Terms of use

By downloading or using SondeFox, you agree to these terms. SondeFox does not transmit radio-frequency signals; it is a receive-side field aid, not an aviation, navigation, emergency, or safety-of-life service. You remain responsible for obeying local radio, access, driving, and recovery laws and for making safe decisions in the field.

SondeFox includes optional Google Maps features and content. By using SondeFox, you agree to be bound by Google's Terms of Service. Your use of Google Maps features and content is also subject to the then-current Google Maps End User Additional Terms of Service and Google Privacy Policy.

Licensing

SondeFox applications are intended to remain free. Cleared SondeFox-owned code is planned for Apache-2.0; current private material is not licensed by that announcement. Public source and download availability remain pending review. See licensing and notices, source status, and trademark status.

SondeFox owes a real debt to published specifications and permissively licensed work across the radiosonde and SDR communities (see the acknowledgements below). Third-party provenance, immutable versions, licenses, and redistribution terms are recorded in the project's reviewed third-party inventory.

Privacy policy

Last updated: September 25, 2026.

Platform scope

The Android and iOS sections describe current private builds. The platforms share some SondeHub features but differ in receiver connections, device permissions, background activity and support captures. macOS release-specific disclosures still need verification before public distribution. Public availability is shown on the downloads page.

Privacy details: Android · SondeHub contributions · iOS · Private debug storage · Your choices and requests.

Android permissions and network features

• SondeFox diagnostics and privacy. The app requires no sign-up and SondeFox does not run routine usage analytics or advertising trackers. Diagnostic reports you choose to send are used to diagnose bugs and improve the app. Decoded telemetry is not sent to SondeFox unless you explicitly use a developer-capture upload.
• Location and sensors: location and orientation data support on-device chase guidance and the compass pointer. When native 3D is enabled, SondeFox also provides geographic coordinates to the Maps 3D SDK: the current phone fix can be added as the chase-vehicle marker and used as the Chase Car camera center, while sonde positions, tracks, and landing predictions are added as markers and overlays. In normal operation Google may receive latitude/longitude coordinates and request or usage data, as described in the Google Maps Platform Terms. Android location permission can be revoked at any time; the SondeHub and SondeFox uploads described below remain separately opt-in.
• SondeHub, reading: the Saved Flights screen fetches and refreshes exact flight history, and the optional landing-prediction setting polls SondeHub's predictor for eligible radiosonde targets during a running local chase. If you enable Auto-update for a saved flight, Android may make its exact-history refresh requests in the background about every 15 minutes, subject to the Wi-Fi-only or cellular network policy you selected. While the chase screen is open, current builds also live-follow up to six saved flights (the flight on screen first) over one shared read-only MQTT-over-WSS connection to SondeHub, subscribed only to those flights’ exact serial or callsign topics. This connection respects the same network policy and aggregate reconnect limit, stops when the app leaves the foreground, and uploads nothing. SondeHub receives ordinary request metadata for these connections, including your IP address and a random per-connection client identifier. The current SondeFox source configuration enables the SondeHub Live source in both production releases (from v0.14.7 onward) and the separately installed SondeFox Test debug build; older installed production builds do not expose it. SondeHub Live is an explicit per-activation opt-in: after you select it, review its disclosure, and choose network access, broad 2D map views request one bounded active-sonde snapshot without sending the map center, while closer 2D views send the viewed map center and search radius; from v0.14.9 onward either view then opens live subscriptions for up to sixty-four selected exact sondes, and before v0.14.9 only the closer views opened subscriptions, for up to twenty-four. From v0.15.2 onward, while SondeHub Live is selected, SondeFox also requests recent observations for the lookback window you choose (one hour by default, up to twenty-four hours) and published recovery reports for the past three days; these read-only requests send the viewed map center and a search radius of at most 150 km at every zoom level, including broad views, follow the same network policy and request limits, are kept only in memory for the session, and never upload anything or write a recovery report. Native 3D currently does not estimate or send its viewport for SondeHub Live discovery. SondeHub receives ordinary request metadata, including your IP address, and a random per-activation client identifier. SondeFox sends no user-account identifier; the session is receive-only, never uploads telemetry or your position, and is not restored or run in the background. From v0.14.9 onward you can also long-press a sonde on the chase screen to fetch that flight’s published path from SondeHub and draw it on your map; this is a single request you initiate, it follows the same network policy, nothing is stored, and the fetched positions are drawn only and are never uploaded anywhere.
• SondeHub, writing: strictly opt-in. Telemetry requires a configured callsign and, from v0.14.14 onward, SondeFox transmits only genuine radiosonde decodes with an exact SondeHub type mapping after CRC, confirmed strict identity, GPS time/position, freshness, and plausibility gates. SondeHub's server-side denylist decides protocol acceptance among those types. See the table below.
• MapLibre 2D map: when you're online, the chase map fetches styles and tiles from its configured providers; like any web request, a provider sees standard request metadata such as your IP address and which map areas you request. Supported 2D content may be cached on-device for field continuity.
• Google Maps APIs: the optional native 3D map uses the Maps 3D SDK for Android and requests online Google map content for the area you view; SondeFox does not implement an offline store for that Google content. Google's current SDK disclosure says the SDK automatically collects request metadata, including device and operating-system details, SDK build and version, the number of results returned, and an Internal Usage Attribution Identifier; it also collects stack traces and crash metrics, IP address, and a Maps 3D SDK-specific pseudonymous identifier. Depending on map use, it collects interaction events such as panning and zooming. Google states that the Internal Usage Attribution Identifier is not used to identify the user or for advertising attribution. SondeFox uses Google Maps APIs, and this Privacy Policy incorporates the Google Privacy Policy by reference.

