IoTForge / Android

IoTForge privacy policy

Effective: 7 November 2026 · Package: com.iotforge.app

IoTForge is provided by Rupak Banerjee under the Cyber Wizard brand in India. For support, privacy questions or deletion requests, email [email protected].

About IoTForge · Request account deletion

Local MQTT tools and storage

You can use the local MQTT tools without an IoTForge account. Connection profiles, publishing templates, workspaces, settings, message buffers, decoded numerical trends and diagnostic events are processed on your device. Account caches are separated by authenticated user ID; guest data has a separate cache and is not automatically imported into a signed-in account.

Local profile and trend databases use SQLCipher encryption. Account preference values, database keys, broker passwords and session credentials use Android Keystore-backed encryption. Android KeyChain manages client identities that you select. Public custom CA certificates remain in app-private storage. Theme and other non-sensitive appearance settings may be shared across accounts on the device.

Logging out stops the previous account's active app connections and hides its cache. It does not erase that account's encrypted cache or delete its cloud account. Signing into the same account can restore its own cached records. Local data controls apply to the current app data scope; uninstalling removes app-private data. Android KeyChain identities have separate system controls.

Connections you choose

When you connect, subscribe or publish, IoTForge sends the credentials and MQTT data needed for that operation to the broker endpoint you configure. The broker operator controls its handling of this traffic. Plain MQTT over TCP does not encrypt traffic. Use a correctly configured TLS broker when encryption in transit is required. IoTForge validates TLS trust and hostnames and has no insecure TLS fallback.

Optional accounts and synchronization

If you create an account, Supabase processes your email address, authentication information, user identifier and optional display name. IoTForge synchronizes workspace and broker-profile metadata, memberships and connection session history for account features. Metadata can include connection names, hostnames or IP addresses, ports, client identifiers, broker usernames and non-secret connection options. Session history includes connection names, times, durations and traffic counts.

Broker passwords, SAS tokens, client private keys and MQTT message payloads are not uploaded through profile/history synchronization. Resend delivers account authentication emails through Supabase's email configuration. Infrastructure providers can process technical request, authentication and delivery information for service operation and security.

The current Supabase project is hosted in the Sydney region of Australia. Google, email providers and other infrastructure providers may process information in other countries under their own privacy and data-processing terms.

Advertising and choices

The Google Play release includes Google AdMob banner advertising. Google's Mobile Ads SDK can process IP-derived approximate location, advertising or device identifiers, app and ad interactions, and diagnostic information for advertising, analytics and fraud prevention. These advertising activities may involve data sharing with Google and its advertising partners. See Google's privacy policy and advertising technologies information.

IoTForge uses Google's User Messaging Platform to request applicable privacy choices before requesting ads when required. Settings shows Privacy choices when required by the platform, so you can revisit the available options. Device advertising/privacy settings provide additional controls. Debug and private testing configurations do not initialize or display ads.

Diagnostics and exports

IoTForge keeps bounded diagnostic events locally. You can clear them and review a redacted diagnostic snapshot before choosing to share it through Android's sharing interface. Your chosen destination handles the exported information under its own practices. Review diagnostics and copied MQTT payloads before sharing them. IoTForge does not automatically upload these diagnostic exports to its account service.

Retention and deletion

Cloud account information and synchronized records are retained while your account exists, unless you remove individual records through available app controls. To delete your account and associated cloud data, follow the account-deletion instructions. We verify ownership and complete deletion within 30 days after ownership verification.

Account deletion covers the authentication account and associated cloud workspaces, profile metadata, memberships, session history and any decoder records retained from earlier testing. It does not remotely erase data on your devices or remove records independently held by a broker you selected.

The current Supabase Free project has no scheduled project backups. Its plan provides one day of API/database log access; this is not a promise that all provider-internal security records are erased after one day. Resend documents 30-day email/log retention for its Free, Pro and Scale plans. Providers may retain separate security, billing or legally required records under their own policies. We retain support correspondence as needed to resolve the request, document its completion and meet applicable legal obligations; contact us to request deletion or ask about a specific record.

Security, rights and policy changes

We use access controls, encrypted local storage and encrypted connections to the account service. No storage or transmission method guarantees complete security. You can contact us to request access, correction or deletion of your account information, withdraw applicable privacy choices or raise a concern. We may need to verify ownership before acting. Information independently controlled by your broker or another provider must be addressed with that provider.

We will update this page and its effective date when these practices change. This product notice supplements the Cyber Wizard website privacy policy. Contact: Rupak Banerjee, Cyber Wizard, [email protected].