BigBrainParking/docs/OFFICIAL_APP_PRIVACY.md

# What the official ParkSmarter app does with your privacy

*A plain-language look at the official **ParkSmarter** app for Android
(`com.ipsgroupinc.parksmarter`, version 4.4.0), and how **BigBrainParking** — this
open-source alternative — is different.*

This was written by taking the official app apart: reading its program code, and
watching its real network traffic through a proxy. Where we're **sure**, we say
so; where something is situational, we say that too. (For the technical teardown
with diagrams and evidence, see
[OFFICIAL_APP_REVERSE_ENGINEERING.md](OFFICIAL_APP_REVERSE_ENGINEERING.md).)

---

## The short version

- **Your exact location is sent to ParkSmarter's servers when you use the map**
  to find meters — and the app is built to do this **automatically** when the map
  opens, not only when you ask it to "find parking near me."
- **The app carries one heavy tracking tool — Instabug** — that can record your
  screen, take screenshots, and log the app's network activity, reporting to an
  outside company.
- **It sends a permanent per-device ID to ParkSmarter.** It is *not* your phone's
  IMEI (despite the app calling the field `IMEINumber`) — it's Android's device
  ID. Still a fixed code that identifies your specific phone to ParkSmarter.
- **Good news:** it **cannot** track your location while the app is closed.
- **BigBrainParking removes the tracking entirely** and only sends your location
  when *you* deliberately tap "My location" and search.

---

## First, why does this matter?

"Location data" is a record of where you physically are. On its own, one location
isn't a big deal. But a *stream* of them — collected quietly and often — reveals
where you live, work, worship, and who you visit. Tie that to a permanent ID for
your phone and it becomes a profile of you that can be sold, leaked, or
subpoenaed. So the questions that matter are: **who collects it, how often, is it
tied to your identity, and does it leave in ways you didn't ask for?**

---

## When does the official app send your location to ParkSmarter?

**To ParkSmarter's own servers, your GPS is used for one thing: finding nearby
meters.** We confirmed this by watching the traffic: the coordinates go out as a
`GET …/api/Meter?Lat=…&Long=…` request, and your location is **not** attached to
logging in, starting a session, or paying. That part is reasonable.

**The catch is *when*.** The app is built to grab your live GPS and ask "what
meters are near me?" **automatically when the map opens** — no tap required — as
long as you're logged in and have granted location permission. So simply browsing
the map quietly sends your precise location to ParkSmarter.

> **One nuance we saw firsthand:** on a de-Googled phone (GrapheneOS), the map
> itself doesn't draw (it needs Google services), which can suppress that
> automatic send. On a normal Google phone the auto-send happens as designed.

**BigBrainParking does the opposite on purpose:** it opens on your **last parking
lot** (from your own history, not your GPS), and it only sends your location when
you *explicitly* tap **"My location"** and then search.

---

## The bigger privacy concerns

### 1. A heavy tracking tool: Instabug

The app bundles **Instabug**, a monitoring/bug-reporting toolkit — and it's the
serious one. It's capable of:

- **recording your session / replaying what you did**,
- **taking screenshots** of the app,
- **logging the app's network requests**,
- **tracking your taps and the steps you take** through the app.

All of this reports to an outside company's servers (`api.instabug.com`). We saw
it phone home the moment the app started.

> **What it is *not*:** we specifically checked and the app does **not** contain
> Segment, Amplitude, Sentry, Google Analytics/Firebase-Analytics, an advertising
> ID, or Play Store install-tracking. (An earlier version of this note listed
> those — that was wrong; Instabug is the actual story.) Google is present only
> for **push notifications**.

> **BigBrainParking has none of this.** No Instabug, no analytics, no ad-ID, no
> Google services at all.

### 2. A permanent device ID sent to ParkSmarter

When you log in, the app sends ParkSmarter a fixed identifier for your phone,
inside a request to `…/api/Device`. The field is **named `IMEINumber`**, which is
misleading — **it is not your IMEI**. Modern Android forbids apps from reading the
IMEI at all, and this app never tries. The value it actually sends is your
phone's **Android device ID** (a code assigned to your device). Unlike a password,
it doesn't change, so it can be used to recognize your specific phone over time.
It goes only to ParkSmarter, not to a third party.

> **BigBrainParking never reads or sends any device ID.**

### 3. Other capabilities worth knowing about

- **Microphone & camera permissions** — camera is for scanning kiosk QR codes;
  microphone is unusual for a parking app (may be an unused library leftover).
- **Wi-Fi & phone-state access** — used by a networking library to report your
  connection type and carrier name; it does **not** read your IMEI.
- **Bluetooth** — for talking to parking meters directly.
- **Google push messaging (FCM)** — notifications route through Google.

---

## To be fair — what it does *not* do

- **No background location tracking.** The app has the everyday location
  permission but **not** the "all the time / background" one, so it can't follow
  you when it's closed.
- **No IMEI, no advertising ID, no Segment/Amplitude/Sentry.**
- Your location going to ParkSmarter is genuinely limited to the "find nearby
  meters" feature — it isn't stapled onto payments or your account details.

---

## Side-by-side

| | Official ParkSmarter app | BigBrainParking |
| --- | --- | --- |
| Sends GPS to ParkSmarter | **Automatically** when the map opens | **Only** when you tap "My location" and search |
| Opens the map on… | Your current GPS location | Your **last parking lot** (not your GPS) |
| Third-party tracking SDKs | **Instabug** (session replay, screenshots, network logs) | **None** |
| Advertising ID / cross-app tracking | **No** (none present) | **Never** |
| Sends a permanent device ID | **Yes** — Android device ID, sent as `IMEINumber` | **Never** |
| Reads your hardware IMEI | **No** (not possible on modern Android) | **Never** |
| Google services required | Yes (push notifications) | **None** (runs on GrapheneOS) |
| Background location | No | No |
| Source code you can inspect | No (closed) | **Yes** (this repo) |

---

## How we checked (for the curious)

- **Permissions** come from the app's own `AndroidManifest`. Confirmed present:
  precise + approximate location, read-phone-state, Wi-Fi, microphone, camera,
  Bluetooth, Google push. Confirmed **absent**: background location.
- **The device-ID and location behavior** were read from the app's decompiled
  code (it's a React Native / Expo app, so the logic is in a JavaScript bundle)
  **and confirmed on the wire** with a live proxy capture: the `…/api/Device`
  request carrying the Android ID as `IMEINumber`, and the `…/api/Meter?Lat=…`
  request carrying GPS.
- **The SDK list** (Instabug present; Segment/Amplitude/Sentry/Firebase-Analytics/
  ad-ID absent) comes from searching the app's bundled code and its network
  endpoints.

*Not affiliated with or endorsed by IPS Group / ParkSmarter. This is an
independent, good-faith analysis of a publicly distributed app for the purpose of
building a privacy-respecting alternative. Findings reflect version 4.4.0 and
could change in later versions.*