Privacy - Mobile DevTools

Mobile DevTools (“the app”) is a developer tool for inspecting network traffic on your own Android device. Your privacy is fundamental to how it is built.

To do its job, the app processes network traffic and related information — including the list of installed apps and on-device identifiers — locally on your device. Everything the app captures stays on your device.

What the app processes, and where

To function, the app runs a local VPN (Android’s VpnService) on your device to capture network traffic from installed apps. The captured data — hosts, request and response metadata, headers, and (when applicable) bodies — is:

• Processed entirely on-device. Nothing is sent to the developer or any third party.
• Stored only in the app’s private local storage (an on-device database).
• Under your control. You choose how many requests are retained and can clear all captured history at any time from Settings.

The VPN is used solely to capture traffic locally for inspection. It is not a proxy or anonymizer; it does not route your traffic through any external server.

Data types accessed (Google Play Data safety)

To label network activity with the app that produced it, Mobile DevTools accesses two data types that Google Play’s Data safety section classifies as below. Both are used only on your device, for app functionality (per-app attribution), and are never shared, sold, or transmitted to the developer:

• Installed apps — the app reads which applications are installed so it can show each captured request under the correct app name and icon.
• Device or other IDs — the app does not read hardware or advertising identifiers such as Android ID, Advertising ID, IMEI, or MAC address. Attributing traffic uses per-connection/app identifiers (for example, the Android UID that owns a connection), and captured traffic may itself contain identifiers; Google Play’s taxonomy classifies this on-device handling under “Device or other IDs”.

Because Google Play defines these as “collected” data types even when handled only on-device, they are declared in the app’s Data safety form as collected for app functionality and not shared. In practice this data never leaves your device.

HTTPS decryption

The app can optionally generate a local certificate authority (CA) so you can decrypt HTTPS traffic for inspection. The CA private key is generated on your device and never leaves it. This feature is off by default and only affects traffic on your own device.

Permissions

• VPN (BIND_VPN_SERVICE) — to capture traffic locally for inspection.
• Foreground service — to keep capture running with a persistent notification.
• Query installed apps (QUERY_ALL_PACKAGES) — to label each captured request with the name and icon of the app that made it. App package information is used only for on-device display and is never transmitted.
• Post notifications — to show the ongoing capture status.

Data sharing and sale

The app does not share or sell any data with anyone, and never transmits your data to the developer. All processing happens on your device.

How to delete your data

All captured data is stored only on your device. To delete it: Open Mobile DevTools → Settings → Clear capture history (deletes all captured traffic data immediately), or Uninstall the app (removes all app data, per Android's standard behavior). No data is retained anywhere else - the app has no servers or accounts.

Children

The app is a technical tool not directed at children.

Changes

If this policy changes, the updated version will be published at the same location with a new “last updated” date.

Contact

Questions about this policy: nijat.contact@gmail.com