Privacy Policy

Last updated 27 August 2026

LOTSE is a Wi-Fi manager and VPN client. It watches networks for a living, so a privacy policy that waved its hands would be worth nothing. This one is specific.

The short version

The app collects nothing. There is no analytics, no crash reporting, no telemetry, no advertising identifier and no account. Everything LOTSE learns about your networks stays on your Mac, and — if you switch iCloud sync on — in your private iCloud database, which we cannot read.

What follows is the long version, including the parts that are less flattering: our web servers keep ordinary access logs, and the app talks to a handful of hosts to do its job.

Who is responsible

Controller: Stefan Gentz
Address: Paracelsusstr. 59
53177 Bonn
Germany
Privacy: support@lotse.cloud
Security: security@lotse.cloud

What the app stores, and where

LOTSE keeps a record of the networks you join: names, router identifiers, signal quality, measured MTU, the trust level you assigned, your own notes and — if you allow Location access — an approximate position so it can tell one café from another. It also stores the VPN profiles you import.

All of it lives on your Mac, in the app's sandbox container. Passwords, private keys and VPN credentials live in the macOS Keychain, never in a plain file.

iCloud sync is off until you turn it on. When you do, that record syncs through your private CloudKit database using your Apple Account. It moves between your own devices. We operate no server in that path and have no way to read it — Apple's private database is not visible to a developer.

The app ships a privacy manifest that Apple validates on every submission. It declares no collected data types, no tracking, and no tracking domains. Two system APIs are declared with their required reasons: user defaults (CA92.1, for the app's own settings) and file timestamps (C617.1, for its own files).

What the app connects to

A network tool has to touch the network. Here is every host LOTSE reaches on its own, and why.

db.lotse.cloud: Weekly download of the offline lookup databases — hardware vendor names, USB identifiers, network-operator ranges. The request says which file it wants and nothing about you.
heartbeat.lotse.cloud: A small UDP echo used to tell “the internet is down” from “this network is broken”. It falls through to two independent public resolvers, so the feature works with our server unreachable.
udp-echo-responder.lotse.cloud: Packet-size and latency measurement. Stateless, and it keeps no record of who asked.
Public DNS resolvers: Reachability probes to well-known addresses such as 1.1.1.1 and 8.8.8.8. No name of yours is in them.
Apple: Location (Wi-Fi positioning) and place names for the map, through Apple's own frameworks and Apple's privacy terms. Only with your permission, and the app works without it.
The network you are on: Your router, its captive portal, and — aboard some trains and aircraft — the operator's own onboard service, to name the vehicle you are in. Only while you are connected to that network.
Speed-test servers: Only when you start a speed test, and to the server list that test uses.
Your own infrastructure: Your VPN endpoints and, if you configured one, your own AdGuard Home. Those are your servers; we never see the traffic.

What LOTSE never sends anywhere: your network list, your notes, your trust decisions, your VPN configuration, your keys, your position.

What our servers record

Almost nothing, and that is a configuration choice rather than a promise. Access logging is switched off as the server-wide default, so a host has to ask for it explicitly rather than inherit it by accident.

lotse.cloud: No access log. This site is a few static pages; an IP address would answer no question we have.
db.lotse.cloud: An access log without your IP address. It records the time, the method, the path, the status, the size and the user agent — enough to see that a 14 MB database was served and whether the client was LOTSE or a scraper, and not enough to say who. Kept 14 days, then rotated away. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
heartbeat.lotse.cloud: No per-request logging. Start-up messages and failures only.
udp-echo-responder.lotse.cloud: Nothing. The responder is stateless by design and keeps no record of who asked.

The exception, because leaving it out would be the dishonest part: nginx's error log still records a client IP when a request actually fails. That log is what makes a broken deployment diagnosable, so it stays. It is not written for successful requests, and it rotates on the same 14-day schedule.

There are no cookies on this site, no analytics, no third-party scripts and no web fonts. The stylesheet is served from this domain, which is why the page needs no consent banner: there is nothing to consent to.

When you write to us

The contact form sends exactly what you type into it: the topic, your name, your e-mail address, a subject, your message, and optionally the LOTSE version. Nothing else — no IP address, no browser fingerprint, no cookie. Everything stored is something you can see on the page before you press send.

The message is held in a small database on the server only until it has been moved into the mailbox, and is deleted there immediately afterwards. In normal operation that is minutes; if the receiving machine is offline it can be hours. It is a real store of personal data for that time, which is why it is named here rather than glossed as “nothing is kept”.

After that the message lives in an ordinary mailbox, for as long as answering you and keeping a record of the exchange requires. Legal basis: legitimate interest in answering an enquiry, Art. 6(1)(f) GDPR — and Art. 6(1)(b) where the enquiry concerns a purchase you have made.

Your address is used to answer you and for nothing else. There is no newsletter, and it is never passed on.

Writing to support@lotse.cloud directly reaches the same mailbox without the intermediate step. Either route is fine.

Sending the form makes your browser solve a small arithmetic puzzle first. It runs entirely in your browser, sets nothing and reports nothing back beyond the answer; it exists so the form can work without a CAPTCHA from another company.

Purchases

Subscriptions are handled entirely by Apple through the App Store. We never see your name, your address or your payment details — only whether an anonymous receipt entitles this copy of the app to the paid features. Apple's own privacy policy governs that transaction.

Your rights

Under the GDPR you may request access to the personal data we hold about you, correction, deletion, restriction of processing, portability, and you may object to processing based on legitimate interest. In practice there are only two kinds: a web-server log entry that expires within 14 days, and — if you have written to us — the message you sent and our reply.

Write to support@lotse.cloud. You also have the right to complain to a supervisory authority.

Changes

If this policy changes, the date at the top changes with it. Material changes will be noted here rather than made quietly.