SondeHub uploads: all opt-in

These contribution choices are shared by Android and iOS. Device location permission and each upload choice are separate controls.

Everything you upload to SondeHub joins a public telemetry stream and may be redistributed by SondeHub and downstream projects. The in-app opt-in flow says the same thing before you enable anything.

Telemetry upload remains off by default and requires explicit opt-in plus a callsign. From v0.14.14 onward, decoder validation badges remain evidence labels rather than a client-held protocol rollout list. SondeFox considers every genuine radiosonde type for which it has an exact SondeHub mapping, but transmits only after CRC, confirmed strict identity, GPS time/position, freshness, and plausibility gates. SondeHub's server-side denylist is authoritative for acceptance among those exact-mapped types, so the service can change that policy without requiring another installed-app update. RS92's approximate RS41 mapping, Meisei's missing mapping, and generic LMS6's unresolved 400/1680 MHz variant remain client-blocked; APRS, WSPR, Meshtastic, C50, and Unknown remain local-only; unimplemented roadmap decoders emit nothing.

Android support captures

On Android, the user-controlled paths that can transmit your own position as application data are telemetry upload through uploader_position, station-position upload, chase-car upload, a manually confirmed recovery report when it uses the phone's current GPS fix, and the two developer capture tools. SondeHub developer capture records exact uploader_position, callsign, reception details, and raw payload and diagnostic fields. The separate field-debug capture uploads radio IQ, spectrum, decoded sonde telemetry, diagnostics, and the app's own log; when Android location is active, that log can contain exact phone GPS fixes. Both capture tools send to SondeFox's private server at debug.sondefox.com, not to SondeHub. A separately initiated SondeHub validator dry-run control exists for development, but it is held in v0.14.0 and sends nothing. These features remain off until you enable, start, or confirm them. Online maps separately disclose the requested area and provider or SDK data described above.

On Android, pending field-debug bundles are retained in app-private storage for up to seven days and deleted after successful upload. A SondeHub developer capture may remain pending until it uploads, subject to a 512 MiB backlog ceiling. iOS keeps local copies differently, as described below.

iOS permissions and network features

• Receiver and local network: the app connects to the rtl_tcp receiver host and port you select, usually over local Wi-Fi. It can also look for advertised receivers using Bonjour. iOS can ask for Local Network permission for local receiver connections and discovery. The receiver supplies radio samples and receives radio-control commands over plain, unencrypted TCP; this is separate from SondeHub and support uploads.
• Location and heading: the app requests When In Use location permission for receiver position, chase guidance and orientation. It can use precise or reduced-accuracy fixes, depending on your iOS settings. An active receiver chase can request a background location session to continue with the screen locked, with the iOS location indicator visible; stopping the chase ends that session. Location permission controls device fixes, while the separate map, contribution and capture choices control their respective uses. Manually entered station coordinates are also used when you select them.
• Lock-screen information: when Live Activities are enabled in iOS, chase identity/status and guidance such as range and bearing can appear on the Lock Screen and Dynamic Island. Manage Live Activities in iOS settings if you do not want that information visible there.
• SondeHub reads: saved-flight history, prediction and SondeHub Live requests contact SondeHub for the identities or map areas you select. Servers receive ordinary connection data, including IP address; live subscriptions use a random session identifier. Reading public data does not itself upload telemetry or receiver position. Saved-flight auto-refresh can use iOS-granted background windows under your selected network policy. SondeHub Live subscriptions are foreground-only. iOS decides whether and when background work runs.
• MapLibre and OpenFreeMap: the 2D map requests styles and tiles from OpenFreeMap. The requested map areas and ordinary network metadata, including IP address, reach the providers serving those requests. Their handling is described in OpenFreeMap's privacy information, including its use of Cloudflare.
• Optional Google 3D: using this map sends viewed areas and camera or marker coordinates to Google, including your receiver location when used for a marker or camera position. SondeFox does not provide an offline store of Google map content. Google's published Maps 3D SDK privacy information describes request/device/OS/SDK metadata, IP address, an SDK-specific pseudonymous identifier, crash information and camera interactions such as panning and zooming. It describes the latest SDK; the applicable Google Privacy Policy also governs Google's processing. A pseudonymous identifier is not a promise of anonymity. SondeHub upload switches do not control map-provider requests.

