Privacy Policy (Datenschutzerklärung)

This Privacy Policy explains how NetzSec (Selda Karakus, Köln, Germany) collects, uses, and protects personal data when you visit our websites, use the dashboard, or purchase ZeroTrace hardware and firmware. ZeroTrace is a NetzSec product line, and this policy applies across NetzSec and its products.

Controller within the meaning of Art. 4 No. 7 GDPR is Selda Karakus, trading as NetzSec, Alte Brühler Straße 127, 50997 Köln, Germany, contact@netzsec.com.

The use of cookies and similar technologies on our website is described separately in our Cookies Policy.

• Visitors browsing netzsec.com, zerotrace.one, or zerotrace.pw subdomains
• Dashboard users with an account on our authenticated services
• Customers purchasing hardware, firmware, or licenses
• App users pairing with and controlling ZeroTrace hardware from the mobile app
• Support contacts communicating with us by email

NetzSec is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us so we can remove it.

Most of what follows is optional. We want to be exact about which is which, because "we collect X" is misleading if X only exists when you switch a feature on.

Required — the minimum for an account to work at all:

• A username and a password hash. That is the entire account record. There is no email address on your account — our user table has no email column.
• A session token while you are signed in, which is deleted when it expires.
• For a purchase: what you bought, its fulfilment status, the destination country, and the payment reference.

Not required — stored only once you choose to use that feature, and empty until then:

• Two-factor authentication, device nicknames, scripts, themes, library items, ratings and comments, forum messages, webhooks, support tickets, certification exams and badges, AirLeak upload tokens, uploaded wardrives, publishing to the community map, and cloud AI providers.

You can buy, activate, and fully use a ZeroTrace device without any of them. Declining an optional feature never degrades the hardware or the software you paid for. Where a feature is optional under this policy, its legal basis is your consent (Art. 6(1)(a)), withdrawable at any time.

A per-table breakdown of every field we hold, marked always or only if used, is published at netzsec.com/security.

• Account data: username, hashed password, session tokens, and — only if you enable it — a two-factor secret. No email address is stored on the account.
• Order data: what was ordered, its fulfilment status, destination country, tracking and invoice references, and a per-attempt shipping audit record. Your name and delivery address are held by Stripe and passed to DHL to produce the label — they are written into our own database only in the exception where a carrier rejects an address and we correct it by hand so the parcel can be re-sent.
• Payment data: processed by Stripe; we only receive a payment confirmation and the Stripe event reference, never card details.
• Device & licensing data: device type and status, license keys, and a hardware fingerprint (HWID) used by our licensed desktop tools (e.g. OSINT, Proxy) to bind a licence to one machine. The HWID is a hash derived from your machine's motherboard, CPU, and disk serial numbers and its machine identifier — only the hash is transmitted; the raw serials never leave your device, and the binding is stored against your licence.
• Ghost-mode orders: an anonymous purchase creates no account and no user record at all. See Section 6.
• Community content (optional): scripts, themes, library items (payloads, presets, and configurations you publish to the shared library), messages, ratings, likes, favourites, comments, and reports you create — stored with the visibility (private, unlisted, or public) you choose, together with the download, vote, and moderation counters that go with a shared item.
• Certification data (optional): your exam questions, answers, score, and pass/fail result, plus exam-integrity events recorded during a proctored attempt (for example switching tabs, leaving fullscreen, opening developer tools, blocked copy/paste, or auto-submission). If you pass, a badge is issued: a public verification ID, the holder name you choose to print on it, and its validity or revocation dates. A badge is public by default so that it can be verified by a third party — you can make it private at any time, which stops the verification link resolving.
• AirLeak wardrive data (only if you upload it): when you upload a wardrive to your account — via the dashboard or the app's optional cloud sync — we store the discovered wireless networks (BSSID/MAC address, network name (SSID), encryption, channel), the GPS coordinates of each network's strongest sighting, your route track, the country/region, and the phone make and model. These are identifiers of nearby third-party wireless devices; see the AirLeak section below. Capturing a drive and keeping it on your phone creates none of this.
• Upload tokens (optional): if you generate an AirLeak API token we store only a hash of it plus a short prefix and the time it was last used — never the token itself.
• Returns and refunds: if you exercise your right of withdrawal or cancel an order, we store the reference number, your email address (so we can reply), the payment reference, your withdrawal declaration and any reason you give, the language you filed in, the refund amount and currency, the returned items and their condition, and our internal processing notes. This is the only place we store an email address.
• Redeem codes: codes issued to resellers or as vouchers carry no personal data until redemption; when you redeem one, your account ID and the redemption time are recorded against it.
• Moderation data: infractions, warnings, and cooldowns applied to your account for abuse prevention.
• Support data: messages, attachments, and logs you choose to share
• Technical data: IP address, user agent, timestamps, abuse-detection signals, rate-limit logs

Ghost mode is a checkout option on supported products that lets you buy without an account.

