Privacy Policy

BLESmith (Android package com.bleworkbench, “the app”, “we”) is a developer tool, built and operated by Rapid Circuitry, for inspecting and driving Bluetooth Low Energy (BLE) devices. This policy explains exactly what the app collects, what stays on your device, and how to delete your account — and it covers this website too, which is static, sets no cookies, and runs no analytics of its own.

The short version: BLESmith requires an account, so your email address, a password, and an optional display name reach our authentication server. Everything else — every BLE scan, connection, capture, codec, and export — stays on your device and is never uploaded.

The table below is the complete list — every field the app touches, and exactly where it goes.

Everything marked ON-DEVICE is processed entirely on your phone and never transmitted to us. The only destination any data reaches is our own server at workbench.rapidcircuitry.com, and only for account sign-up, sign-in, and deletion.

One caution worth stating plainly: BLE scan results can contain identifiers belonging to nearby devices you do not own. Treat any capture you export or share as potentially sensitive.

• Nearby devices (BLUETOOTH_SCAN, BLUETOOTH_CONNECT, BLUETOOTH_ADVERTISE) — to scan for, connect to, and, in Peripheral mode, advertise as a BLE device. BLUETOOTH_SCAN is declared with neverForLocation.
• Legacy Bluetooth & location (BLUETOOTH, BLUETOOTH_ADMIN, ACCESS_FINE_LOCATION, all capped at maxSdkVersion="30") — on Android 11 and earlier the operating system will not return any BLE scan result without these. The app does not derive, use, store, or transmit your physical location, and on Android 12 and later these are not requested at all.
• Foreground service (FOREGROUND_SERVICE, FOREGROUND_SERVICE_CONNECTED_DEVICE) — keeps a firmware-update (DFU) transfer alive while it runs.
• Internet (INTERNET) — used only to reach our authentication server for sign-up, sign-in, and account deletion. It is used for nothing else.

An account (email + password, and an optional display name) is required to use the app. All traffic between BLESmith and our authentication server runs over HTTPS (TLS), and the app sends account credentials to no other host. Passwords are hashed with Argon2id before they ever touch storage — we cannot read or recover your password, only reset it.

Signing in issues a session token (JWT) valid for 30 days. The app stores it in Android’s EncryptedSharedPreferences, backed by the Android Keystore, and sends it with account requests to prove who you are. Signing out erases it from the device.

You can delete your account and everything we hold for it at any time:

• In the app — open the ⋮ menu → Account → Delete my account, then confirm. Deletion is immediate and permanent.
• On the web, without installing the app — see Account & data deletion.

Deleting the account removes your email address, display name, password hash, account ID and creation date from our database, and signs you out on the device. It does not remove the BLE work saved on your phone, because that was never part of your account — uninstall the app or clear its storage to remove that.

One honest technical detail: session tokens are self-contained, so a token issued before deletion stays cryptographically valid until it expires. It can no longer reach any account, because every authenticated request checks that the account still exists and is refused when it does not.

Account data is retained for as long as your account exists, and is deleted when you delete the account — see Account & data deletion.

Server request logs, which may contain an IP address and timestamp, are retained briefly for security and debugging, then discarded.

BLE scan data, session logs, and preferenceslive only on your device. Clearing the app’s storage or uninstalling it removes them completely, because we never had a copy.

We do not sell your data, and we do not share it with advertisers, data brokers, or analytics platforms — we don’t use any. The only recipient of your account data is our own authentication server, which we operate. We do not use any third-party identity or analytics provider for authentication.

• Every BLE reading, log, and codec definition stays under your control on-device — export or delete it whenever you like.
• You can delete your account, or request a copy of the data held for it, at any time — see Account & data deletion.
• You can revoke Bluetooth permissions from Android Settings at any time; the app will ask again only when you use a feature that needs them.

If we change what the app collects or how it’s used, we’ll update this page and the “effective” date at the top. Material changes will also be noted in the app’s release notes.

Questions about this policy, or about your data: contacts@rapidcircuitry.com

Rapid Circuitry