Privacy
Privacy Policy
Shepherd Rover collects nothing. There is no account to create, no analytics, no crash reporting, no advertising, and no Shepherd Rover server anywhere. The app talks to one thing: the rover you point it at, on your own network. Everything it saves stays on your device.
What the app does not do
- No account, no sign-in, and no email address is needed to use the app.
- No analytics, usage tracking, or event reporting. The app never phones home, because there is no home to phone.
- No crash-reporting or diagnostics service.
- No advertising, no advertising identifiers, and no cross-app or cross-site tracking.
- No third-party analytics, advertising, or attribution code is bundled at all. The apps are built on Apple's and Google's own frameworks, plus an open-source HTTP client on Android that only ever talks to your rover.
- No location. The app never asks for your position and never receives it. The orientation readings on the telemetry display come from a motion sensor, not from satellite positioning.
Where the app connects
The only network destination is the rover address you type in or pick from discovery. Drive commands go out to that address and telemetry comes back from it. Nothing is relayed through a Shepherd Rover server, because there is not one.
- On a local network the connection is plain HTTP, because rover hardware has no TLS certificate to present. iOS permits this only for local networking. Android permits cleartext only to loopback, private, link-local, unique-local, .local and single-label addresses; a rover reached at a public hostname must use HTTPS.
- Discovery uses Bonjour and mDNS to find rovers advertising themselves. That is a broadcast on your own local network and does not reach the internet.
- Command signing is optional and off by default. With it on, each command carries an HMAC signature. On iOS the signing secret you enter is kept in the device keychain; on Android it is compiled into the build. Either way the secret itself is never transmitted — only the signature computed from it.
What is stored, and where
Everything Shepherd Rover saves is written to the app's own private storage on your device. None of it is uploaded, synced, or shared with anyone.
On iOS
- The rover address you last connected to.
- Your preferences: control scheme, gamepad scheme, haptics, and whether the telemetry mode and the quick-action bar are shown.
- Whether you have finished the onboarding screens.
- Any custom rover profiles you create, with the names and motor settings you gave them. A command-signing secret, if you set one, is kept in the device keychain rather than with the ordinary settings.
On Android
- Rovers you have saved, with the nickname you chose, the address, and the hardware address if the rover reported one.
- Telemetry samples recorded during a session, such as battery voltage and orientation.
- Driving-session summaries, such as start time, end time, and distance.
- Tricks you record, stored as the sequence of commands you drove.
- A local log of session events.
The Android app opts out of Android cloud backup and of device-to-device transfer entirely, so none of this data leaves the phone by either route.
Deleting the app removes everything it stored, on both platforms.
Telemetry export
You can export telemetry as CSV or JSON. The file is written only when you ask for it and is handed to the system share sheet, where you choose what happens to it next. On Android it is written to the app's own cache directory and shared through a grant scoped to that export folder alone. Shepherd Rover never uploads an export anywhere.
Permissions the app asks for
Motion and orientation
Used only for tilt-to-drive. Your device's tilt is turned into motor values in memory and sent to the rover as drive commands. The readings are not recorded and are not sent anywhere else.
Local network
Used to discover rovers on your network and to reach the one you connect to. On iOS this is local network access; on Android it is the nearby-devices and WiFi-state permissions. It is not used to inventory your network or to look at anything other than the rover you are driving.
Declared but not used in this version
Two permissions appear in the app's manifest without being exercised by this release. They are listed here so that seeing them in the store listing or in system settings does not mislead you:
- Microphone and speech recognition. Voice control is written but switched off: there is no way to reach it in the shipping app, and Shepherd Rover does not record audio or run speech recognition in this release. If voice control is turned on in a future version, this policy will be updated before that version ships.
- Bluetooth, on Android. Game controllers reach the app through the operating system's ordinary input handling, which needs no Bluetooth permission, and the app never scans for or connects to Bluetooth devices itself.
Children
Shepherd Rover is a general-audience app. It is not directed at children, and because it collects nothing, it does not knowingly collect information from anyone of any age.
This website
www.shepherdrover.com is a static site with no cookies, no analytics, and no third-party embeds. Your theme and language choices are kept in your own browser's local storage and are never sent anywhere.
The App Store and Google Play
Apple and Google collect their own data about downloads, and about crashes when you have agreed to share them with developers. What they pass back to us is aggregated and does not identify you. That collection is governed by Apple's and Google's privacy policies, not by this one.
Changes to this policy
If this policy changes, the revised version is posted on this page with a new effective date. Material changes will be described here rather than made quietly.
Contact
Questions about privacy, or about anything on this page: