ZuckOff for iPhone, Apple Watch and Mac, last updated 29 October 2026
ZuckOff has no account system and no analytics. Nothing the app records is transmitted anywhere on its own. There are two exceptions. A hardware report goes out only when you compose one and tap Send. Reports from people nearby carry your location rounded to about 100 m, and only when you send one or turn their alerts on.
ZuckOff scans for Bluetooth Low Energy advertisements, the broadcasts nearby devices send out on their own. For each device it hears, it stores locally on your iPhone or Mac:
This is the same information any Bluetooth scanner sees. Apple does not give apps the Bluetooth MAC address, so the identifier stored here is one your own device issues. It does not identify anyone else's hardware outside this app.
In the app's own storage on your device, plus an app group container shared with the ZuckOff widget so it can display the current status. Deleting the app deletes all of it, except two small items kept for reports from people nearby and described below: the last push token, in the Keychain, and a device group ID, in your iCloud key-value storage. You can also clear the log at any time from Settings.
Only if you choose to send it. The CSV export in Settings produces a file and hands it to the iOS share sheet, and where it goes from there is entirely your decision. A hardware report reaches the ZuckOff server only when you tap Send. Reports from people nearby are the one feature that uses your location, and they are described below.
ZuckOff can flag glasses it recognises, but new hardware only gets added to that list once someone has captured a real advertisement from a pair. The report sheet lets you send one from inside the app: it shows you the exact payload before anything leaves, and nothing is sent until you tap Send.
A report can include what the device broadcasts: its advertised name, its manufacturer company ID, the full advertisement payload, any service UUIDs and the bytes attached to them, whether it accepts connections, and up to six different payloads it sent with how often each was heard. It can also include a rough figure for how often it advertises, signal strength and transmit power, what the app already thinks the device is and why, and the version of ZuckOff and of its detection list. Two fields you type yourself go with it, a label of up to 80 characters and a note of up to 500, along with how you say you know what the device is. It never includes the identifier iOS issues for the device, your location, an account, an advertising identifier, or a date or time of its own. Timings inside a report count seconds from when the app first heard the device, and the server records when the report arrived. A report cannot be linked to you, and for that reason it cannot be withdrawn once sent.
The report sheet also offers to ask the device about itself, and only if you tap Probe. ZuckOff then connects for a few seconds and reads the public fields any Bluetooth device can publish: its name, its appearance category, its manufacturer, model, firmware and hardware strings, the vendor and product IDs it declares, and the list of services it exposes. Then it disconnects. It never writes anything to the device and never pairs with it, and if the device asks to pair, the probe is cancelled. Serial numbers and any other field that identifies one particular unit rather than a model are never read. What the probe returns is shown to you on the same sheet, and you can drop it before sending.
Reports are stored so they can be reviewed and turned into new detection rules. To limit how many reports one source can send in an hour, the server keeps a salted hash of the network address a report arrives from, shortened to eight bytes. The address itself is never written down. The hash is never joined to the report it came with, and it is deleted once the hour has passed.
The free text a report can carry, meaning your note, the label you typed and the name the device broadcast, is removed 30 days after the report has been dealt with, and in every case 180 days after it arrives. The advertisement bytes are kept, because those are what a detection rule is written from and they identify nobody. Please leave other people's names out of the note.
Tapping Report camera glasses takes one location fix and rounds it to about 100 m. That point goes to the ZuckOff server with the app version and a random install ID the app made up once. If your scanner flagged camera glasses in the last 10 minutes, the report also names what it heard and carries the same 16 digit fingerprint a hardware report would; otherwise it is marked as something you saw. The sheet shows all of it before you tap Send. Phones within 500 m see the report for 30 minutes and can answer I saw them or Not seen, and those answers go to the server the same way. Pro users may choose 250 m or 1 km instead, and Tell people nearby on a detection alert sends the same fields at once, without the sheet. With Pro and background scanning, a phone that hears the same kind of hardware when it arrives near a report answers I saw them on its own, with the same fingerprint.
The server never stores the install ID itself, only a salted hash of it, which it uses to count one answer per phone, to keep a reporter from answering their own report, and to limit how often one phone can post. The server also notes when it first and last heard from each hashed install ID. For an install's first hour, its reports are shown but not pushed to anyone until a phone the server has known for longer answers I saw them, and its answers are not counted. That note is deleted once the install has been silent for 30 days. Reports and their answers are deleted after 30 days. Every hour the server also counts, from the reports it already holds, how often camera glasses were reported in each area of about 150 m over the last 14 days, and by how many people. Those counts hold no install ID or device group. If you turn on alerts from people nearby, the app also sends your push token and your location rounded to about 100 m each time you reach a new area, so the server can tell you about reports around you. Turning the switch off deletes that registration, and one not refreshed for 30 days is deleted anyway. With Always location access, iOS wakes the app when you move a long way, when you walk into a reported area, and, with Warn me in busy areas on, when you walk into a busy area. ZuckOff keeps no record of where you have been, with one exception. While Warn me in busy areas is on, the app remembers on your device the busy areas it warned you about in the last day, so that each one warns you once a day at most, and turning the switch off forgets them.
Two things keep your own devices from alerting you about your own reports. The app keeps the push token it last registered in the Keychain, which survives deleting the app, and sends that old token along the next time it registers, so the server can delete the old registration. And when you are signed in to iCloud, the app makes up a random device group ID once and keeps it in iCloud key-value storage, so your iPhone and Mac share it. It is not derived from your Apple Account, and ZuckOff never learns who you are. Reports, answers and registrations carry it, and the server stores only a salted hash of it. The server uses it to leave every device in the group out when one of them reports, and to refuse an answer from the group to its own report. Each report also carries a random report ID, so a retry after a lost connection is not counted twice.
Looking at reports nearby sends the server only the map squares around you, each about 5 km across, and no install ID. The exception is the 30 minutes after one of your devices tries to send a report: then the install ID and device group go with it, so the app can tell which report is yours. The map of reports is drawn by Apple Maps, so Apple receives the map area you look at, as it does for any app that shows an Apple map. Asking for busy areas, for the warning or for the map, sends the same map squares and nothing else.
Alerts about glasses your own phone heard are local notifications generated on your device, so their content never reaches Apple or anyone else. Alerts from people nearby are different: once you turn them on, the ZuckOff server sends them through Apple's push service. Such a push carries the report's rounded location, whether a scanner heard the glasses and, if one did, the product name, and nothing about you.
The controller of the personal data described in this policy is Paweł Szydłowski, the developer of ZuckOff. For anything about your data, including the requests below, write to: pawels.apps@gmail.com
We do not sell or share personal data. These providers handle it as part of the service, each only for the part named. Cloudflare runs this website and the ZuckOff server and its database, and protects both from abuse. Apple delivers push notifications and draws maps on iPhone and Mac. Google delivers push notifications through Firebase Cloud Messaging and provides location services on Android. OpenFreeMap serves the map tiles on Android. Tally hosts the newsletter form and its list. Some of these providers process data outside the European Economic Area, including in the United States. Where they do, they rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Under the GDPR you can ask for a copy of your personal data, ask for it to be corrected or deleted, ask for its use to be restricted, or ask to receive it in a portable form, and you can object to any use based on our legitimate interest. ZuckOff never asks who you are, so what reaches the server, such as a push token, a rounded location or a hashed install ID, does not name you. It still counts as personal data under the GDPR, and these rights apply to it. We answer within one month. ZuckOff makes no automated decisions about you.
Turning off alerts from people nearby deletes your registration at once. To have the reports and answers your phone sent deleted before the usual 30 days, email us the install ID or report ID shown on the report sheet. Without one of them we cannot tell which records are yours. Sending the install ID also deletes the server's note of when it first and last heard from that install.
You can also complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
zuckoff.app is served by Cloudflare, which processes each visitor's network address and request details to deliver the pages and protect them from abuse, including a script that checks for bots and reports of pages that failed to load. The site has no analytics, no advertising and no cookies of its own. If you dismiss the banner, close the shop popup or choose a language, your browser remembers that in its own storage, and nothing is sent anywhere.
The newsletter form is provided by Tally and loads only when you scroll to it. If you sign up, Tally stores your email address, and it is used only to tell you when a new version ships or the detection list grows. It is kept until you unsubscribe, through the link in every email or by writing to us, and then deleted.
ZuckOff is not directed at children and collects no personal information from anyone, regardless of age.
If this policy changes, the updated version will be posted on this page with a new date.
Questions about privacy or anything else: pawels.apps@gmail.com
ZuckOff is an independent app and is not affiliated with Meta Platforms, Luxottica, Ray-Ban, Oakley or Snap.