MEDJED

Privacy & Data Access

What data each part of Medjed touches, which permissions it asks for, where the data is stored and for how long: it's all on this page.

Last updated: 2026-10-13 ・ What changed on Oct 11 ・ Change log

In short

We don't collect your location.The locations you type, save, simulate or send never reach our server. The server doesn't even have an interface that accepts user locations, so we can't get your coordinates and can't see where you've been.
We see your IP address, but we don't store it.When our server receives a request it sees your IP address, which roughly shows your region, but we don't store it. For our host's access logs, see section 4.
The server only keeps the account data needed for licensing.For example your email, license hash, device info and trial records. Details in sections 3 and 4.
Map services see the map area you're looking at.Maps and place names come from public OpenStreetMap-family services. They see the map area you're viewing and your IP address, like with any map app. Details in section 7.
No ads, and no tracking, analytics or crash-reporting SDKs. We don't sell data.Only the providers listed in section 8 receive what they need to provide their service.
The phone apps don't ask for your contacts, photos, camera or microphone, and don't read your advertising ID.Whether each permission shows a prompt, and which permissions we don't ask for, are in sections 10 and 11. What personal data the server does and doesn't store is summarized in section 2. The desktop app's Photos feature reads photos from your iPhone over USB or through the local iOS service; they're processed only on your PC and never uploaded, see section 9.

1Why we wrote this

Medjed isn't listed on any app store, so there's no store review checking it for you. That's why we've written down, in one place, what data each part of Medjed touches, which permissions it asks for, where the data is stored and for how long.

Medjed is made by an individual developer in Taiwan. This page was written by checking each item against the code as of 2026-10-13. It isn't marketing copy: where something can't be done or hasn't been fixed yet, we say so plainly.

2What we don't do

We don't upload your location. The coordinates you type, save, simulate or send, your routes, the map area you browse and your phone's real GPS location never reach our server. None of the server's APIs has a field for user coordinates.
- The only coordinates on the server are of two kinds, both provided by us to you: the places in the "Mushroom warehouse", and the "Recommended special places" list. These only go from the server down to you.
We don't read data from games or other apps. Only the three things below involve other apps, and all of them are handled only on your device and never uploaded:
- The desktop app's iOS Setup Wizard reads the list of apps installed on your iPhone, only to check whether SideStore, LocalDevVPN and Medjed are installed.
- Once you grant access, the Android "Steps" (步數) feature reads today's total step count from Health Connect.
- The one-click mock location setup ("Set up") in the desktop app's Android setup steps sets Medjed as the mock location app and turns off the mock location permission for the other apps on the phone. This is the same as choosing Medjed yourself in Developer options (only one mock location app can be selected there at a time). It only lists the apps that have this permission so it can turn them off; it doesn't read those apps' data.
No ads, and no tracking, analytics or crash-reporting SDKs. Many free apps build in components like these to make money or collect usage data; the dependency lists of Medjed's desktop, Android and iPhone apps contain none of them.
We don't sell data, and we don't share it with advertisers or other users. Only the providers listed in section 8 receive what they need to provide their service. Please send your PC machine ID and license key to an admin only in a private message, and don't post them in public channels.
We can't access your Apple ID password. Your Apple ID is only entered in SideStore on your own phone and in iloader on your PC. Medjed's apps can't access it, and it never passes through our server. iloader and SideStore are third-party tools; for how they handle sign-in, refer to their own documentation.
We don't handle your credit card. All payments are completed on Polar, and we never see your card number.

Personal data at a glance: what the server stores and what it doesn't

What the server stores is only for licensing. This table lists what relates to you personally, split into the desktop app and the phone apps; the full list is in sections 3 and 4.

Category	Stored on the server: desktop app	Stored on the server: phone apps	Not stored on the server
Contact details	Email: only if you subscribe or sign in with email (the same on the desktop app and phones). If you only request a verification code, it's deleted within 1 hour.		Name, phone number, address, date of birth, biometric data (if Polar provides your name, it's only used to greet you in the license email).
License and subscription	License keys are stored only as hashes (only the desktop app takes a license key); if you subscribe, also Polar's subscription ID and customer ID.		The license key itself, your card number (payment is completed at Polar).
Device	Machine ID: an 8-character hash computed from "PC name + Windows user name". Hardware ID: a hash of Windows' MachineGuid, computed on your PC before it's sent. App version.	A random device ID generated by the app and the device public key; the phone's name, model, OS version and app version. On Android the name is "brand + model"; on iPhone it's the generic name "iPhone" plus the model identifier (for example iPhone14,2). If you start a trial on the phone itself, also a hash of the system ID / trial identifier.	Your PC name, your Windows user name and the MachineGuid itself (the desktop app only sends hashes); the name you gave your phone; your advertising ID.
Usage records	Trial start time and the last time you opened the app. After you activate a license key or sign in with email, also the activation / unbinding / connection log (connections at most once every 6 hours; only the latest 200 entries).	Date added and last online time.	Per-person feature-usage analytics (who tapped what, how long they used it; the warehouse only keeps daily totals, see section 4) and cross-app tracking data.
Network	Hashes of your IP address and of the network you connect from, computed with a server secret key (for rate limiting and preventing repeated trials; for how long they're kept, see section 4).		Your IP address itself (for the host's access logs, see section 4).
Location	—		Your location, favorites, routes and movement history (for what map services see, see section 7).
Other	—		Contacts, photos, other apps' data.