What we store is a single row in one table. If you check out in ghost mode we create no user record and no session record — nothing that identifies you as a person, and nothing that can be linked back to you by us. The only thing written to our database is one entry in the devices table containing:

• the product you bought and its fulfilment status,
• the destination country (needed for shipping and customs),
• the Stripe checkout reference,
• the ghost licence you were handed at checkout, and
• for digital or subscription items, the licence expiry.

What we do not store: your name, your street address, and any link between the order and an identity. As with every order, the delivery address stays at Stripe and is passed to DHL to print the label; it enters our database only in the exception described in Section 5, where a carrier rejects an address and we correct it manually so the parcel can be re-sent.

The ghost licence is the only thing tying you to the device. It is handed over once via a short-lived, single-use token that expires and is not linked to any account. Keep the licence and you keep your ability to prove ownership; lose it and we have no way to identify you as the buyer — that is the intended trade-off.

Claiming is optional. You may later attach a ghost order to an account to get the dashboard, warranty history, and account-based support. Doing so records the claim time and moves the devices onto your account. Nothing about the product requires this, and if you never claim, the single devices row remains the entirety of what exists.

Note that ghost mode makes your order anonymous to us. Your payment is still processed by Stripe and your parcel is still carried by DHL, both of which necessarily see the details their own service requires.

• Art. 6(1)(b), performance of a contract (orders, accounts, licensing)
• Art. 6(1)(c), legal obligations (tax law, packaging law, etc.)
• Art. 6(1)(f), legitimate interests (security, fraud prevention, abuse detection)
• Art. 6(1)(a), consent (cookies and similar, where required)

• Operate the dashboard, licensing, and delivery functionality
• Process orders, issue invoices, and prevent fraud
• Handle customer support and warranty claims
• Secure the Service (logging, rate-limiting, abuse monitoring)
• Comply with German tax, commercial, and packaging-law obligations

We use the following processors under Art. 28 GDPR contracts:

• Stripe Payments Europe Ltd (Dublin, Ireland; further sub-processing by Stripe, Inc. in the United States), payment processing. Transfer to the US is covered by the EU-US Data Privacy Framework certification and Stripe's Standard Contractual Clauses.
• DHL Paket GmbH (Bonn, Germany), physical shipment. The recipient name, shipping address, email, and phone number, plus the customs description and value, are shared so the parcel can be delivered and cleared.
• Discord (Discord Netherlands B.V., with onward processing by Discord Inc., USA), internal operational and support notifications. New-order details (including customer email, order ID, and cart contents), support-ticket messages, device-activation events, withdrawal notices, and error reports are sent to a private staff channel via webhook so we can fulfil orders and provide support. This is not a public channel and is used only for running the business (Art. 6(1)(b) and (f) GDPR).
• Hosting / infrastructure providers (located primarily within the EU/EEA), operation of the dashboard, backend, and licence services.
• Vercel Inc. (San Francisco, USA), content delivery and hosting of the website and, only if you opt in via the cookie banner, privacy-friendly product analytics (Vercel Web Analytics). Vercel Web Analytics is cookieless, measures aggregate page views, and does not build cross-site profiles or sell data. Vercel is certified under the EU-US Data Privacy Framework and we additionally rely on Standard Contractual Clauses (Art. 46 GDPR). If you decline analytics, no analytics script is loaded at all.

We do not sell personal data and do not transfer data to third parties for advertising.

Where data is processed outside the EU/EEA — primarily by Stripe for card-payment processing, Vercel for content delivery and optional analytics, and Discord for internal notifications — we rely on a combination of: (i) the EU-US Data Privacy Framework adequacy decision where applicable, (ii) Standard Contractual Clauses under Art. 46(2)(c) GDPR, and (iii) additional safeguards as required by case law (Schrems II). Copies of the SCCs may be requested at contact@netzsec.com.

