Sprint Booster Controller App

Sprint Booster Controller Mobile Application

1. Introduction

This Privacy Policy describes how Panagopoulos & CO OE (“Company,” “we,” “us,” or “our”) collects, uses, stores, and protects your information when you use the Sprint Booster Controller mobile application (“App”).

We are committed to protecting your privacy and handling your data transparently. We collect only the minimum data necessary to provide the App’s functionality and do not engage in advertising, behavioral tracking, or sale of personal data.

Data Controller: Panagopoulos & CO OE El. Venizelou 13 & Lysarridi, 57400, Sindos, Greece Email: info@aditech.gr

We have not appointed a Data Protection Officer (DPO) as this is not required for our organization under GDPR Article 37. For all privacy-related inquiries, please contact us at info@aditech.gr.

2. Information We Collect

2.1 Information You Provide

Data Type	When Collected	Required?
Email address	When you create an email account	Yes, for account creation
Account password	When you create an email account	Only for email accounts
Device name	When you name a saved Sprint Booster device	Yes, for device management
Device password	When you first connect to a Sprint Booster device	Yes, for device authentication
Guest PIN	When you configure guest access on a device	No (optional feature)
Device image	When you upload a photo for a device	No (optional feature)

2.2 Information Collected Automatically

Data Type	Purpose	Stored Where
Firebase Authentication UID	Unique account identifier	Firebase Auth (Google Cloud)
BLE MAC address	Identify and reconnect to Sprint Booster devices	Firebase Firestore (Google Cloud)
Device firmware version	Device identification	Firebase Firestore (Google Cloud)
Booster state	Current throttle mode and level settings	Firebase Firestore (Google Cloud)
Transmission type	Manual or automatic setting	Firebase Firestore (Google Cloud)
App settings	Auto-connect, view mode, biometric, auto-unlock preferences	Firebase Firestore (Google Cloud)
Crash and error reports	App stability and bug fixing	Firebase Crashlytics (Google Cloud)
Analytics events	Understanding usage patterns (e.g., connection results, setting changes, onboarding completion, screen views)	Firebase Analytics (Google Cloud)
Performance traces	Measuring connection timing and command latency	Firebase Performance (Google Cloud)

2.3 Information Used Locally Only (Not Stored or Transmitted)

Data Type	Purpose
Biometric data	Face ID, Touch ID, or fingerprint authentication is processed entirely by your device’s operating system. We never receive, access, or store your biometric data.

2.4 Location Permission and Vehicle Speed

The App asks for location permission (“while using the app” only) for two reasons:

Vehicle speed for the lock safety check. When “Require stillness to lock” is on (the default), the App will not lock your Sprint Booster while the vehicle is moving. To tell whether it is moving, it reads the speed that your phone’s location services (GPS) report. It does this whenever the device control screen, or the App’s CarPlay or Android Auto screen, is open, whether or not the setting is on. The App asks for precise location because speed comes from GPS; with approximate location the phone may not report a speed, and the App cannot then detect motion.
Bluetooth scanning on Android 11 and below. On these Android versions the operating system requires location permission before an app can scan for Bluetooth devices.

What the App does and does not do with location:

It never records, stores, or transmits your position (latitude and longitude) and does not track your route or where you park. Your position is not sent to us, to Firebase, or to anyone else.
It does not ask for background (“Always”) location permission and is not designed to read location in the background. It stops reading speed when you leave the control screen and no car screen is open; while the App is in the background the operating system normally stops it (on Android 8 and 9 it can continue while the App is running).
Speed readings stay on your phone. The App writes vehicle speed and GPS signal-quality figures (for example “54 km/h, accuracy 5 m”) to its on-device diagnostic log, so that a report of the lock check misbehaving can be investigated. The log holds about 512 KB on your phone and older lines are overwritten by newer ones; it is removed when you uninstall the App or clear its data. The log leaves your phone only if you choose to send a problem report (Settings > Report a problem). A sent report is kept for 90 days and deleted earlier if you delete your account.
Speed is not sent to Firebase Analytics, Crashlytics, or Performance Monitoring. Analytics records only that a lock was refused because the vehicle was moving (no speed, no position).
Location permission is optional. If you deny it, the App works normally, but the lock safety check cannot detect motion (and, on Android 11 and below, the App cannot scan for new devices).