3What the server stores

The server is an API on Vercel plus an Upstash database. The data in the database that relates to you falls into the categories below. For a summary of how long each is kept, see section 4.

Desktop app (everyone)

Data	What it is	Kept for
PC machine ID	An 8-character hash computed from "PC name + Windows user name". The server receives the hash, not the names themselves.	In trial records: 400 days after last use. In license bindings and logs: until you ask us to delete it. When the PC pushes a trial to a phone, that phone's device record also uses the machine ID as its key: kept until that phone signs out or you ask us to delete it.
Hardware ID	Windows' MachineGuid, hashed on your PC before it's sent. It stops people from renaming their PC to get another trial.	400 days after last use
Trial record	Trial start time, the last time you opened the app, app version.	400 days after last use

Subscription / license

Data	What it is	Kept for
License key	Only a hash is stored, never the key itself.	Until you ask us to delete it
Binding status	Which PC it's bound to (machine ID), expiry date, last connection time, number of PC switches.	Until you ask us to delete it
Activation / unbinding / connection log	Each entry has a time, the machine ID and a short note (for example the app version). For a license issued automatically by a subscription, the first entry includes the Polar subscription ID and email. Connections are logged at most once every 6 hours.	Only the latest 200 entries; kept until you ask us to delete it
Licenses used on each PC	Records, by machine ID, the hashes of the licenses used on that PC, so we can look them up if you forget your license key.	Up to 50 entries; kept until you ask us to delete it
Subscription data (from Polar notifications)	Email, Polar subscription ID and customer ID, subscription status (active / paused / ended), next renewal date, and whether it has been canceled. If Polar provides your name, it's only used to greet you in the license email and isn't stored separately.	Until you ask us to delete it
Refund record	When Polar notifies us of a refund, the time is recorded on the license, and the log contains the Polar order ID and amount.	Until you ask us to delete it
Support record	When an admin disables a license by hand, the reason, a short note and the time are recorded.	Until you ask us to delete it
Pending subscription status	If Polar's pause or end notification arrives before the license exists, that status is held temporarily under the subscription ID.	30 days

Phones (email sign-in or trial)

Data	What it is	Kept for
Device data	A random device ID generated by the app, the device public key (the private key stays on the phone), device name, model, OS version, app version, date added and last online time. On Android the device name is "brand + model"; on iPhone it's the generic name "iPhone" that the system gives the app, plus the model identifier, not the name you gave your phone (from iOS 16 on, the system doesn't give apps that name).	Until you ask us to delete it (trial phones too)
Trial started on the phone	Android sends the system ID (`ANDROID_ID`); iPhone sends a trial identifier generated by the app and stored in the Keychain. The server only stores their hashes, to make sure each phone can use the trial only once.	Trial record: 400 days after last use. The trial phone's device record also uses this hash as its key, and is kept until this phone signs out or you ask us to delete it
Records for the phone-switch limit	For each platform, the time of the last device switch, plus the previous device's ID and key fingerprint. The "one switch every 7 days" rule relies on these.	Until you ask us to delete it

4Verification codes, IP addresses, warehouse records and how long we keep them

Verification codes

Only a hash of the code and the number of wrong attempts are stored. The record is named after your email and is deleted automatically after 10 minutes.
When you request a code, the server counts code requests for that email (whether or not the email has a subscription). This count is deleted automatically within 1 hour.

IP addresses

Since this update, the database no longer stores raw IP addresses (for records left from before the update, see "Old-format records" below). An IP address roughly reveals the region you're really in, so we don't store it.
Hashes for rate limiting: To block code guessing and mass trial sign-ups, we only use a hash of your IP address computed with a server secret key. The key is kept separately from the database, so even if the database contents leaked, the IP address couldn't be worked back out. These records are deleted automatically within 10 minutes to 2 days.
Network hashes to prevent repeated trials: We record a keyed hash of the network you connect from (IPv4 /24, IPv6 /64).
- PC trials: kept with the trial record, up to 5 entries, for at most 400 days after last use.
- Trials pushed from the PC to a phone: kept until 1 day after the trial ends.
Old-format records: Records left from before the Oct 11 update (rate-limit records whose names contain a raw IP address, and network hashes computed the old way) are no longer created. They stop being used as soon as this update goes live, and all of them are deleted immediately afterwards.
Host access logs: Our server host, Vercel, may briefly keep access logs (including IP addresses and URL paths) under its own policy.