• Encryption in transit (TLS) on all endpoints
• Password hashing using modern algorithms (e.g., argon2 / bcrypt)
• Least-privilege access and security monitoring
• Automated retention and cleanup (see Section 12)

We retain data only as long as needed for the purpose collected:

• Server / access logs (IP, user agent, timestamps): up to 14 days for security and abuse-prevention purposes (Art. 6(1)(f) GDPR), then anonymised or deleted
• Sessions & auth tokens: deleted at expiry
• Desktop tool licenses: 7 days from issue, then cleaned up
• Ghost handover tokens: single-use and short-lived; dead once used or expired
• Cooldowns: 14 days
• Webhook content: 30 days
• Notifications: deleted once read, and in any case after 60 days
• Messages & reactions: 90 days
• Scripts, themes, and library items: retained until you delete them
• AirLeak upload tokens: retained until you regenerate or remove the token
• AirLeak wardrive data (networks, discoveries, tracks, and run records you uploaded): retained until you delete or unpublish it; we do not auto-expire it. The raw uploaded file is deleted immediately after it is processed.
• Exam attempts and integrity events: retained while the associated certification or badge is valid, so a credential can be substantiated if challenged
• Certification badges: retained while valid; revocation records are kept so a withdrawn credential cannot be presented as current
• Returns and withdrawal requests: retained as accounting records for 10 years (§147 AO), since they evidence a refund
• Shipping audit records: 12 months, for delivery disputes and carrier claims
• Invoices, contracts, and tax-relevant records: 10 years (§147 AO)
• Account data (including the HWID bound to a licence): retained while the account or licence exists; deleted on request subject to legal hold
• Ghost-mode device records: kept for warranty and support purposes; they contain no personal data to erase, and there is no account to delete

Backups are infrequent and used only during maintenance, deleted records are not recoverable.

The ZeroTrace mobile app (iOS/Android) is the companion app for pairing with and controlling ZeroTrace hardware. It has no login account and no analytics or telemetry, and it keeps your captured data on your phone by default. We do not receive your location, photos, or device logs, and nothing leaves the phone unless you choose to upload it. The app can optionally sync a finished wardrive to your ZeroTrace cloud account or to third-party platforms, using a token you add yourself; this is described under "Optional uploads" below and is off until you set it up.

Permissions the app requests, and why

• Bluetooth (BLE): to discover, pair with, and control your ZeroTrace devices and to receive the wireless observations they capture. Bluetooth communication happens directly between your phone and your device.
• Location (including in the background): during a war-drive ("Drive"), to stamp each captured device with the position where it was heard strongest and to draw your route on the map. On Android, location access is also a system prerequisite for Bluetooth scanning. By default location is recorded only while the app is open; if you grant "Allow all the time" and enable background recording, a drive keeps logging with the screen off, using a foreground service with a persistent notification. Location is only ever used to record an active drive.
• Camera: only to scan a license-key QR code when activating a device. The frame is processed on-device to read the key; no images are captured, stored, or transmitted.
• Photos / media library: the app writes to your gallery only when you tap "save" to export a route card, drive image, or GIF, and reads a single image you pick if you set a custom theme background. It does not scan, index, or upload your existing library and does not read photo location metadata.

Data stored on your device

• App settings, paired devices, saved scripts, and theme/unit preferences.
• War-drive sessions — the captured observations (a device's Bluetooth address, advertised name, signal strength, vendor, and the GPS coordinates and time of its strongest sighting) and your route track — saved as files in the app's private storage.
• Any WiGLE or WDGoWars API tokens you choose to add (see below).

All of this stays on the device. You can delete drive sessions, remove tokens, and clear the in-app diagnostic log at any time; uninstalling the app removes it. None of it is synced to ZeroTrace.

Optional uploads (your ZeroTrace cloud and/or third-party accounts)

The app can publish a finished drive to your ZeroTrace cloud account and to the third-party wardriving platforms WiGLE (wigle.net) and WDGoWars (wdgwars.pl). This is strictly opt-in and never happens unless you act:

• You paste a token for each destination you want to use. Tokens are stored encrypted on your device only (in the OS keychain/keystore), are never embedded in the app, and are only ever sent to the destination they belong to as an authentication header.
• Only when you tap Upload — or enable auto-upload for finished drives — does the app send that session's observations as a standard WiGLE-format CSV (device address, name, time, signal strength, latitude/longitude, accuracy) directly from your phone to the chosen destination's API. The app may also read back your own account statistics from each destination using the same token.
• Uploads to your ZeroTrace cloud (secure.zerotrace.pw) are received and stored by us; how we handle that server-side data, and the optional community map and leaderboard, are described in the AirLeak section below.
• Uploads to WiGLE or WDGoWars go to your own account on that third-party service; NetzSec is not a party to those transfers and does not receive or process that data, and the service's own privacy policy and terms govern it.

Map tiles

The drive map loads background tiles from a third-party map CDN (CARTO basemaps, rendered from OpenStreetMap data, no account or API key). As with any online map, this discloses the map area you are viewing and your device's IP address to the tile provider. No ZeroTrace identifier is attached.