You can withdraw location permission at any time in your phone’s settings.

2.5 Information We Do NOT Collect

Your location. See “Location Permission and Vehicle Speed” above: the App reads vehicle speed on your phone but never collects your position.
Behavioral profiling. We collect specific functional analytics events (such as connection results and setting changes) and screen views: the name of each App screen you open (for example “/settings”) and of a few dialogs (for example the delete-account confirmation), sent to Firebase Analytics. Screen views carry no position, speed, device names, or other content you enter. Firebase Analytics also automatically records app sessions and how long the App is in use (engagement time). Turning off “Share Usage Data” (Section 5a) stops all of this. We do not build behavioral profiles.
Advertising identifiers.
Contacts, call logs, SMS, or any data unrelated to Sprint Booster device management.

2.6 Problem Reports (User-Initiated)

If you experience an issue, you can send us a problem report from Settings > Report a problem. This feature is entirely user-initiated: nothing is collected or uploaded unless you write a description and tap Send. When you submit a report, we collect:

Data Type	Detail
Report description	The free-text description you write. It may contain any information you choose to include.
Diagnostic app logs	Recent in-app debug logs that help us reproduce the issue. These may include Bluetooth device identifiers (device addresses), device names, connection and timing events, error messages, vehicle-speed readings (never your position), and BLE command/response data (credential exchanges are encrypted). They are not designed to, and do not, include your device passwords, guest PINs, encryption keys, or account password.
Firebase Authentication UID	Associates the report with your account for follow-up and deletion.
App version, build number, device model, operating system	Reproducing the issue on the correct platform and version.

Problem reports are uploaded to Google Firebase (Cloud Firestore and Firebase Storage) and encrypted in transit. They are independent of the “Share Usage Data” setting (Section 5a): turning that setting off does not disable problem reports, and turning it on never causes a report to be sent; a report is uploaded only when you tap Send. Reports are retained for 90 days and then automatically deleted, and are deleted immediately if you delete your account (Section 6).

3. How We Use Your Information

We use your information solely for the following purposes:

Purpose	Legal Basis (GDPR)
Authenticate your identity and maintain your account	Performance of contract; Legitimate interest
Store and synchronize your Sprint Booster device configurations across devices	Performance of contract
Enable BLE connection to your Sprint Booster devices using stored MAC addresses and encrypted passwords	Performance of contract
Display device images you have uploaded	Performance of contract
Diagnose crashes and errors to improve App stability	Legitimate interest
Understand usage patterns through analytics events (e.g., connection results, setting changes) to improve the App	Legitimate interest
Monitor performance by measuring connection timing and command latency to optimize the App	Legitimate interest
Protect against unauthorized device access through encrypted passwords, PINs, and optional biometric authentication	Legitimate interest; Performance of contract
Diagnose and resolve issues you report via the in-app “Report a problem” feature	Consent

Where we rely on legitimate interest as the legal basis (analytics, crash reporting, performance monitoring), you have the right to object. You can exercise this right at any time via the opt-out toggle described in Section 5a below.

We do not use your information for marketing, profiling, automated decision-making, or any purpose not listed above.

4. Data Storage and Security

4.1 Cloud Storage

Your data is stored using Google Firebase services. Firebase infrastructure is operated by Google LLC and data may be stored and processed in the United States or other countries where Google maintains facilities. For details on Google’s security practices, see https://firebase.google.com/support/privacy.

4.2 Encryption

Device passwords and guest PINs are encrypted using AES-256-CBC encryption before storage. The encryption key is derived from your unique account identifier combined with an application secret using SHA-256 hashing. Even in the unlikely event of unauthorized database access, your device passwords and PINs cannot be read without the corresponding encryption key.
Data in transit between the App and Firebase is protected by HTTPS/TLS encryption.
BLE communication between the App and Sprint Booster hardware occurs locally and is not transmitted over the internet.

