Enlyzr

ZRAK: privacy policy

What ZRAK stores, what can leave your device, and how to reach us.

Last updated: October 2026

Introduction

Enlyzr ("we", "our", or "us") makes ZRAK, a network security toolkit for Android. Inside the app the name is written Z.R.A.K., for Zone Recon & Analysis Kit. This Privacy Policy explains what the app records, where that is kept, which permissions it uses, and what it sends over the network.

In short: ZRAK has no account, no advertising and no analytics, and it sends nothing to us. What it finds is kept on your device until you delete it. It is a network tool, though: it talks to the network you are connected to, and some of its tools ask services on the internet for an answer. This policy names each of them.

Information the app stores

ZRAK looks at the Wi-Fi networks and Bluetooth devices in range and at the devices on the network your phone is connected to, and it keeps a history of what it saw. All of it is stored on your device, in the app's own database and settings:

  • Wi-Fi networks: the name (SSID), the hardware address (BSSID), signal strength, the kind of security, and the place where the network was seen. Each sighting adds a measurement with signal strength, GPS coordinates and time.
  • Bluetooth devices: the hardware (MAC) address, name, type and signal strength, the place where the device was seen, and measurements with signal strength, GPS coordinates and time.
  • Devices on the local network: IP address, hardware address, host name and vendor, and sightings with IP address, GPS coordinates, accuracy and time.
  • Scan points: the places where the app made a Wi-Fi scan, with GPS coordinates, accuracy and time.
  • Security events: what the app's detection engines noticed, with time, type, severity, a description and the address the event came from. Events of medium, high and critical severity are saved in the database. Lesser events, and the note the app makes when you open a tool, are kept only until the app is closed.
  • What you add yourself: the names, notes and labels you give to devices, the trust state you set for a device, baselines (a saved list of the devices on a network, to compare with later), monitoring profiles, and how far you are in a guided workflow.
  • Settings: theme, Basic or Advanced mode, which detection engines are switched on, your choices for vibration and notifications, the hardware and IP address of your router as first seen (so that a change can be noticed), a count of how often each tool was opened, and a map key if you enter your own.
  • Map tiles: the pieces of map the app has loaded are kept in a cache on the device, so that they need not be loaded again.

These records describe the devices around you, and some of those belong to other people. Together with the coordinates they also show where your phone has been. The app keeps them without a time limit: they stay until you delete them (see Data deletion).

  • No account: the app has no registration and no login.
  • Nothing is sent to us: the app has no server of ours to report to. We do not receive your scan results, your location or anything else.

Exporting and sharing

Data leaves the app as a file only when you ask for it:

  • Reports and exports: the Overview screen exports the collected data as JSON (events, Wi-Fi networks, Bluetooth devices and network devices), as CSV, as an incident report in Markdown, as a PDF report, and in the CEF and Syslog formats that security monitoring systems read. The Analyzer exports its analysis as Markdown, JSON or CSV. The app writes the file into its own cache folder and hands it to Android's share sheet; it goes to the app you choose there, and nowhere else.
  • Database backup: "Backup" saves the whole history database as one file, in a place you choose in Android's file dialog. "Restore" reads such a file back in.
  • Clipboard: some tools copy a text report to the clipboard for you to paste elsewhere.

An exported file or a backup holds the same addresses and coordinates as the app itself. Once you have shared or saved it, it is outside the app, and deleting the app's data does not remove it.

Android backup

ZRAK is excluded from Android's backup. Its history and settings are part of neither the Google cloud backup nor a transfer from one device to another. To move your history to another phone, use the app's own Backup and Restore.

Permissions and what leaves your device

Permissions

  • Precise and approximate location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION): Android gives an app the results of Wi-Fi and Bluetooth scans only with the location permission, and with location switched on. ZRAK also uses the position itself: it stores GPS coordinates with what it finds, shows them on the Map screen, and uses them in the tools that follow a signal or map coverage. While monitoring is active, the position is read about once a second. Approximate location is the fallback when GPS is not available.
  • Location in the background (ACCESS_BACKGROUND_LOCATION): declared so that monitoring can go on receiving the position while the app is not on the screen.
  • Nearby Wi-Fi devices (NEARBY_WIFI_DEVICES): needed for Wi-Fi scanning on Android 13 and newer.
  • Wi-Fi state (ACCESS_WIFI_STATE, CHANGE_WIFI_STATE): to read the Wi-Fi scan results and the details of your current connection, and to start a scan.
  • Wi-Fi multicast (CHANGE_WIFI_MULTICAST_STATE): the tools that discover services on the local network (printers, media players, smart home devices that announce themselves) need it to receive those announcements.
  • Bluetooth scan (BLUETOOTH_SCAN): to find Bluetooth Classic and Bluetooth Low Energy devices in range.
  • Bluetooth connect (BLUETOOTH_CONNECT): to read a device's name and whether it is paired with your phone, and for the tools that connect to a Bluetooth device you picked in order to list the services it offers.
  • Bluetooth, old form (BLUETOOTH, BLUETOOTH_ADMIN): declared for Android 11 and older only. ZRAK runs on Android 12 and newer, where these two have no effect.
  • Camera (CAMERA): used by two tools only, the Covert Camera Detector and the Infrared Scanner. They look at the live camera picture, with the flash or through the front camera, for the bright points that a hidden camera's lens or its infrared lights produce. The picture is examined on the device.
  • Internet (INTERNET) and network state (ACCESS_NETWORK_STATE): for the checks and tools described below, for loading the map, and to know whether and how the phone is connected.
  • Notifications (POST_NOTIFICATIONS): for the permanent notification that says scanning is active, and for alerts about events of high or critical severity. Both kinds of alert can be switched off in the settings.
  • Foreground service (FOREGROUND_SERVICE, FOREGROUND_SERVICE_LOCATION): monitoring runs as a service that Android keeps alive and shows in the notification bar ("Scanning is active"), so that it can continue when you leave the app. It stops when monitoring and Wi-Fi scanning are both off.
  • Vibration (VIBRATE): a short pulse when a Wi-Fi scan is refreshed and on threat events, if you leave these switched on.

