Adds OFFICIAL_APP_REVERSE_ENGINEERING.md — a technical teardown (methodology,
auth model, device-ID, GPS, Instabug) with mermaid diagrams and the mitmproxy
capture timeline.
Corrects OFFICIAL_APP_PRIVACY.md, which was wrong on two counts:
- IMEI: the app reads no IMEI; it sends the Android SSAID to /api/Device in a
field misleadingly named IMEINumber.
- Trackers: Segment/Amplitude/Firebase-Analytics/Sentry/ad-ID are all ABSENT;
the real telemetry SDK is Instabug (session replay, screenshots, network logs).
Also folds in the confirmed GPS auto-send (with the GrapheneOS caveat).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docs/OFFICIAL_APP_PRIVACY.md — readable-by-anyone comparison based on the official
app's manifest + decompiled bundle (v4.4.0): auto-sends GPS to IPS on map open;
bundles Segment/Amplitude/Firebase/Sentry + ad-ID + install-referrer; can send
IMEI; but NO background location. Contrasts with BigBrainParking (explicit-only
location, zero analytics). Confidence levels labeled. Linked from README.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
