Privacy Policy: HTTPGlass for Android

HTTPGlass is made by Nutiverse. This page covers the HTTPGlass app for Android. For the Mac app and this website, see themain privacy policy.

The short version. HTTPGlass shows you the network traffic of your own phone. Everything it captures stays on your phone. We do not receive it, store it, sell it or share it. The only things the app can send are anonymous crash reports and anonymous usage events, and only if you choose to allow them.

What the app does with your traffic

While capture is on, HTTPGlass uses Android's VPN service to route your phone's traffic through a proxy that runs on the phone itself. It can read the addresses (URLs), headers and, for HTTPS that you choose to decrypt, the contents of requests and responses, and the name of the app that sent them.

This is stored in a database on your phone so you can look at it. It is never uploaded. You can delete it at any time from the traffic list, and capture stops when you turn it off. HTTPGlass is not a VPN to a remote server and does not hide your location.

Information we receive

The app asks once, on first launch, whether you want to share anonymous diagnostics. It isoff until you say yes, and you can change your answer at any time in Privacy. If you say no, nothing below is sent.

• Crash reports, only if you agree. An error report (the error, the phone model and the Android version) is sent to our error-reporting provider, Sentry. It never contains anything you captured (no addresses, headers, bodies or app names) and carries no account or device identifier.
• Anonymous usage events, only if you agree. The app sends events such as "capture started", "paywall viewed" or "rule created" to Google Firebase Analytics, so we can see which features get used and where people get stuck setting the app up. Each event carries only a fixed label (for example the kind of rule, or whether a response was a success or an error) and counts as ranges, never exact numbers. Nothing derived from your traffic is ever included: no hostnames, URLs, paths, headers, bodies, app names or certificates. Firebase also keeps a random app-instance identifier to tell installs apart; it is not linked to you or your Google account, we never receive your advertising ID, and ad personalisation is switched off. Turning the setting off stops collection and resets that identifier. Google processes this data on our behalf; see Google's privacy policy.
• Purchases. Subscriptions are handled by Google Play. We receive only whether your account has an active subscription. We do not see your payment details.
• Nothing else. There is no account, no advertising and no tracking.

Permissions

• VPN: to capture traffic, as described above. You approve it in Android's system dialog.
• Notifications: to show that capture is running and to tell you when a breakpoint is waiting.
• Package visibility: to show the name and icon of the app behind each request and to let you pick which apps to capture. For this the app reads the list of apps installed on your phone. Our own code uses that list on the phone only and never uploads it. Because the app reads this list and also contains the diagnostics libraries described above, we declare "Installed apps" in the Data safety section of our Google Play listing.

Certificates

To read HTTPS that you choose to decrypt, HTTPGlass creates a certificate on your phone that you install in Android's settings. Its private key never leaves the phone. Remove the certificate in Android's settings to stop trusting it.

Children's privacy

HTTPGlass is a developer tool and isn't directed at children.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page.

Contact

Questions about this policy or your data: support@httpglass.com.