Privacy Policy
Last updated: September 2026
This Privacy Policy describes how NanoBeacon LIVE! (“the App”), developed by InPlay Inc. (“InPlay”, “we”), handles information. It applies to version 2.0 and later, in which the App is the mobile client of the NanoBeaconNetwork cloud service and of the Live IoT Passport network.
The App Store version 1.x is a different, local BLE companion app. Its privacy policy for version 1.x continues to describe that version until a user installs 2.0. The App Store's privacy label should describe the version currently available for download.
1. Your account
To use the App you sign in with a NanoBeaconNetwork account.
- What we receive: the App uses an email address for account registration and password sign-in; it does not ask for a phone number. We receive your email address and password when you register, sign in, or change the password. Passwords are sent over an encrypted connection and are not stored by the App.
- Google sign-in: this option is unavailable in version 2.0. If offered in a future version, choosing “Continue with Google” would let Google share your account email address and a signed identity token with us. Google's sign-in SDK may process additional information under Google's own privacy policy when that option is used.
- On this device: the App keeps your session tokens in the iOS Keychain (not synced to iCloud) and three display preferences in local app storage. Signing out removes the session from the device. While an account deletion request is waiting for the service's answer, the App also keeps a random request reference in the Keychain; it contains no personal data and is removed once the answer is known.
2. Your devices and their data
Devices you bind to your account (by their serial number), their names, the reports they send (location, temperature, battery voltage, signal strength, time), their alerts, destinations and sharing settings are stored by the NanoBeaconNetwork service and shown to you in the App. People you share a device with can see that device’s data read-only until you revoke access or they leave.
The App shows this data; it does not create it. Device reports reach the service from the network of gateways and phones that hear the devices.
3. Live IoT Passport scan contribution
The App can contribute Bluetooth observations to Live IoT Passport, which is how bound devices are located when their owners are not nearby. The switch is Me → Live IoT Passport → Contribute scan data. It starts on; turning it on again shows the disclosure below first, and it only runs while the required permissions are granted.
When enabled, NanoBeacon LIVE! sends nearby Live IoT Passport beacon service data, signal strength, observation time, and your precise location to Live IoT Passport, including while background scanning is active. The SDK creates an anonymous installation credential using a public key, derived key ID, and signatures; it does not use your signed-in account. You can turn contribution off in the App at any time, and it is not affected by signing out.
- Only broadcasts from Live IoT Passport beacons (service UUID
0xFC32) are collected. The beacon payload is encrypted; the App cannot read it and forwards it unchanged. - No advertising identifier, device name, contacts or other personal data is attached to observations.
- Observations waiting to be sent are kept briefly in encrypted storage on the device and deleted once delivered or after a short retention period.
4. Permissions
| Permission | Why |
|---|---|
| Bluetooth | To hear Live IoT Passport beacons for scan contribution. The App never pairs or connects. |
| Location (While Using / Always) | Your location is attached to the beacon observations you contribute. “Always” lets contribution continue in the background. |
| Camera | Only to scan the serial-number QR code on a device label. Images are not stored or transmitted. |
Denying Bluetooth or location turns scan contribution off; everything else in the App keeps working.
5. Third-party services
- Maps: map tiles come from OpenFreeMap (map data © OpenMapTiles, © OpenStreetMap contributors). Loading tiles reveals the area you are viewing and your IP address to the tile server.
- Place search: when you search for a destination address, the text you typed is sent to the OpenStreetMap Nominatim service.
- Google Sign-In: unavailable in version 2.0; see section 1 for a possible future option.
The App has no separate advertising or product-analytics SDK. The bundled Google sign-in SDK has its own privacy declarations, including some analytics purposes, but the sign-in option is disabled in version 2.0. The App does not track you across apps or websites for advertising.
6. Retention and deletion
Account and device data are kept by the NanoBeaconNetwork service while your account exists. Removing a device from your account stops its data being shown to you; reports already stored are kept with the device.
You can delete your account in the App at Me → Delete account. The App asks for your password (or, where offered, Google verification) and one more confirmation. Once the service accepts the request:
- You are signed out right away on every device, and the account can no longer be used.
- Your devices are released and every device share you sent or accepted ends. Someone who adds a released device later only sees its data from that point on.
- Your account details (email address, password, linked Google identity, settings, notifications, sessions and API keys) are deleted. Device reports stay with their devices, with your account and the phone location you contributed while signed in removed. Hourly summaries of past readings stay with the device and cannot be separated by account.
- This online cleanup is designed to finish within 7 days, and we email you when it is done.
- Backups, server logs and copies held by our email provider are kept until they expire on their own schedules; if a backup is ever restored, your deletion is applied again so the account does not return. Location data already delivered to partner services before the deletion cannot be recalled from them.
- You can register again with the same email address later. The new account starts empty.
Live IoT Passport contribution uses an anonymous installation credential and is not part of your account, so deleting the account does not change it; turn it off in Me → Live IoT Passport. If you cannot use the App, contact us at the address below.
7. Children
The App is not directed to children under 13 and we do not knowingly collect their personal data.
8. Security
Connections to our services are encrypted (HTTPS). Security issues can be reported as described in SECURITY.md.
9. Changes
We may update this policy. Changes are published on this page with a new “Last updated” date.
10. Contact
InPlay Inc. — support@inplay-tech.com