Privacy policy
Effective 23 September 2026.
Summary
NetWrench does not collect personal data, does not transmit data to the developer or to third parties, and requires no account. The application contains no analytics, no crash reporting and no advertising libraries. Everything it measures stays on the device.
Data processed on the device
The application works with technical information about the network the phone is attached to. It is processed locally and does not leave the device unless the user exports a report:
- connection parameters: IP address, netmask, gateway, DNS servers, connection type;
- wireless networks in range: network name, BSSID, channel, signal level, security mode;
- devices found on the local network during a user-initiated scan: address, MAC address, hostname, vendor by OUI, state of individual ports;
- data obtained from the router over its management protocol: model, firmware version, interface list, MAC and IP addresses, WAN and Wi-Fi settings;
- mobile network information, while the Cellular tab is open: operator, MCC and MNC, network type, cell and area identifiers, signal level;
- measurement results: latency, loss, throughput, traceroute and diagnostic output.
This information may be included in a diagnostic report. Reports are produced locally and are shared only when the user explicitly chooses to share one.
Router credentials
Router usernames and passwords are entered by the user. They are stored on the device in the Android Keystore and are used only to reach that router over the local network. They are never sent to the developer and are never written to application logs or diagnostic reports.
Permissions and why they are needed
| Permission | Purpose |
|---|---|
| ACCESS_FINE_LOCATION ACCESS_COARSE_LOCATION | Required by Android itself before it will return Wi-Fi scan results. The location is not used by the application, not stored and not transmitted. |
| NEARBY_WIFI_DEVICES | The same purpose on Android 13 and newer, where Wi-Fi scanning is decoupled from location. |
| ACCESS_WIFI_STATE CHANGE_WIFI_STATE | Reading Wi-Fi state and initiating scans of the air. |
| CHANGE_WIFI_MULTICAST_STATE | Receiving multicast traffic to discover devices and services on the local network (mDNS). |
| ACCESS_NETWORK_STATE | Determining the transport, gateway and network parameters. |
| CHANGE_NETWORK_STATE | Holding the phone on a router's Wi-Fi that has no Internet yet, while that router is being configured. |
| INTERNET | Reaching the router and the throughput-test server, and checking Internet availability. |
| FOREGROUND_SERVICE FOREGROUND_SERVICE_DATA_SYNC | Running the throughput-test server and long measurements while the app is not in the foreground. A persistent notification is shown throughout. |
| FOREGROUND_SERVICE_SPECIAL_USE | The network speed indicator in the status bar, when the user has enabled it. A persistent notification is shown throughout. |
| POST_NOTIFICATIONS | Notifying about a running measurement and its completion. |
| READ_PHONE_STATE | Listing the active SIMs, so that the Cellular tab can show more than the primary one. Device identifiers — IMEI, serial number — are never requested. The permission is optional: without it the tab reads the SIM assigned to data. |
| WRITE_EXTERNAL_STORAGE | Saving a file offered by a page on the Web tab into the shared Downloads folder. Requested on Android 9 and older only; newer versions write without it. |
Network connections
The application connects only to hosts determined by what the user is doing:
- the router and local network devices, during discovery, configuration reads and scanning;
- the throughput-test server the user selected or entered;
- public hosts used to check Internet reachability and measure latency;
- the ipwho.is service, to identify the Internet provider behind the connection’s public IP address. Such a request necessarily discloses that public IP address to the service, as any Internet request does; no device identifier and no application data are sent, and the response is not retained beyond the current session;
- raw.githubusercontent.com, for the router factory-login data (the zortald/netwrench-data repository). The file is fetched only when the user presses “Check” in Settings; the request discloses the public IP address to GitHub, as any Internet request does, and carries no device identifier and nothing about the network the phone is on;
- raw.githubusercontent.com, for the user-script catalogue (the same zortald/netwrench-data repository, file userscripts.json). It is fetched only when the user opens the catalogue in Settings; the file lists addresses and contains no code itself;
- the address a user-installed script is published at, when it is installed and when it is later checked for an update. The request goes to the host the script's author named, over https only;
- netwrench.app, for the release notes the application reads when Google Play reports an update as available;
- the address a page opened in the Web tab asked for — only when the user has separately enabled this for that one saved address. Enabled, it lets the page ask the application to reach the address it names using the phone's own network stack, and returns the response, reusing the built-in browser's shared cookie storage; this is how, for example, a site that blocks requests from server addresses is still reached. The exchange runs directly between the phone and the address the page named — the application does not store this data and does not send it to the developer.
There are no developer-operated servers receiving telemetry.
User scripts
On the Web tab a user script can be installed — a small JavaScript program that runs inside an open page, the way an extension does in a desktop browser. The user installs it: by address, by pasting its text, or by choosing it from the published catalogue. Nothing installs itself, and nothing is installed by default.
A script runs only on the addresses listed in its own header, and inside such a page it sees that page's content and cookies — exactly as much as the page's own code does. Neither the text of a script nor the addresses it ran on is sent anywhere. Downloading a script and checking it for updates happen over https only.
A script is somebody else's code, and whoever wrote it is responsible for it. Every installed script is listed in Settings, where it can be opened and read, disabled or removed.
Children's data
The application is intended for professional use and collects no personal data, including data of children under 13.
Sharing with third parties
Data is not shared with third parties, not sold and not used for advertising. The developer operates no servers that receive anything from the application.
Data deletion
The application creates no account, so there is nothing held on the developer's side to delete. Everything it stores — settings, report history, and router credentials in the Android Keystore — is kept on the device only, and is removed entirely when the application is uninstalled or its data is cleared in Android settings.
Who is responsible for the application
NetWrench is developed by an independent developer. Enquiries about data handling go to the address below.
Changes
Revised versions are published on this page with their effective date. Material changes will be noted in the application's store listing when it is updated.
Contact
Questions about how the application handles data: onufriev.serg@gmail.com