Mushroom warehouse

When you claim one, we record "which account claimed which mushroom". The account is an email, a license hash or a trial ID; for PC trials it's the machine ID.
For trials, which ones were claimed that day is also recorded under a keyed IP hash.
These are deleted automatically within about 2 days.
Daily usage totals (from Oct 13): we keep only totals per day: how many times the list was fetched, roughly how many different people viewed it or claimed something, how many mushrooms were claimed, how many claims were refused (full, daily limit used up, etc.), and how many new mushrooms our scanner added. We don't record who: the "roughly how many people" figure comes from hashing each account with a random salt generated for that day and feeding the result into a statistical counter (HyperLogLog). The salt is deleted one hour after the day ends; after that, these daily counts can no longer be matched to any account (the claim records above are deleted separately within about 2 days), and because every day has a different salt, people can't be matched across days either. The totals are kept for 90 days.

How long we keep it (summary)

Data	Kept for
License, email, phone device records (including trial phones), refund and support records, licenses used on each PC	Not deleted automatically for now; kept until you ask us to delete it.
Trial records (machine ID, trial start time, hashes of the hardware ID / phone identifiers, network hashes)	Kept for 400 days after last use. If you ask us to delete your data, this part stays until that period ends, to prevent repeated trials. Exception: a trial phone's device record also uses the hash of the phone identifier (or the machine ID, for trials pushed from the PC to a phone) as its key; that record is kept until the phone signs out or you ask us to delete it.
Verification codes	10 minutes
Verification code request count	1 hour
IP hashes (for rate limiting)	10 minutes to 2 days
Network hashes	PC trials: with the trial record, at most 400 days after last use. Trials pushed from the PC to a phone: 1 day after the trial ends.
Warehouse claims	About 2 days
Warehouse daily usage totals (no individual accounts)	90 days
Pending subscription status	30 days
Old-format records from before the Oct 11 update	No longer used from the moment this update goes live, and all of them are deleted immediately afterwards (see Old-format records above).

5How data flows: install, update, sign-in

Install and update

Item	How it flows
Desktop installer	The download button on the website redirects to the official release on GitHub.
Desktop updates	When the app starts and every 6 hours after that, it reads a version file from GitHub to compare. If there's a new version it only lets you know; it downloads only when you click.
Android app	Usually installed for you by the desktop app. After that, the app reads companion.json from the website at most once every 6 hours. When there's a new version, it downloads it from GitHub only after you confirm, then hands it to the system to install.
iPhone app	The IPA is hosted on the website and installed with SideStore (the desktop wizard can put it on your phone for you). The app reads sidestore.json from the website at most once every 6 hours to check for a new version.

These version checks only download files and don't send any of your data, but whoever serves the download sees your IP address.

When the apps contact our server, and what they send

When	What's sent
Trial start (desktop app)	Every time the app opens, it sends "machine ID, app version, hardware ID hash", and the server replies with the date your trial started.
Email sign-in: sending your email	Your email. The server only sends a verification code if that email has an active subscription; the response is the same whether or not a code was sent.
Email sign-in: entering the code	The desktop app also sends the machine ID and app version; phones send the device data and device public key listed in section 3.
License activation	License key, machine ID, app version. The server only stores a hash of the license key.
Periodic license check (desktop app)	When the app opens, every 6 hours, and also when you switch back to its window (at most once every 10 minutes). It contains only the machine ID and a sign-in credential (token).
Periodic license check (phones)	About every 10 minutes while the app is open or simulating. It contains only the token, a timestamp, a device signature and the app version.

The periodic license check (heartbeat) doesn't include your locationWhat the desktop app and the phones send doesn't include your location.

6How data flows: sending locations, favorites, warehouse

Sending locations (the core feature)

How you use it	How it flows
PC → Android	Sent with adb over USB to Medjed on the phone. Wi-Fi adb you've set up yourself, or an emulator on your PC, goes the same way.
PC → iPhone	Handed to the "iOS service" on your PC (it only accepts commands locally, on 127.0.0.1), then sent to your own iPhone over USB or your home network.
Android phone on its own	The mock location is set inside the phone.
iPhone on its own	Medjed connects through LocalDevVPN to the phone's own developer services (10.7.0.1).

None of this goes over the internet or through our server.Once a mock location is set, other apps on the phone that have location permission will read it. That is simply what location simulation does.

Favorites sync / pushing to the phone

The PC and the phone relay through adb. The small servers on both the phone and the PC only accept connections from the same device, and require authentication.

Mushroom warehouse

Viewing the list: only your sign-in credential (token) is sent, not your location.
Claiming or releasing one: only that mushroom's ID is sent.
Coordinates only go from the server down, and only to the person who claimed them.
Where the places come from: every place in the warehouse is collected and uploaded by us, and writing to it requires a server-side secret key. No user's location ever goes into the warehouse.
IDs: the IDs on the list are now computed with a server secret key. Someone who hasn't claimed a place can't work out where it is from its ID.

