Your data stays yours.

The short version

• The DroidStar DMR app doesn't collect, store or send your data to us. There is no DroidStar DMR server, database or cloud. Your logs, settings, favourite Talk Groups, net reminders, recordings and transcripts are stored only on your device.
• When you use the app, it connects directly to the amateur radio networks you choose, such as BrandMeister. Those networks need your callsign and DMR ID to work. Like all amateur radio, what you say on air is public by law.
• This website uses no cookies or ad trackers, only cookieless, aggregate visit statistics (see below). The only personal information we ever receive is what you choose to send through the TestFlight form or by email.
• We use that information only to send your TestFlight invite and reply to you. Ask and we'll delete it.

Who we are

“We”, “us” and “our” refer to Rohith Namboothiri (callsign VU3LVO), an individual amateur radio operator based in Bengaluru, India. He develops DroidStar DMR for iOS (“the app”) and runs vu3lvo.com (“the website”). DroidStar DMR is a free, open-source project. It isn't a company, and it has no investors, advertisers or data partners.

About the name. “DroidStar DMR” (also written “DroidStar DMR for iOS” or “Droidstar DMR by VU3LVO”) is a separate app. It is developed independently from DroidStar by Doug McLain and isn't affiliated with it, apart from being built on its open-source code under the GPL-3.0. This policy applies only to DroidStar DMR and vu3lvo.com, not to the original DroidStar or any other app with a similar name.

For any personal information you send us, Rohith is the data controller (in India, the “data fiduciary”). You can reach him at hi@vu3lvo.com.

The DroidStar DMR app

What stays on your device

The following is created and stored only in the app's local storage on your iPhone or iPad. We never receive any of it:

• Your settings, such as your callsign, DMR ID, chosen hosts, Talk Groups, audio preferences and any hotspot or AllStar passwords you enter
• Your QSO log (Last Heard) and favourite Talk Groups
• Net reminders. These are scheduled as local notifications by iOS on your device; no push server is involved.
• Live transcription text and any transcription models you download
• Live Activities (Dynamic Island and Lock Screen), which are updated locally by the app

Deleting the app removes this data. If you turn on iCloud or device backups, Apple may include the app's data in your own backup, under your Apple account and Apple's privacy policy. We never have access to it.

Microphone

The app asks for microphone access so you can transmit. Audio is recorded only while you hold PTT and is encoded on your device. It is sent only to the radio network you're connected to, just as a radio would send it. We never record, store or receive your audio.

Live transcription (Beta)

You choose the engine:

• The four downloadable models run entirely on your device. Incoming audio and the resulting text never leave your iPhone or iPad. The model files themselves are downloaded once from a public host when you choose to install them.
• Apple's built-in speech recognition is provided by iOS. Depending on your device, language and settings, Apple may process speech on the device or on Apple's servers, under Apple's Privacy Policy. We never receive any of it. If you want everything to stay on your device, choose one of the downloadable models.

Bluetooth and accessories

Bluetooth and wired accessories are used only to route audio and PTT on your device. No accessory data is sent to us.

Exports and sharing

When you export your log (ADIF or CSV) or tap a QRZ, BrandMeister or APRS link, you choose where it goes, through the iOS share sheet or your browser. Whatever you share is handled by the app or website you send it to.

No tracking, no ads

The app contains no advertising, no analytics SDKs, no tracking and no third-party data collection. It doesn't use Apple's advertising identifier.

Radio networks & third parties

DroidStar DMR is a client for independent amateur radio networks. When you connect, the app talks directly to the servers you choose. These include BrandMeister (DMR, including ODTP), YSF, M17, P25, NXDN and D-STAR reflectors, and AllStar/IAX nodes. These networks are run by third parties, not by us. To work, they receive what every radio and hotspot sends:

• Your callsign, DMR ID and any credentials you entered for that network (for example a BrandMeister hotspot password)
• Your IP address, as with any internet connection
• Your transmissions (voice and metadata such as Talk Group and time)

Amateur radio is public by design. Encryption isn't allowed, and networks commonly publish “last heard” lists and live dashboards showing who transmitted, when and on which Talk Group. Anyone may listen. Please don't say anything on air that you wouldn't want to be public. Each network has its own policies, so check them, for example BrandMeister.

To show operator names and countries, the app may download publicly available amateur radio directories, such as DMR ID lists, and host lists. These downloads only bring public data to your device. Nothing about you is sent with them beyond a normal internet request.

Apple TestFlight

DroidStar DMR is distributed through Apple's TestFlight. To invite you, we enter the email address you give us into Apple's App Store Connect. Apple then sends the invite and manages installation.

As a beta tester, Apple shares some information with developers. This includes your email address and name (if provided), the build you installed, install and session counts, and crash reports or feedback you choose to send through TestFlight, along with device model and iOS version. We use it only to fix bugs and improve DroidStar DMR. Apple handles this under the Apple Privacy Policy and the TestFlight terms. You can stop testing at any time in the TestFlight app, and you can ask us to remove you as a tester.

This website

• No cookies, no advertising or social media pixels, no session recording and no fingerprinting.
• No third-party content is loaded on normal page views. Fonts, images and scripts are served from vu3lvo.com itself. The one exception is Cloudflare Turnstile on the request form (see below).
• No backend, no database. vu3lvo.com is a static website. There are no user accounts, no database and no server that stores anything about visitors. The only code that runs on a server is a small, stateless function that relays the TestFlight request form (see below). It keeps nothing.
• Hosting by Vercel. The site is hosted and delivered by Vercel Inc. Like every web host, Vercel briefly processes technical request data, such as your IP address, browser user agent, the page requested and the time, so that it can deliver pages and protect against abuse. We don't use this data to identify or profile visitors,
• Anonymous visit statistics. We use Vercel Web Analytics to count page views, referrers, country, device type, and a few interactions (such as clicking the TestFlight button, scroll depth and time on page). It sets no cookies, stores nothing on your device, and does not track you across sites or build a profile of you. Visitors are told apart only by a short-lived, irreversible hash. Form contents, callsigns and email addresses are never included.
• The Parrot (TG 9990) demo on the home page records your voice only in your browser, plays it back once and discards it. It is never uploaded. Your browser asks for microphone permission first, and you can refuse.
• Links to other sites, such as GitHub, WhatsApp, Buy Me a Coffee, PayPal and QRZ, take you to services with their own privacy policies.

TestFlight request form

If you request an invite, you give us your name, callsign, Apple ID email and country, the device you'll use, and optionally your DMR ID, how you heard about DroidStar DMR and a message. You also confirm that you hold an amateur radio licence.

• Why: to check that the request comes from a licensed amateur, send your TestFlight invite and reply to you. We also look up your callsign in public amateur radio directories such as QRZ to confirm your licence.
• How it travels: your request goes over HTTPS to a stateless Vercel Function. It checks the human verification and forwards your request as an email through Resend (our email delivery provider) to our Proton Mail inbox. Nothing is saved on the way: there's no database, and the function doesn't log your details.
• Bot protection: the form uses Cloudflare Turnstile, which processes technical signals from your browser and your IP address to tell people from bots. According to Cloudflare, Turnstile doesn't use this information for advertising. See Cloudflare's Privacy Policy. To limit abuse, the function also keeps your IP address in temporary memory for up to 10 minutes. It is never written to storage.
• How long: we keep your request while you're a tester and for up to 12 months afterwards, so we can handle support. After that we delete it. You can ask us to delete it sooner at any time.
• Legal basis: your request. Processing is needed to do what you asked (GDPR Art. 6(1)(b)), and you give consent by submitting the form (consent under India's DPDP Act, 2023).

We never add you to a mailing list or send marketing email, and we never share your details with anyone other than the providers named here. If you email us directly, we use your message only to reply.

Donations

Donations are made on Buy Me a Coffee or PayPal, never on this website. We don't see or store card or bank details. Those services tell us what they normally show a recipient, such as your name or display name, email address, amount and any message you add. We use this only to thank you. We thank contributors on the contributors wall by callsign or first name only (with a last initial where needed). The callsign is taken from your name, email address or note. We never publish email addresses, full names or amounts. If you'd rather not be listed, say so in your note or email us and we'll remove you.

Data at a glance

We don't use any data for automated decisions or profiling.

Your rights

Wherever you live, you can ask us to:

• access the personal information we hold about you, and get a copy
• correct it if it's wrong
• delete it, including removing you as a TestFlight tester or from the contributors wall
• withdraw consent or object to processing at any time
• nominate someone to exercise these rights for you (India's DPDP Act)

Email hi@vu3lvo.com from the address you used. We'll reply within 30 days, usually much sooner. There is no charge. Data held only on your own device is already fully under your control, because we never receive it. If you're unhappy with our response, you may complain to your local data protection authority, such as the Data Protection Board of India or a supervisory authority in the EU or UK.

California and other US states: we don't sell or “share” personal information as those laws define it, and we don't use it for targeted advertising.

Security

The website is served only over HTTPS with modern security headers. There is no backend or database to breach. The one form function is protected by Turnstile, rate limiting and strict input validation, and it stores nothing. The app is open source under the GPL-3.0 licence, so anyone can check what it does at github.com/rohithzmoi/Droidstar-DMR. No system is perfectly secure, but having almost no data to begin with is the strongest protection there is. You can report a security issue to hi@vu3lvo.com. See security.txt.

International transfers

We're based in India, and the providers named above may process data in other countries. Vercel and Resend operate mainly in the United States, Cloudflare operates globally, Proton is based in Switzerland, and Apple operates worldwide. Each provider applies safeguards required by applicable law, such as standard contractual clauses. By using the form, you understand your request will be handled in these places.

Children

Young people can and do earn amateur radio licences, which is wonderful. The website and app don't knowingly collect personal information from children. If you're under 18 (or the age of digital consent where you live), please ask a parent or guardian before submitting the form. If a parent believes their child sent us information, email us and we'll delete it.

Changes & contact

If our practices change, we'll update this page and its date. If a change matters, such as a new kind of data being collected, we'll say so clearly on this site before it takes effect. Our core promise won't change: DroidStar DMR keeps your data on your device.

Rohith Namboothiri, VU3LVO · Bengaluru, India · hi@vu3lvo.com