Privacy Notice
What TAVI collects during the private beta
Effective 26 September 2026 · Revision 2026-09-26.1
Operator and purpose
The person who issued your TAVI invitation operates this private beta and is responsible for its data. Contact them through the channel that delivered your code for access, correction, deletion or device revocation. If you do not know who issued it, do not activate. The purposes are to test connectivity across networks and locations, diagnose blocking, manage invitations and enforce access periods.
Activation and device
The server stores the invitation name, a one-way hash of the code until it is used or expires, your device public key and tunnel address, a hashed token, activation IP, access dates, consent revision and time, acceptance IP and revocation details. The private VPN key stays on your phone. The app also reports phone model, Android and TAVI versions, language, time zone and network/SIM country codes; those codes do not establish your physical location.
Background location and networks
After activation the app requests coordinates, accuracy, measurement time and provider, network type and identifier, connectivity state, available Wi-Fi names (SSID), access point addresses (BSSID), carrier name/code and DNS servers. The service can run with the VPN off and app closed. It requests location updates about once a minute while moving and reports stationary readings no more often than roughly every five minutes. Android can delay or suppress measurements. Precise and background permissions are required to participate; revoking them pauses the beta VPN.
Traffic and diagnostics
While the VPN runs, the server records external IP and port, handshake time, transfer counts, destination IP and port, protocol, DNS questions and answers, visible TLS/SNI names and TLS metadata, plus the method, host, path and response status of unencrypted HTTP. The app reports connectivity test results, errors and response times. It does not store encrypted HTTPS content, private keys or complete raw packets. Encrypted DNS and concealed host names may be invisible; TAVI cannot see literally everything a phone does.
Retention and hosting
Diagnostic events, coordinates and traffic metadata remain in the live database for about 24 hours: records older than a day are removed on the next diagnostics request and periodic cleanup. Activation and acceptance IPs, brief access events and connection samples are cleared after 30 days. Device records remain during access and are deleted 30 days after expiry or revocation; access lasts 30 days. The diagnostics database is on the TAVI server in Germany. The public website is hosted by Vercel, which may process ordinary request data under its own rules.
Access and exports
The beta administrator accesses diagnostics through a separate viewing key. The dashboard URL is public, but the records require that key. Anyone else who obtains the key can also read them. A 24-hour export creates a downloaded file; exported files and backups are outside automatic live-database cleanup and must be deleted separately by the operator. The data is not used for advertising or sale.
Your choice
Consent is given using the checkbox and activation button after reading the Terms. Android separately asks for precise location and continuous background access; you may decline or later revoke them. You can stop the service from its notification, but simply disconnecting the VPN does not stop diagnostics. Declining pauses participation and the VPN. Ask the person who invited you for a copy or deletion of data, including exports. Withdrawal does not undo processing before records are deleted.
Revision
Revision 2026-09-26.1, dated 26 September 2026. Changes to data categories or purposes require acceptance of a new revision in the app.