Diagnostics

For troubleshooting, the app keeps a small, fixed-size diagnostic log on the device (shown in the in-app Logs screen). It is capped, overwrites the oldest entries first, and is never transmitted off the device — consistent with our no-logs principle.

Lawful use

War-driving records wireless identifiers broadcast by nearby devices, which can constitute personal data under the GDPR. You are responsible for using the app — and any uploads you make — in line with the law applicable to you. The app is built to minimise: it runs on-device, flags randomised (private) Bluetooth addresses, bounds how much it retains, and uploads nothing without your action.

Legal bases (Art. 6 GDPR): providing the app's core functionality rests on Art. 6(1)(b) (performance of the contract); access to Bluetooth, location, camera, and photos is enabled by the device permissions you grant at the operating-system level; optional uploads to your ZeroTrace cloud and to WiGLE/WDGoWars rest on your consent (Art. 6(1)(a)), which you can withdraw at any time by removing the token or disabling auto-upload.

A note on Android permissions: some permissions appear in the Android manifest because they are pulled in by the libraries the app uses (for example a microphone permission comes bundled with the camera module) even though the app does not use them. The app requests a permission at runtime only for the features described above.

None of this is required. AirLeak hardware and the mobile app work completely without an upload — you can capture drives, map them, and export them with no ZeroTrace account at all. What follows applies only if you separately choose to upload, and then again only if you separately choose to publish. There are two distinct opt-ins here and neither is on by default.

If you upload a wardrive to your ZeroTrace cloud account (from the dashboard or the mobile app), the observations are ingested and stored on our backend: for each discovered network we keep its BSSID/MAC address, name (SSID), encryption, channel, the GPS coordinates and time of its strongest sighting, the country and region, and the route track of the drive, together with your username and the phone make and model. We also record the run itself — its start and finish, row counts, and a hash and byte size of the uploaded file so we can detect duplicates and verify integrity. A wardrive records identifiers that nearby wireless devices broadcast, which can constitute personal data about their owners; you are responsible for uploading only data you are permitted to collect and share.

Private by default. An uploaded drive is visible only to you unless you turn on publishing. Your own view shows the full BSSID, SSID, and exact coordinates.

If you publish, your discovered networks join the community map and you appear on the leaderboard, the recent-activity feed, and shared tracks. To protect the people whose devices were observed, the community view is de-identified: BSSID/MAC addresses are hashed, coordinates are coarsened to roughly 110 metres, and SSIDs are omitted. The leaderboard shows your username and your count of unique networks; a shared track shows your username, device model, and time. You can unpublish or delete your data at any time.

Uploaded runs are also screened for fabricated data (impossible movement, colliding or future timestamps, oversized files); a flagged run may be held for review and excluded from the community map and leaderboard.

Legal basis: upload and publishing rest on your consent (Art. 6(1)(a)); screening and de-identification rest on our legitimate interest (Art. 6(1)(f)) in a trustworthy community dataset and in protecting observed third parties.

Some of our desktop tools (for example OSINT, Proxy, and the desktop app) include an optional AI assistant. By default it runs a local model on your own machine (e.g. Ollama) and sends nothing to us or to any third party.

If you choose a cloud AI provider — such as Anthropic, OpenAI, Google, Mistral, or another supported provider — and supply your own API key, then the content you send to the assistant (your prompts and any tool output you include, which may contain data you are working on) is transmitted to that provider and handled under that provider's own terms and privacy policy. NetzSec does not receive that content. A small amount of AI-usage information (model, token counts, cost, and a short prompt snippet) is kept locally on your device for your own reference and is not transmitted to us.

NetzSec does not carry out automated individual decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

Our systems use automated rules for fraud and abuse prevention (e.g., rate limiting, anomaly detection, payment-risk signals supplied by Stripe). These rules may flag a session or order for human review but do not, by themselves, deny goods or services without a manual review step.

• Access, request a copy of your data (Art. 15)
• Rectification, correct inaccurate data (Art. 16)
• Erasure, request deletion (Art. 17), subject to legal retention
• Restriction, limit processing (Art. 18)
• Portability, receive your data in a portable format (Art. 20)
• Objection, to processing based on legitimate interests (Art. 21)
• Withdraw consent, at any time, with effect for the future (Art. 7(3))
• Right to lodge a complaint with a supervisory authority, competent for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Düsseldorf

To exercise rights, contact contact@netzsec.com.

Privacy questions and requests can be sent to contact@netzsec.com.

NetzSec is currently a sole proprietorship without employees regularly engaged in large-scale processing and is not required to appoint a Data Protection Officer (Art. 37 GDPR / §38 BDSG). The owner, Selda Karakus, handles privacy enquiries directly.