Recommended special places

A fixed list written into the server code; the app just downloads it (the full list is for subscribers). Again, only the token is sent.

7Maps and place names

Maps and place names come from third-party map services. Your PC or phone connects to these services directly; the requests don't go through our server.

Which services are used

Purpose	Desktop app	Phone apps (Android, iPhone)
Map tiles	tile.openstreetmap.org or OpenFreeMap (depending on the map style you choose)	OpenFreeMap
Place search	Nominatim, falling back to Photon if that fails	Nominatim
Place name lookup (reverse geocoding)	Not used	When the map stops moving, asks Nominatim for the place name at the map center

What the search box sends

Desktop app: sends the full text in the "Search for a place" box, so if you type coordinates into that box, those coordinates are sent too. To enter coordinates in the desktop app, use the "Coordinate" field; it's parsed on your PC and isn't sent.
Phone apps: coordinates pasted into the search box are parsed on the phone and aren't sent. Once the map moves there, the place name lookup sends a location near it (see the precision below).

What map services receive

The map area or center point you're looking at, and your IP address, like with any map app.
Map services can tell that requests from the desktop app, and the phone apps' place searches and place name lookups, come from Medjed.
This also includes the area around your real location:
- In the phone apps, when you open the map or tap the locate button, the map moves to your current real location.
- In the desktop app, each time you send a location, the map moves to the target.

Precision of place name lookups

Version	Coordinates sent
From the next version after Android 1.0.4 / iPhone build 35	First rounded to 3 decimal places, about 100 m
Android 1.0.4 (the current release) and earlier, and iPhone build 35 and earlier	Full coordinates

Please update once the new version is out.

8Third-party services

The following providers receive what they need to provide their service.

Service	Used for	What it receives
Polar	Payments (Merchant of Record)	Your payment details at checkout stay with Polar; we never see your card number. Polar notifies us of the subscription's email, subscription and customer IDs, status and renewal date; for a refund, it also notifies us of the order ID and amount. Our server sometimes checks a subscription's status with Polar using the subscription ID.
Resend	Sending email	Your email address and the message content, that is, the verification code email or the license email.
Vercel	Hosting the website and the API	Every request to the website and the API. It keeps its own access logs (IP address, path).
Upstash	Database	Stores the data listed in sections 3 and 4.
GitHub	The desktop installer, Android update files and desktop update checks; some fonts in the iPhone app are also downloaded from GitHub	Your IP address.
Map services (OpenStreetMap, Nominatim, OpenFreeMap, Photon)	Map tiles, place search and place name lookup	See section 7.
Google Fonts	Fonts for the website and the desktop app. The Android app's fonts are downloaded by Google Play services on the phone	Your IP address, but not your location.
unpkg.com	The desktop app still contains an old "phone browser remote control page". Since October it only runs locally on your PC, and there's no way to reach it from the interface	The map library is loaded from unpkg only if you open that page in a browser yourself. Normal use never connects to unpkg.
iloader, SideStore, LocalDevVPN	Third-party tools for installing on iPhone; not our services	For how they handle data, refer to their own documentation.

9Permissions: Windows desktop app

Administrator rights (UAC)

Installing: by default it installs into your own user folder, so it normally doesn't need administrator rights.
iOS service: while the app is running, this is the only part that needs administrator rights. It uses the open-source tool pymobiledevice3 to connect to the iPhone, and uses Wintun, WireGuard's open-source virtual network adapter driver, to create a virtual network adapter on your PC. The connection to the iPhone goes through this adapter, which is why it needs administrator rights. When you close Medjed, this service stops automatically.
When you'll be asked: the UAC prompt only appears after you've connected an iPhone or opened an iOS feature (the setup wizard, Photos, diagnostics, sending to an iPhone). If you only use Android, you won't see it.
If you click "No": it won't ask again for 30 minutes.
When upgrading: if the old iOS service is still running, the installer also asks for permission so it can close it.

Drivers

The iPhone USB connection uses Apple's official Apple Devices (or iTunes); Medjed doesn't install its own USB driver. For the Wintun virtual adapter used by the iOS service, see above.
Android uses the adb (Google's developer tool) bundled with the installer.

What the desktop app reads or sets on your PC

What it reads or sets	Details
Windows' list of USB devices	Recognizes your phone's brand so it can show you the matching guide.
MachineGuid in the registry	Used to compute the hardware ID hash (see section 3).
Where the emulator is installed	Finds the Android emulator on your PC and connects to it with adb (see section 6).
adb: app status and phone info	Checks the status of Medjed's own app, plus the phone's brand and OS version.
adb: the phone's system ID (`ANDROID_ID`)	Used only on the PC to merge duplicate connections to the same phone (for example when it's connected over USB and Wi-Fi at the same time). Never uploaded.
adb: one-click mock location setup	Sets Medjed as the mock location app and turns off the mock location permission for other apps (see section 2).
adb: when reinstalling Medjed	Grants its location and notification permissions directly, and selects it again as the mock location app (see section 10).

Photos feature

Reads photos from the iPhone directly over USB or through the local iOS service. Thumbnails are cached in your PC's temp folder, and exports go to the folder you choose. Nothing is uploaded.
A photo's GPS info is only shown on screen; you can copy it yourself.

Local server

Listens only on 127.0.0.1, to sync favorites with an Android phone connected over USB. Other devices on your local network can't connect to it.

10Permissions: Android app

Many apps ask for a long list of permissions as soon as they're installed. Below are all the permissions the Medjed Android app declares, and whether you'll be asked for each. The "setup checklist" means the "Before you start" (開始前的準備) screen in the app.

Asks youYou turn it on in SettingsAsked only if you use the featureAutomatic, no prompt

Permission	Will you be asked?	Why it's needed	Limits and notes
Location (precise / approximate)	Asks youThe first time you open the map, or at step 1 of the setup checklist.	Lets the map show where you are now. Android also requires this permission for the "location" foreground service that keeps running while simulating.	It doesn't ask for the background location permission (on Android 10 and later, the most you can grant is "While using the app"; Android 8–9 doesn't separate foreground and background location, and the app only reads your real location while its screen is open). Your real location is never uploaded to our server; but map services receive tile requests for that area, see section 7.
Notifications	Asks youOn Android 13 and later, at step 4 of the setup checklist. On Android 12 and earlier the system allows it by default and doesn't ask.	Shows "Medjed simulating" (Medjed 模擬中) and a stop button, a reminder when a new version has finished downloading, and an alert when your license is no longer valid and simulation has been stopped.	From the next version after 1.0.4, the notification no longer contains coordinates, and they can't be seen on the lock screen either.
Unrestricted background use (recommended)	Asks youWhen you tap "Set up" (設定) at step 6 of the setup checklist.	So the system doesn't stop the simulation and the joystick after you swipe the app away.	—
Mock location app (Developer options › Select mock location app)	You turn it on in SettingsChoose it in Developer options, or use the desktop app's one-click setup. When the app is reinstalled, the desktop app also selects it again automatically (see USB debugging below).	This is Android's official mechanism for changing location. Without selecting it, the location can't be changed.	The one-click setup selects Medjed for you and turns off the mock location permission for other apps, the same as choosing Medjed yourself in Developer options.
Display over other apps (optional)	You turn it on in SettingsAt step 5 of the setup checklist, or when you open the floating joystick (懸浮搖桿) without having allowed it yet, the app takes you to the settings page; on Xiaomi phones, the first time you open the joystick it also takes you to turn on background pop-up windows.	Needed for the floating joystick.	Only used to show the joystick; it can't see other apps' screens (see "Permissions we don't ask for" below).
Install unknown apps	You turn it on in SettingsOnly for in-app updates: when a downloaded new version is about to be installed (after you tap "Update" (更新) and the download finishes, or when you tap "Install" (安裝)), the app takes you to the settings page.	Needed for in-app updates.	It only installs our update files, and the system refuses to install a file with a different signature.
Health Connect steps (read + write, optional)	Asked only if you use the featureOnly when you tap "Grant Health Connect access" (授權 Health Connect) on the Steps (步數) page.	Reads today's steps and writes the steps you choose to add.	The data stays in Health Connect on your phone.
Internet	Automatic, no promptGranted at install (Android doesn't ask for this kind of permission).	Connects to our license server, map services and update checks, plus the small local server used to sync with your PC.	—
Network state	Automatic, no promptGranted at install.	Used by the map component to tell whether you're online.	—
Wi-Fi state	Automatic, no promptGranted at install.	Not used by the app at the moment (a declaration left over from an early version).	It doesn't read your Wi-Fi network name or nearby networks.
Foreground service (location type)	Automatic, no promptGranted at install.	The service that keeps running while simulating.	—
USB debugging (in the phone's Developer options; not an app permission)	You turn it on in SettingsThe first time you connect to a PC, the phone asks whether to allow that PC.	Lets the desktop app install the app, set up mock location in one click, send locations and push favorites.	While it's on, any PC you've tapped "Allow" for can control this phone, so you can turn it off when you're not using the PC. When reinstalling the app, the desktop app grants location and notification permissions directly with adb and selects Medjed again as the mock location app, without showing a prompt and without first checking whether you had allowed them before; if you don't want that, you can turn them off in system settings.

There's also one internal permission added automatically by Android's development libraries (DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION). It's only used to stop other apps from sending messages into Medjed.

Permissions we don't ask for

Contacts
Photos / videos / files
Camera
Microphone
Phone and call logs
SMS
Accounts
Physical activity
Background location
Accessibility service
Device admin
Usage access
Seeing which apps you've installed (its declaration makes Health Connect and apps that work with Health Connect visible to it, but the app only checks whether Health Connect is installed)

It doesn't use screen recording either, so it can't see other apps' screens.

Other apps can't make Medjed change your locationThe entry point that receives commands from the PC only accepts what's sent through adb.

11Permissions: iPhone app

Below are all the permissions the iPhone app declares, plus the settings you need to change yourself. Permission prompts are shown by iOS; you can decline, and change your choice later in Settings › Medjed.

Asks youNo promptYou turn it on yourselfNot a system permission

Item	Will you be asked?	Why it's needed	Limits and notes
Location (While Using the App)	Asks youThe first time you open the map, connect or pair.	Shows your location on the map, and keeps the connection alive when the screen is locked or you switch to another app.	It doesn't ask for "Always". Your location is never uploaded to our server; for what map services see, see section 7.
Local network	Asks youThe first time you connect or pair.	Connects to the phone's own debugging services; while pairing, it advertises itself on the local network.	It doesn't scan other devices on your home network.
Notifications	Asks youThe first time it connects (tapping "Connect" (連線), or automatically when you send a location from the map) or pairs ("Pair this phone" (配對這支手機)).	Disconnection alerts, the pairing code, and reminders when the app's signature is about to expire.	All of them are local notifications sent by the phone itself, not through a push server. If you don't allow them, a disconnection is only shown inside the app.
Background audio	No promptA background mode the app declares.	Plays near-inaudible silent audio so the app isn't suspended in the background.	It mixes with your music instead of interrupting it, and doesn't use the microphone.
Background location	No promptA background mode the app declares; you need to allow location (above) first.	Keeps the connection alive when the screen is locked or you switch to another app.	Uses the lowest accuracy (about 3 km); the location it receives isn't used for anything and isn't uploaded. While background location is in use, a blue location indicator may appear in the status bar.
Developer Mode	You turn it on yourselfIn the iPhone's Settings app.	An official Apple setting; iOS needs it to change location. The desktop wizard makes this option appear, and you turn it on yourself.	While it's on, Apple disables some additional protections, and other apps can more easily read debug information. We recommend keeping it on only while you use Medjed. When you don't need it, you can turn it off in Settings › Privacy & Security › Developer Mode, and turn it back on when you do.
Pairing file	Not a system permissionGenerated by the desktop wizard and placed on the phone.	The "key" that lets Medjed on your phone control location without a PC. It's generated by the PC and placed in Medjed's Documents folder (visible in the Files app).	Two copies are also kept on the PC: one in Medjed's folder (see section 12), and pymobiledevice3, the open-source tool used for pairing, also stores a pairing key in `%USERPROFILE%\.pymobiledevice3`. Please don't send them to anyone or post them in public channels.
LocalDevVPN	Not a system permissionA separate app that you install and turn on yourself.	A VPN app on the phone. Medjed only uses it to connect to the phone's own developer services (10.7.0.1). SideStore also relies on it for installing and refreshing apps.	For how LocalDevVPN handles data, refer to its own documentation.
SideStore	Not a system permissionA separate app that you install yourself.	Installs Medjed with your own Apple ID.	Apps installed with a free Apple ID need to be refreshed in SideStore every 7 days.

Background audio and background location are on by default. You can turn them off with the gear icon on the app's Settings › Connection & pairing (設定 › 連線與配對) page; with them off, the connection may drop when the screen is locked or you switch to another app.

Permissions we don't ask for

Photos
Contacts
Camera
Microphone
Health
Bluetooth
Calendars
Motion & Fitness
App Tracking (App Tracking Transparency)
"Always" location access
Seeing which apps you've installed (it only checks whether SideStore is installed, so it can open SideStore for updates)

12Data that stays on your devices

Desktop app

Data	Where it's stored
Main data	Favorites, routes, categories, and the "Send / movement log" (the latest 200 entries, including coordinates you've sent) are stored in the `data` folder in the install directory; if the install directory isn't writable, they go to `%APPDATA%\Medjed` instead. Favorites backed up from the phone before reinstalling the Android app (`companion-backups`) and the iPhone pairing file (`ios-pairing`) are also here.
Sign-in and trial status	.dat files in `%APPDATA%\Medjed`, `%LOCALAPPDATA%\Medjed` and `%ProgramData%\Medjed` (the sign-in file contains your license key or the email you signed in with), plus the registry key `HKCU\Software\Medjed`.
Automatic backups	`%APPDATA%\Medjed\backup`, keeping 10 copies, without the movement log.
Upgrade backup	`%LOCALAPPDATA%\Medjed-upgrade-backup`. It stays after you uninstall, so your data can be recovered when you reinstall.
iPhone pairing key	`%USERPROFILE%\.pymobiledevice3` (see section 11).

