BigBrainParking/docs/OFFICIAL_APP_PRIVACY.md

What the official ParkSmarter app does with your privacy

A plain-language look at the official ParkSmarter app for Android (com.ipsgroupinc.parksmarter, version 4.4.0), and how BigBrainParking — this open-source alternative — is different.

This was written by taking the official app apart: reading its program code, and watching its real network traffic through a proxy. Where we're sure, we say so; where something is situational, we say that too. (For the technical teardown with diagrams and evidence, see OFFICIAL_APP_REVERSE_ENGINEERING.md.)

---

The short version

• Your exact location is sent to ParkSmarter's servers when you use the map to find meters — and the app is built to do this automatically when the map opens, not only when you ask it to "find parking near me."
• The app carries one heavy tracking tool — Instabug — that can record your screen, take screenshots, and log the app's network activity, reporting to an outside company.
• It sends a permanent per-device ID to ParkSmarter. It is not your phone's IMEI (despite the app calling the field IMEINumber) — it's Android's device ID. Still a fixed code that identifies your specific phone to ParkSmarter.
• Good news: it cannot track your location while the app is closed.
• BigBrainParking removes the tracking entirely and only sends your location when you deliberately tap "My location" and search.

---

First, why does this matter?

"Location data" is a record of where you physically are. On its own, one location isn't a big deal. But a stream of them — collected quietly and often — reveals where you live, work, worship, and who you visit. Tie that to a permanent ID for your phone and it becomes a profile of you that can be sold, leaked, or subpoenaed. So the questions that matter are: who collects it, how often, is it tied to your identity, and does it leave in ways you didn't ask for?

---

When does the official app send your location to ParkSmarter?

To ParkSmarter's own servers, your GPS is used for one thing: finding nearby meters. We confirmed this by watching the traffic: the coordinates go out as a GET …/api/Meter?Lat=…&Long=… request, and your location is not attached to logging in, starting a session, or paying. That part is reasonable.

The catch is when. The app is built to grab your live GPS and ask "what meters are near me?" automatically when the map opens — no tap required — as long as you're logged in and have granted location permission. So simply browsing the map quietly sends your precise location to ParkSmarter.

One nuance we saw firsthand: on a de-Googled phone (GrapheneOS), the map itself doesn't draw (it needs Google services), which can suppress that automatic send. On a normal Google phone the auto-send happens as designed.

BigBrainParking does the opposite on purpose: it opens on your last parking lot (from your own history, not your GPS), and it only sends your location when you explicitly tap "My location" and then search.

---

The bigger privacy concerns

1. A heavy tracking tool: Instabug

The app bundles Instabug, a monitoring/bug-reporting toolkit — and it's the serious one. It's capable of:

• recording your session / replaying what you did,
• taking screenshots of the app,
• logging the app's network requests,
• tracking your taps and the steps you take through the app.

All of this reports to an outside company's servers (api.instabug.com). We saw it phone home the moment the app started.

What it is not: we specifically checked and the app does not contain Segment, Amplitude, Sentry, Google Analytics/Firebase-Analytics, an advertising ID, or Play Store install-tracking. (An earlier version of this note listed those — that was wrong; Instabug is the actual story.) Google is present only for push notifications.

BigBrainParking has none of this. No Instabug, no analytics, no ad-ID, no Google services at all.

2. A permanent device ID sent to ParkSmarter

When you log in, the app sends ParkSmarter a fixed identifier for your phone, inside a request to …/api/Device. The field is named IMEINumber, which is misleading — it is not your IMEI. Modern Android forbids apps from reading the IMEI at all, and this app never tries. The value it actually sends is your phone's Android device ID (a code assigned to your device). Unlike a password, it doesn't change, so it can be used to recognize your specific phone over time. It goes only to ParkSmarter, not to a third party.

BigBrainParking never reads or sends any device ID.

3. Other capabilities worth knowing about

• Microphone & camera permissions — camera is for scanning kiosk QR codes; microphone is unusual for a parking app (may be an unused library leftover).
• Wi-Fi & phone-state access — used by a networking library to report your connection type and carrier name; it does not read your IMEI.
• Bluetooth — for talking to parking meters directly.
• Google push messaging (FCM) — notifications route through Google.

---

To be fair — what it does not do

• No background location tracking. The app has the everyday location permission but not the "all the time / background" one, so it can't follow you when it's closed.
• No IMEI, no advertising ID, no Segment/Amplitude/Sentry.
• Your location going to ParkSmarter is genuinely limited to the "find nearby meters" feature — it isn't stapled onto payments or your account details.

---

Side-by-side

	Official ParkSmarter app	BigBrainParking
Sends GPS to ParkSmarter	Automatically when the map opens	Only when you tap "My location" and search
Opens the map on…	Your current GPS location	Your last parking lot (not your GPS)
Third-party tracking SDKs	Instabug (session replay, screenshots, network logs)	None
Advertising ID / cross-app tracking	No (none present)	Never
Sends a permanent device ID	Yes — Android device ID, sent as IMEINumber	Never
Reads your hardware IMEI	No (not possible on modern Android)	Never
Google services required	Yes (push notifications)	None (runs on GrapheneOS)
Background location	No	No
Source code you can inspect	No (closed)	Yes (this repo)

---

How we checked (for the curious)

• Permissions come from the app's own AndroidManifest. Confirmed present: precise + approximate location, read-phone-state, Wi-Fi, microphone, camera, Bluetooth, Google push. Confirmed absent: background location.
• The device-ID and location behavior were read from the app's decompiled code (it's a React Native / Expo app, so the logic is in a JavaScript bundle) and confirmed on the wire with a live proxy capture: the …/api/Device request carrying the Android ID as IMEINumber, and the …/api/Meter?Lat=… request carrying GPS.
• The SDK list (Instabug present; Segment/Amplitude/Sentry/Firebase-Analytics/ ad-ID absent) comes from searching the app's bundled code and its network endpoints.

Not affiliated with or endorsed by IPS Group / ParkSmarter. This is an independent, good-faith analysis of a publicly distributed app for the purpose of building a privacy-respecting alternative. Findings reflect version 4.4.0 and could change in later versions.