From 8a5408d19321ecefffe50c11c7c07d2a52611123 Mon Sep 17 00:00:00 2001 From: Hank Date: Mon, 13 Jul 2026 19:49:16 -0700 Subject: [PATCH] docs: plain-language privacy analysis of the official ParkSmarter app MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit docs/OFFICIAL_APP_PRIVACY.md — readable-by-anyone comparison based on the official app's manifest + decompiled bundle (v4.4.0): auto-sends GPS to IPS on map open; bundles Segment/Amplitude/Firebase/Sentry + ad-ID + install-referrer; can send IMEI; but NO background location. Contrasts with BigBrainParking (explicit-only location, zero analytics). Confidence levels labeled. Linked from README. Co-Authored-By: Claude Fable 5 --- README.md | 10 +++ docs/OFFICIAL_APP_PRIVACY.md | 146 +++++++++++++++++++++++++++++++++++ 2 files changed, 156 insertions(+) create mode 100644 docs/OFFICIAL_APP_PRIVACY.md diff --git a/README.md b/README.md index c05e108..832caa8 100644 --- a/README.md +++ b/README.md @@ -43,6 +43,16 @@ bigbrainparking/ | Session-expiry reminders | ✅ wired | **local** on-device notifications — no server, no push | | UnifiedPush (ntfy) | ⚪ optional | not needed for reminders; stub for future server-initiated msgs | +## Privacy + +BigBrainParking sends your location to ParkSmarter **only** when you explicitly tap "My +location" and search; it opens on your last parking lot instead of your GPS, and ships **no** +analytics/tracking (no Segment/Amplitude/Firebase/Sentry, no ad-ID, no Google services). +For a plain-language comparison with the official app — which auto-sends your GPS on map +open and bundles that tracking stack — see +**[docs/OFFICIAL_APP_PRIVACY.md](docs/OFFICIAL_APP_PRIVACY.md)**. What reaches the API and +what never does is also spelled out in the app's **About** page. + ## Build & run (dev) Requires Node 20, JDK 17, Android SDK, and a GrapheneOS device (or any Android device) diff --git a/docs/OFFICIAL_APP_PRIVACY.md b/docs/OFFICIAL_APP_PRIVACY.md new file mode 100644 index 0000000..7cca411 --- /dev/null +++ b/docs/OFFICIAL_APP_PRIVACY.md @@ -0,0 +1,146 @@ +# What the official ParkSmarter app does with your privacy + +*A plain-language look at the official **ParkSmarter** app for Android +(`com.ipsgroupinc.parksmarter`, version 4.4.0), and how **BigBrainParking** — this +open-source alternative — is different.* + +This was written by inspecting the official app's own files (its permission list and +its program code). It's meant to be readable by anyone, not just programmers. Where we're +**sure**, we say so; where we're making an educated guess, we say that too. + +--- + +## The short version + +- **Your exact location is sent to ParkSmarter's servers whenever you look at the map** + in the official app — automatically, just by opening it, not only when you ask it to + "find parking near me." +- **The app also carries a stack of tracking tools** (Segment, Amplitude, Firebase, + Sentry) that quietly report what you do and your device's identity to outside companies. +- **It can read a permanent hardware ID from your phone and send it to ParkSmarter.** +- **Good news:** it **cannot** track your location while the app is closed. +- **BigBrainParking removes the tracking entirely** and only sends your location when + *you* deliberately tap "My location" and search. + +--- + +## First, why does this matter? + +"Location data" is a record of where you physically are. On its own, one location isn't +a big deal. But a *stream* of them — collected quietly and often — reveals where you live, +work, worship, and who you visit. When that's combined with a permanent ID for your phone +and shared with advertising/analytics companies, it becomes a profile of you that can be +sold, leaked, or subpoenaed. So the questions that matter are: **who collects it, how +often, is it tied to your identity, and does it leave in ways you didn't ask for?** + +--- + +## When does the official app send your location to ParkSmarter? + +**To ParkSmarter's own servers, your GPS is used for one thing: finding nearby meters.** +There are exactly two requests that carry your coordinates (finding meters near a point); +your location is **not** attached to logging in, starting a parking session, or paying. +That part is reasonable. + +**The catch is *when* it happens.** The official app is built to grab your live GPS and +ask ParkSmarter "what meters are near me?" **automatically when you open the map** — you +don't have to tap anything. So simply browsing the app quietly sends your precise location +to ParkSmarter's servers. + +> **How sure are we?** *Fairly sure.