BigBrainParking/docs/OFFICIAL_APP_PRIVACY.md

What the official ParkSmarter app does with your privacy

A plain-language look at the official ParkSmarter app for Android (com.ipsgroupinc.parksmarter, version 4.4.0), and how BigBrainParking — this open-source alternative — is different.

This was written by inspecting the official app's own files (its permission list and its program code). It's meant to be readable by anyone, not just programmers. Where we're sure, we say so; where we're making an educated guess, we say that too.

---

The short version

• Your exact location is sent to ParkSmarter's servers whenever you look at the map in the official app — automatically, just by opening it, not only when you ask it to "find parking near me."
• The app also carries a stack of tracking tools (Segment, Amplitude, Firebase, Sentry) that quietly report what you do and your device's identity to outside companies.
• It can read a permanent hardware ID from your phone and send it to ParkSmarter.
• Good news: it cannot track your location while the app is closed.
• BigBrainParking removes the tracking entirely and only sends your location when you deliberately tap "My location" and search.

---

First, why does this matter?

"Location data" is a record of where you physically are. On its own, one location isn't a big deal. But a stream of them — collected quietly and often — reveals where you live, work, worship, and who you visit. When that's combined with a permanent ID for your phone and shared with advertising/analytics companies, it becomes a profile of you that can be sold, leaked, or subpoenaed. So the questions that matter are: who collects it, how often, is it tied to your identity, and does it leave in ways you didn't ask for?

---

When does the official app send your location to ParkSmarter?

To ParkSmarter's own servers, your GPS is used for one thing: finding nearby meters. There are exactly two requests that carry your coordinates (finding meters near a point); your location is not attached to logging in, starting a parking session, or paying. That part is reasonable.

The catch is when it happens. The official app is built to grab your live GPS and ask ParkSmarter "what meters are near me?" automatically when you open the map — you don't have to tap anything. So simply browsing the app quietly sends your precise location to ParkSmarter's servers.

How sure are we? Fairly sure. The code clearly reads your current GPS and has a "nearby meters" feature wired to the map. Confirming the exact moment it fires would take watching the app's live network traffic, which we haven't done yet.

BigBrainParking does the opposite on purpose: it opens on your last parking lot (from your own history, not your GPS), and it only sends your location when you explicitly tap "My location" and then search.

---

The bigger privacy concerns

These are things the official app can do beyond the parking API itself. They're taken from the app's official permission list and the tracking libraries built into it.

1. Hidden tracking/analytics companies (the biggest one)

The app bundles four separate tracking/telemetry toolkits:

• Segment — a "customer data platform." Its whole job is to collect what you do in the app and fan it out to many other companies.
• Amplitude — product-analytics; records your actions to study behavior.
• Firebase (Google) and Sentry — Google's analytics/crash tools and an error tracker.

These typically collect: which screens you visit and when, your device model, and your IP address (which reveals your rough city/neighborhood), and often an advertising ID (a code used to follow you across different apps). Even without your exact GPS, this is a detailed behavioral profile shared with outside companies.

BigBrainParking has none of these. No Segment, no Amplitude, no Firebase, no Sentry, no ad-ID, no Google services at all.

2. A permanent hardware ID sent to ParkSmarter

The app is allowed to read phone/device identifiers (the "read phone state" permission), and it has a feature that sends your device's IMEI number — a permanent serial number for your phone — to ParkSmarter. Unlike a password you can change, this ID is fixed, so it can be used to recognize your specific phone forever.

BigBrainParking never reads or sends this.

3. Other capabilities worth knowing about

• Install tracking — records how you found/installed the app (via the Google Play "install referrer"), tied to your Play account.
• Wi-Fi scanning permission — can see the Wi-Fi networks around you, which can be used to estimate your location even without GPS.
• Microphone permission — unusual for a parking app. It may be an unused leftover from a library, but the app is allowed to access your microphone.
• Google push messaging (FCM) — notifications are routed through Google, which links your device to Google and to ParkSmarter's messaging system.

---

To be fair — what it does not do

• No background location tracking. This is important: the app can only see your location while you have it open and are using it. It has the everyday location permission but not the special "all the time / in the background" one, so it can't follow you around when the app is closed.
• Your location going to ParkSmarter is genuinely limited to the "find nearby meters" feature — it isn't stapled onto payments or your account details.

---

Side-by-side

	Official ParkSmarter app	BigBrainParking
Sends GPS to ParkSmarter	Automatically when you open the map	Only when you tap "My location" and search
Opens the map on…	Your current GPS location	Your last parking lot (not your GPS)
Hidden analytics/tracking SDKs	Segment, Amplitude, Firebase, Sentry	None
Advertising ID / cross-app tracking	Likely collected	Never
Sends a permanent device ID (IMEI)	Yes (feature exists)	Never
Google services required	Yes (Firebase, FCM)	None (runs on GrapheneOS)
Background location	No	No
Source code you can inspect	No (closed)	Yes (this repo)

---

How we checked (for the curious)

• Permissions come from the app's own AndroidManifest (the official list Android shows). Confirmed present: precise + approximate location, read-phone-state, Wi-Fi state, microphone, camera, Google push, install-referrer. Confirmed absent: background location.
• Tracking libraries and the location-bearing requests (getMetersByLocation / getLimitedMetersByLocation) and the IMEI-sending device-registration request come from reading the app's decompiled program code (version 4.4.0).
• Educated guesses (clearly labeled above) are the auto-send-on-open behavior and the advertising-ID collection — code strongly suggests them, but a live network capture would make them certain. We can do that capture if you want proof.

Not affiliated with or endorsed by IPS Group / ParkSmarter. This is an independent, good-faith analysis of a publicly distributed app for the purpose of building a privacy-respecting alternative. Findings reflect version 4.4.0 and could change in later versions.