How to delete it:

Delete favorites and routes in the app; for the "Send / movement log", click "Clear".
To remove everything, delete the folders and the registry key above by hand after uninstalling.

Android

Main data: favorites, routes and settings are stored in the app.
Automatic backups: stored in "Download/Medjed" on the phone, keeping the latest 7. You can turn off "Daily automatic backup" (每天自動備份) in Settings (設定).
Uninstalling: doesn't delete "Download/Medjed"; you need to delete it yourself.
Google backup: the app has Android Auto Backup turned on. If Google backup is on for your phone, the app's data may be backed up to your own Google account.

iPhone

Main data: favorites, routes and settings are stored in the app.
Files app › On My iPhone › Medjed: contains the automatic backups (7 kept), the pairing file, and the log files medjed.log and idevice.log.
How to delete it: you can turn off "Daily automatic backup" (每天自動備份) in Settings (設定); deleting the app deletes all of these.
Keychain: the device key and the trial identifier are stored in the Keychain and stay on the phone after you delete the app; the trial identifier is what prevents repeated trials.
iCloud / computer backups: if you use iCloud Backup, or back up your phone to a computer, this data is included in those backups.
Log files: log files from build 35 and earlier may contain simulated coordinates. If you send them to us for debugging, please use a private message and don't post them in public channels.

13Security and download sources

Code signing

The installer currently has no code signature, so Windows SmartScreen may show a warning. We plan to apply for code signing, but there's no set date yet.

VirusTotal results

These are the results when v0.7.0 was uploaded, all with 0 detections. Antivirus databases get updated, so check the links for the latest results.

File	Scan result
Desktop installer (v0.7.0)	View on VirusTotal
Android app (1.0.4)	View on VirusTotal
iPhone app (build 35)	View on VirusTotal

Download sources

Only download from these two places:
- The official website https://gps.medjed.app
- The official GitHub https://github.com/lele2337-coder/medjed-releases
Please don't install installers that someone sends you in a private message.
Android: updates are only accepted if they're signed with the same release key; if the signature is different, the system refuses to install it.
iPhone: the app is signed and installed through SideStore with your own Apple ID.

Connection security

All traffic between the apps and the server uses HTTPS. The server address is medjed.vercel.app, the same host as the website.
When a phone signs in, it signs with a key generated on the phone itself. The private key is stored only on the phone (Android Keystore / iPhone Keychain); the server only stores the public key.

Diagnostic info

"⚙ Tools › Copy diagnostic info" copies the version, the iPhone's name and UDID, and the install path (which may include your Windows user name) to the clipboard.
Whether to paste it, and to whom, is up to you. We recommend sending it to an admin in a private message rather than posting it in a public channel.

Check it yourself

You can confirm all of the following on your own phone and PC. If anything doesn't match this page, please let us know as described in section 14.

What to check	Where to look	What you should see
Android: the app's permissions	Settings › Apps › Medjed GPS › Permissions (menus differ slightly by brand, for example Xiaomi or Samsung)	Only Location, plus Notifications on Android 13 and later; on Android 14 and later, Health Connect may also appear. This matches section 10.
Android: mock location app	Settings › Developer options › Select mock location app	It shows Medjed GPS only if you chose it yourself or set it with the desktop app (the one-click setup, or the automatic reselection when the app is reinstalled; see section 10).
iPhone: location	Settings › Privacy & Security › Location Services	Medjed is listed, and its options don't include "Always" (see section 11).
iPhone: local network	Settings › Privacy & Security › Local Network	Medjed is listed (this is the "Local network" permission in section 11).
iPhone: other privacy items	Photos, Contacts, Camera, Microphone, Health and Tracking on the same screen	Medjed isn't listed in any of them.
Windows: running programs	Task Manager (Ctrl+Shift+Esc) › Details	Medjed GPS.exe: Medjed itself; you'll see several of them. adb.exe: checks every 5 seconds for a connected Android phone. It may keep running after you close Medjed; you can simply end it. python.exe: bundled with Medjed, located in `resources\python` in the install folder (right-click › Open file location to check). It appears briefly every 5 seconds to check for a connected iPhone. While you use iOS features, a few stay running: the iOS service (section 9), plus the ones for sending locations to your iPhone and for the Photos feature. They're all python.exe from the same folder. wscript.exe or powershell.exe: only there while the iOS service is running; it stops the iOS service when you close Medjed. After you close Medjed, everything above except adb.exe exits.
Windows: network connections	Resource Monitor (search for resmon in the Start menu) › Network, then select the check box next to Medjed GPS.exe	Apart from this PC (127.0.0.1), it only connects to our server (medjed.vercel.app), our website (gps.medjed.app), GitHub, Google Fonts and the map services in section 7 (tile.openstreetmap.org, tiles.openfreemap.org, nominatim.openstreetmap.org, photon.komoot.io). Resource Monitor may show only IP addresses here. python.exe and adb.exe only connect to this PC and your phone.
Windows: install location	Open `%LOCALAPPDATA%\Programs\Medjed GPS` in File Explorer	This is the default install location (you can change it during installation).
Windows: uninstalling	Settings › Apps › Installed apps (on Windows 10, "Apps & features") › Medjed GPS	You can uninstall it here. For the folders left behind after uninstalling, see section 12.
Installer	Only download from the two places under "Download sources" above. After downloading, run `Get-FileHash "file path"` in PowerShell (put straight double quotes around the path so it works even if the path has spaces).	This only works for the versions listed above (desktop v0.7.0, Android 1.0.4, iPhone build 35): if the SHA-256 it prints matches the long string in the matching VirusTotal link's address above (upper or lower case doesn't matter), it's the same file.