* The code clearly reads your current GPS and has a +> "nearby meters" feature wired to the map. Confirming the exact moment it fires would take +> watching the app's live network traffic, which we haven't done yet. + +**BigBrainParking does the opposite on purpose:** it opens on your **last parking lot** +(from your own history, not your GPS), and it only sends your location when you *explicitly* +tap **"My location"** and then search. + +--- + +## The bigger privacy concerns + +These are things the official app *can* do beyond the parking API itself. They're taken +from the app's official permission list and the tracking libraries built into it. + +### 1. Hidden tracking/analytics companies (the biggest one) + +The app bundles four separate tracking/telemetry toolkits: + +- **Segment** — a "customer data platform." Its whole job is to collect what you do in the + app and fan it out to many other companies. +- **Amplitude** — product-analytics; records your actions to study behavior. +- **Firebase** (Google) and **Sentry** — Google's analytics/crash tools and an error tracker. + +These typically collect: **which screens you visit and when, your device model, and your +IP address** (which reveals your rough city/neighborhood), and often an **advertising ID** +(a code used to follow you across different apps). Even without your exact GPS, this is a +detailed behavioral profile shared with outside companies. + +> **BigBrainParking has none of these.** No Segment, no Amplitude, no Firebase, no Sentry, +> no ad-ID, no Google services at all. + +### 2. A permanent hardware ID sent to ParkSmarter + +The app is allowed to **read phone/device identifiers** (the "read phone state" +permission), and it has a feature that sends your device's **IMEI number** — a permanent +serial number for your phone — to ParkSmarter. Unlike a password you can change, this ID +is fixed, so it can be used to recognize your specific phone forever. + +> **BigBrainParking never reads or sends this.** + +### 3. Other capabilities worth knowing about + +- **Install tracking** — records how you found/installed the app (via the Google Play + "install referrer"), tied to your Play account. +- **Wi-Fi scanning permission** — can see the Wi-Fi networks around you, which can be used + to *estimate your location even without GPS*. +- **Microphone permission** — unusual for a parking app. It may be an unused leftover from + a library, but the app is allowed to access your microphone. +- **Google push messaging (FCM)** — notifications are routed through Google, which links + your device to Google and to ParkSmarter's messaging system. + +--- + +## To be fair — what it does *not* do + +- **No background location tracking.** This is important: the app can only see your + location **while you have it open and are using it**. It has the everyday location + permission but **not** the special "all the time / in the background" one, so it can't + follow you around when the app is closed. +- Your location going to ParkSmarter is genuinely limited to the "find nearby meters" + feature — it isn't stapled onto payments or your account details. + +--- + +## Side-by-side + +| | Official ParkSmarter app | BigBrainParking | +| --- | --- | --- | +| Sends GPS to ParkSmarter | **Automatically** when you open the map | **Only** when you tap "My location" and search | +| Opens the map on… | Your current GPS location | Your **last parking lot** (not your GPS) | +| Hidden analytics/tracking SDKs | Segment, Amplitude, Firebase, Sentry | **None** | +| Advertising ID / cross-app tracking | Likely collected | **Never** | +| Sends a permanent device ID (IMEI) | Yes (feature exists) | **Never** | +| Google services required | Yes (Firebase, FCM) | **None** (runs on GrapheneOS) | +| Background location | No | No | +| Source code you can inspect | No (closed) | **Yes** (this repo) | + +--- + +## How we checked (for the curious) + +- **Permissions** come from the app's own `AndroidManifest` (the official list Android + shows). Confirmed present: precise + approximate location, read-phone-state, Wi-Fi + state, microphone, camera, Google push, install-referrer. Confirmed **absent**: + background location. +- **Tracking libraries** and the **location-bearing requests** (`getMetersByLocation` / + `getLimitedMetersByLocation`) and the **IMEI-sending** device-registration request come + from reading the app's decompiled program code (version 4.4.0). +- **Educated guesses** (clearly labeled above) are the auto-send-on-open behavior and the + advertising-ID collection — code strongly suggests them, but a live network capture would + make them certain. We can do that capture if you want proof. + +*Not affiliated with or endorsed by IPS Group / ParkSmarter. This is an independent, +good-faith analysis of a publicly distributed app for the purpose of building a +privacy-respecting alternative. Findings reflect version 4.4.0 and could change in later +versions.*