4.3 Data Separation

Each user’s data is stored in an isolated database path and is accessible only through authenticated requests matching that user’s credentials. Security rules enforce this isolation at the database level.

4.4 Data on Your Device

The App has no database of its own; your account and device data is stored in Firebase cloud services. While you are signed in, the App keeps some of it on your phone: an offline copy of your settings and saved devices (names, Bluetooth addresses, device passwords in encrypted form, and links to device photos) so the App also works without a connection, the device details it needs for background auto-unlock, and photos of your devices that it has displayed.

When you sign out, when the App signs you out because your account is no longer valid (for example, it was deleted on another phone), and when you delete your account, the App deletes these from the phone and tells a paired watch to delete its copy of your devices (the watch does so when it next receives the update from your phone). Changes you made while offline that have not reached our servers yet are discarded too. If one of these deletions fails, for example because the phone’s storage is busy, the App still signs you out and the leftover data stays on the phone until you sign out again, uninstall the App, or clear its data.

Only the diagnostic log stays after sign-out: an on-device log of app events, Bluetooth device identifiers, and vehicle speed readings, never your position (see “Location Permission and Vehicle Speed”). Older lines are overwritten by newer ones. It is removed when you uninstall the App or clear its data.

5. Third-Party Services

The App uses the following third-party services:

Service	Provider	Purpose	Data Shared
Firebase Authentication	Google LLC	Account creation and sign-in	Email (if provided), UID
Cloud Firestore	Google LLC	Device configuration storage	Device settings, encrypted passwords, app preferences, problem report metadata
Firebase Storage	Google LLC	Device image storage	Uploaded device images, problem report logs
Firebase Crashlytics	Google LLC	Crash reporting and diagnostics	Crash stack traces, device model, OS version, UID, connection state metadata
Firebase Analytics	Google LLC	Usage analytics	Analytics events (connection results, setting changes, onboarding completion, screen views), app version, device model
Firebase Performance	Google LLC	Performance monitoring	Performance trace data, connection timing metrics, command latency

Crashlytics data detail: When a crash or error occurs, Crashlytics receives your Firebase UID, device model and OS version, crash stack trace, and contextual metadata including the current connection phase, boost mode, boost level, transmission type, and whether a guest session was active. BLE message logs (command direction and content) may also be included in crash reports to aid debugging. Crashlytics does not receive your email address, device passwords, guest PINs, or Bluetooth MAC addresses.

We do not use advertising networks or any other tracking services beyond the Firebase services listed above.

For Google’s privacy practices, see: https://policies.google.com/privacy

You can disable analytics, crash reporting, and performance monitoring at any time by navigating to Settings > Privacy and turning off the “Share Usage Data” toggle.

When this toggle is disabled:

No analytics events are sent to Firebase Analytics
No crash reports are sent to Firebase Crashlytics
No performance traces are sent to Firebase Performance Monitoring
No usage data of any kind is shared automatically with Google or any third party

When this toggle is enabled (the default):

The App collects the analytics, crash, and performance data described in Sections 2.2 and 5 above

Data sharing is on by default for new accounts, and you can turn it off at any time with the toggle described above. Disabling data sharing stops all future data collection but does not delete analytics, crash, or performance data that was previously collected. Previously collected data is subject to the retention periods described in Section 6.

This setting is stored in your account and applies across all devices where you are signed in. Disabling data sharing does not affect the core functionality of the App; you can still connect to and configure your Sprint Booster devices normally.

Problem reports are separate from this setting. The in-app “Report a problem” feature (Section 2.6) is user-initiated support: it uploads your description and diagnostic logs only when you tap Send, regardless of whether “Share Usage Data” is on or off. Disabling “Share Usage Data” stops automatic analytics, crash, and performance collection, but does not disable a problem report you send yourself.

6. Data Retention

Data Type	Retention Period
Account and device data	Retained until you delete your account or remove individual devices
Device images	Retained until you remove the image or delete the device/account
Crash reports	Retained by Firebase Crashlytics for 90 days (Google’s default retention), after which crash reports including associated UIDs are permanently deleted by Google
Analytics data	Retained by Firebase Analytics for 14 months (Google’s default retention)
Performance data	Retained by Firebase Performance for 90 days (Google’s default retention)
Problem reports (description, diagnostic logs, metadata)	Retained for 90 days, then automatically deleted. Deleted immediately upon account deletion.