ZRAK asks for no access to your contacts, messages, photos, files or microphone.

What the app does on the network you are connected to

ZRAK examines the local network, and to do that it sends and receives data there:

  • While monitoring is on, it reads the phone's table of neighbouring devices, asks for Wi-Fi scans, scans for Bluetooth devices, and listens on a few network ports for incoming connections. A device that tries those ports is recorded as a security event, with its address.
  • A network scan, which runs only when you start it, sends pings, small test packets and name queries to the addresses of the local network to find out which devices are there.
  • Tools you start yourself go further with the device or address you point them at: they try common ports, read the greeting a service sends, ask for announced services, or check a TLS certificate.

Other devices and the network's administrator can see this activity. Use these tools on a network that is yours or that you have permission to examine.

What goes to the internet

ZRAK has no function that uploads the history it keeps. What does go out are the questions listed under Third-party services: test requests that show whether the connection is sound, look-ups of a single IP address or domain name, and the requests for the map. As with every internet request, the service that answers sees the IP address your connection comes from.

Third-party services

ZRAK contains no advertising, no analytics and no crash reporting, and it has no user accounts. It does contact the following outside services. Each is run by its own operator under its own privacy terms, and none of them is ours.

The map

  • MapTiler (api.maptiler.com): the map pictures on the Map screen and in the other places where a map is shown. A request names the map area you are looking at, which is usually where you are, and carries a key: the one built into the app, or your own if you enter one in the settings. The credit line under the map links to www.maptiler.com and www.openstreetmap.org.
  • unpkg (unpkg.com): the program library that draws the map is loaded from here when a map is opened.

Connection checks while monitoring is on

  • Reachability and login pages: the app asks connectivitycheck.gstatic.com, www.google.com and clients3.google.com for an empty page, to see whether the internet is reachable or a Wi-Fi login page stands in between. If that fails it tries google.com, cloudflare.com and www.apple.com over HTTPS.
  • Name resolution: the app looks up the names google.com, cloudflare.com, example.com and quad9.net and measures how long it takes. To notice forged answers it asks the public DNS servers of Cloudflare (1.1.1.1) and Google (8.8.8.8) the same questions and compares.

Tools that you start

  • Captive Portal Analyzer and Captive Portal Fingerprinter: request the test pages that phones and computers use to detect a login page: connectivitycheck.gstatic.com, captive.apple.com, www.msftconnecttest.com and detectportal.firefox.com.
  • DNS Integrity Verifier: resolves google.com, cloudflare.com, github.com, amazon.com and microsoft.com through your network's DNS server and through those of Google (8.8.8.8), Cloudflare (1.1.1.1) and Quad9 (9.9.9.9), and compares the answers.
  • SSL/TLS Interception Detector and the other tools that examine encrypted connections: connect to well-known sites, the five named above and www.apple.com, and look at the certificate they receive.
  • Network Latency Profiler: pings your router and 1.1.1.1.
  • Network Path Analyzer and the traceroute in a device's details: send pings towards google.com or a target you enter.
  • Network Path Analyzer, IP / Domain Reputation Checker and Connection Metadata Analyzer: send an IP address (a stop on the route, a device, or the far end of a connection) to ip-api.com and receive its country and network operator. This look-up is not encrypted.
  • VPN Leak Tester: asks httpbin.org which public IP address your connection appears to come from.
  • Bandwidth Profiler: measures speed by downloading 10 MB of test data from speed.cloudflare.com and uploading 5 MB to it.
  • Certificate Transparency Monitor: sends the domain name you type to crt.sh and receives the list of certificates issued for it.
  • NTP / Time Integrity Checker and NTP Poisoning Detector: ask the time servers pool.ntp.org, time.google.com, time.cloudflare.com and time.apple.com for the time.
  • WPAD Detector: looks for a host named wpad on the network you are connected to. This is a question to your own network, not to an outside service.
  • Tools with a target of your choice: a tool that asks you for an address or a domain connects to what you entered.

Reference lists that contact nobody

The MITRE ATT&CK Mapper and the Service Vulnerability Correlator work from lists built into the app. Their entries carry reference links to attack.mitre.org and nvd.nist.gov; those sites are contacted only if such a link is opened. The app's built-in vendor lists name their sources, www.bluetooth.com and a project on github.com; the lists are part of the app and are not downloaded.

Children's privacy

ZRAK is a technical tool, and it is also used for teaching network security. We do not knowingly collect personal information from children or from any other user: the app has no accounts and sends nothing to us. What it records stays on the device it runs on.

Data deletion

You can delete what the app has stored:

  • In the app: "Purge All" on the Overview screen permanently deletes the whole history, the saved security events included. "Clear Events" empties the event list.
  • In Android: Settings > Apps > ZRAK > Clear Data removes the history, the settings and the cached map tiles.
  • By uninstalling the application from your device.

There is nothing to delete on our side, because we hold no data. Files you exported and backups you saved are yours to delete where you put them.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be reflected in the "Last updated" date at the top of this policy. We encourage you to review this policy periodically.

Contact us

If you have any questions about this Privacy Policy, please contact us at enlyzr@gmail.com.