com/speed/observatory/rum-beacon/ and https://developers.cloudflare.com/cloudflare-challenges/challenge-types/javascript-detections/ .

4. Cloud retention and your choices

The linked Analytics property is configured to retain event data for 2 months and user data for 14 months. New user activity resets the user-data retention period. These controls do not apply to most standard reports based on aggregated data, and are not a maximum lifetime for all data processed by Google.

Google states that Crashlytics retains crash stack traces, extracted minidump data and associated identifiers for 90 days before beginning removal from live and backup systems. That statement is separate from the Analytics settings and does not determine retention of any separately exported copies.

Turning diagnostics off stops new PopTrace usage/error events and requests SDK collection to stop. It also resets local Analytics state and requests removal of unsent Crashlytics reports where supported. Automatic crash-reporting changes fully take effect after restarting PopTrace. Turning diagnostics off, clearing local history or uninstalling the app does not automatically delete data already sent to Google.

You can request deletion of identifiable optional cloud diagnostic data by emailing [email protected] with the subject “PopTrace data deletion”. We receive, verify and process these requests against the data we can identify and control, available provider controls and applicable requirements. We may ask for information needed to match and verify a request; an email address alone may not identify an installation, and some historical records may not be identifiable. See our data deletion request page for the steps, data types and limits. PopTrace does not require an account.

5. Security

Local capture history uses Android app-private storage. Firebase SDK transmissions use HTTPS according to Google's documentation. No storage or transmission method can be guaranteed completely secure.

6. Audience and updates

PopTrace is intended for people aged 13 and above and is not designed for children under 13. For privacy concerns involving a child, contact [email protected].

We may update this policy as the app or its data practices change. The current Android policy is linked from https://poptrace.app/#privacy and within PopTrace. Its update date appears above.