When you delete your account through the App, we permanently delete:

All device documents and configurations
All uploaded images
Your user settings
All problem reports you submitted, including their diagnostic logs
Your authentication account

This deletion is immediate and irreversible. Some data may persist in Google’s backup systems for a limited time in accordance with Google’s data retention practices, after which it is permanently deleted.

7. Your Rights

If you reside in the EEA, UK, or Switzerland, you have the following rights:

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate personal data. You can directly edit your device names and settings within the App.
Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data. You can exercise this right directly via the “Delete Account” feature in the App’s Profile screen.
Right to Data Portability: Request your data in a structured, commonly used, machine-readable format.
Right to Restrict Processing: Request that we limit how we process your data.
Right to Object: Object to processing based on legitimate interests.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to Lodge a Complaint: You have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr or with the supervisory authority in your country of residence.

To exercise any of these rights, contact us at info@aditech.gr. We will respond within 30 days.

7.2 Rights Under CCPA (California, United States)

If you are a California resident:

Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected.
Right to Delete: Request deletion of your personal information. You can exercise this directly through the “Delete Account” feature.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
Right to Opt Out of Sale: We do not sell your personal information to third parties. No opt-out is necessary.

To submit a verifiable consumer request, contact us at info@aditech.gr.

7.3 Rights for All Users

Regardless of your location, you may:

Delete your account and all associated data at any time through the App (Profile > Delete Account)
Delete individual devices and their data through the App
Contact us with any privacy questions or requests

8. Children’s Privacy

The App is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. The App controls vehicle throttle response and is intended exclusively for adults who are legally permitted to operate motor vehicles.

If we learn that we have collected personal information from a child under 18, we will promptly delete that information. If you believe a child has provided us with personal data, please contact us at info@aditech.gr.

9. International Data Transfers

Your data is processed and stored using Google Firebase infrastructure, which may be located in the United States or other countries outside your country of residence. If you are located in the European Economic Area, the United Kingdom, or Switzerland, your data may be transferred to the United States.

These transfers are governed by Google’s data processing terms, which include Standard Contractual Clauses approved by the European Commission to provide adequate safeguards for international data transfers.

For transfers to the United States, Google also participates in the EU-U.S. Data Privacy Framework, providing an additional adequacy mechanism for transatlantic data transfers.

10. Permissions Explained

Permission	Platform	Why It Is Needed
Bluetooth	iOS & Android	Required to scan for, connect to, and communicate with Sprint Booster devices via BLE
Location (“while using the app”)	iOS & Android (optional)	Reads vehicle speed so the App can refuse to lock the Sprint Booster while the vehicle is moving; on Android 11 and below, also required by the OS for Bluetooth scanning. Precise location is requested because speed comes from GPS. No background (“Always”) location is requested. Your position is never recorded, stored, or transmitted (see “Location Permission and Vehicle Speed”).
Biometric	iOS & Android (optional)	Protects lock/unlock operations if enabled in Settings. Biometric data is processed entirely by your device’s OS and is never accessed or stored by the App.
Internet	iOS & Android	Required for Firebase authentication, data synchronization, image storage, and crash reporting
Camera / Photo Library	iOS & Android (optional)	Accessed only when you choose to upload a device image. No images are captured without your explicit action.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the App or, for email account holders, via email.

The “Last Updated” date at the top of this document indicates when the most recent changes were made. Your continued use of the App after any changes constitutes acceptance of the updated Privacy Policy.

12. Data Breach Notification

In the event of a data breach that affects your personal data, we will:

Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by applicable law
Notify affected users without undue delay if the breach is likely to result in a high risk to your rights and freedoms
Describe the nature of the breach, the likely consequences, and the measures taken to address it

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Panagopoulos & CO OE El. Venizelou 13 & Lysarridi, 57400, Sindos, Greece

Email: info@aditech.gr Website: www.sprintbooster.com

For privacy-specific inquiries, please include “Privacy” in your email subject line.