14Your rights and how to reach us

Access or delete your data

To access or delete your data on our server, send a private message to an admin on Discord.
Exception: the records that prevent repeated trials are kept until their period ends (400 days after last use).

Unbinding devices

Desktop app: click "Switch PC (unbind this machine)". Unbinding only frees this PC's slot; the license record and the record of which licenses this PC has used are kept, because support uses them to resolve disputes.
Phones: tap "Sign out this phone" (登出這支手機) to free the slot for another phone. Each platform can switch phones only once every 7 days.
Phone lost or broken and you can't sign out: send a private message to an admin and we'll remove it for you.

Privacy policy

Privacy in "Terms & Disclaimer" on our website.

If you find something that doesn't matchIf this page and the apps' actual behavior ever differ, the code is what counts. Please let us know if you find something like that, and we'll correct it.

15What changed on Oct 11

This time we went through the desktop app, Android, iPhone and the server again with one question in mind: can your location leave your device? The conclusion: the server has never had an interface that accepts user locations. But we did find a few things that weren't good enough, and we've fixed them as follows.

IP records on the server

The problem before:
- The names of rate-limit records contained the IP address directly. Most of them expired within 2 days; the few without an expiry are deleted immediately after this update goes live.
- The network hashes used to prevent repeated trials used a fixed algorithm that could be reversed. Some were kept for 400 days, and some had no expiry.
Now: all new records use hashes computed with a server secret key. Old-format records from before the Oct 11 update (rate-limit records whose names contain a raw IP address, and network hashes computed the old way) stop being used as soon as this update goes live, and all of them are deleted immediately afterwards.
What the website said: the website used to say that connection IP addresses are deleted after at most 2 days. That wasn't accurate, and it now describes what actually happens.

Mushroom warehouse

The problem before: the IDs on the list could be used to work out the locations of places nobody had claimed yet. Those are places we provide, not any user's location.
Now: the IDs can no longer be used to work out locations, and unclaimed places no longer come with a time zone.

Android (next version after 1.0.4)

The notification (including on the lock screen) no longer shows your current coordinates.
For place name lookups, coordinates are first rounded to about 100 m.

iPhone (next version after build 35)

Place name lookups use lower coordinate precision and are made less often.
Log files no longer record simulated coordinates.
The description shown when asking for location permission now matches the facts. The old one said "your location stays on your phone and is never collected or uploaded" (位置只留在手機上，不會蒐集也不會上傳), but place name lookups send the map center to OpenStreetMap's Nominatim, so that wasn't accurate.

Website privacy policy

Added what map services receive, the warehouse claim records, and where fonts and libraries are loaded from.
Removed the imprecise claim that map queries don't include your identity.

When it takes effect

The server fixes go live together with this page.
The Android and iPhone fixes will ship in the next version (after Android 1.0.4 and iPhone build 35). Please update once it's out.

Change log

2026-10-13: The mushroom warehouse now keeps daily usage totals (how many times the list was fetched, roughly how many people viewed it or claimed something, how many mushrooms were claimed), without recording who, for 90 days (section 4). In section 2, "Not stored on the server" now says per-person feature-usage analytics. Later the same day, the people counts switched to a random daily salt (no people counts were recorded in the first few hours, so no data computed with a fixed key remains). Nothing else about what we collect has changed.
2026-10-12: Added explanations only; nothing about what we collect has changed: whether each Android and iPhone permission shows a prompt, and which permissions we don't ask for (sections 10 and 11); a personal-data table split into the desktop app, the phone apps and what the server doesn't store (section 2); and "Check it yourself" steps (section 13).
2026-10-11: Published this page. Live on the server at the same time: the database no longer stores raw IP addresses, and warehouse IDs can no longer be used to work out locations; old-format records stop being used as soon as this goes live and are all deleted immediately afterwards. Android (next version after 1.0.4): the notification no longer shows coordinates, and place name lookups are rounded to about 100 m. iPhone (next version after build 35): lower precision for place name lookups, and log files don't record simulated coordinates. Details in section 15.