The SondeHub contribution table also applies on iOS: telemetry can include your receiver position under the telemetry opt-in even when station-position and chase-car uploads are off. Listener records can include your callsign or name, contact email and radio/antenna descriptions; recovery reports can include your reporter name, chosen coordinates and notes. These contributions are public.

iOS support captures and delivery

Recording, exporting and sending are separate choices. Completed captures are stored in protected app storage and excluded from device/iCloud backup. Exporting through the share sheet creates copies outside the app's retention controls. Delivery to SondeFox is offered only in builds where that feature is available.

• Radio IQ diagnostics: each recording requires its own disclosure and lasts at most 60 seconds. It can include raw receiver samples, spectrum, decoded radio identities/positions and raw frames, radio settings, device class, OS/app build and bounded capture-health events. The app does not add your iPhone's GPS fix, station callsign/contact email, credentials or arbitrary system logs to this format. Radio content can still contain other people's identifiers and locations. Send requires a separate confirmation, using unmetered Wi-Fi by default or mobile/other constrained data only when you allow it for that send. Queue for Wi-Fi authorizes that exact file for a later unmetered Wi-Fi transfer, including an iOS-granted background window; recording alone never authorizes an upload.
• Flight decision captures: this separately enabled recording explains proposed SondeHub messages and send-or-hold decisions. It can contain your full receiver GPS position and callsign, sonde positions and raw decoder data, including when ordinary telemetry upload is off. Capture consent keeps these files local. Each file has a separate Send or Queue for Wi-Fi choice. A separate automatic-delivery switch, off by default, can authorize newly completed fragments in a fresh capture session for the Wi-Fi queue; it does not admit older files. Turning automatic delivery or capture off, or entering Demo, revokes that automatic grant and cancels its queued work. Those changes do not revoke separately authorized manual sends or queue entries; cancel those separately.

The built-in Send and Queue controls for both iOS capture types upload to SondeFox's private service at debug.sondefox.com, not to SondeHub. You can cancel a send or withdraw a queued file's authorization. An immediate Send does not authorize future sends. A queued file can resume later under its recorded permission; background scheduling and completion times are not guaranteed. Cancellation cannot recall bytes the service has already received.

Private debug storage

Android and iOS support uploads are held by SondeFox's private debug service, hosted on Cloudflare. Its object storage is configured to delete completed objects after 30 days and abort unfinished multipart uploads after seven days. These rules apply to the hosted objects; they do not recall copies already downloaded or exported. Email and service logs are separate from that object storage.

Your choices and privacy requests

You can change location/local-network permissions in device settings, turn off contribution or capture options in the app, and cancel separately authorized queued sends. These actions stop the relevant future activity; they do not delete data already sent. Deleting a local capture is not a request to delete its server copy.

SondeHub contributions enter a public stream and may have been retained or redistributed by SondeHub and other projects. Turning an upload switch off does not remove earlier public contributions, and SondeFox cannot recall all downstream copies.

For questions or requests about data held by SondeFox, including access, correction or deletion of private support files, see how to request data deletion or contact [email protected]. Include enough information to identify the relevant capture or message, and avoid sending credentials or additional sensitive captures in the initial request. Requests about another provider's copies are subject to that provider's policies and controls.

This website

• Static pages. SondeFox adds no advertising, analytics or tracking scripts. Cloudflare serves a script from this site’s own domain to display protected contact email addresses.
• Hosting and downloads: the website and planned downloads.sondefox.com file service use Cloudflare. It receives standard request data such as IP address, user agent and requested URL to deliver and protect those services. No SondeFox advertising or analytics tracker is added. The private tester area requires authentication and is excluded from indexing.
• Store links: following an Apple TestFlight, App Store, or Google Play link opens that provider’s service, which has its own privacy policy and account requirements.
• Email: if you write to [email protected], your message is handled like ordinary email and used to respond, handle support or privacy requests, and run the beta program.

Reception legality & field safety

Radiosonde telemetry in the 400–406 MHz band is unencrypted and broadcast as part of the public meteorological service. Receiving it is legal in most jurisdictions. SondeFox does not transmit radio-frequency signals; its separately described network features communicate over the internet only when their own conditions are met.

• Never make an RF transmission without authorization. SondeFox has no RF transmit function; do not use other equipment to transmit unless you hold the appropriate license.
• Never trespass to recover a sonde. Get the landowner's permission first, and let a recovery go rather than take a risk. A dead RS41 in a field is not worth a confrontation, an injury, or a fine.
• Chirp monitor: authorized signals only. The experimental chirp-spread-spectrum (CSS) monitor is off by default and scoped strictly to signals you're authorized to receive: your own devices, amateur-radio telemetry under your license, and ISM-band experiments. It includes Meshtastic payload decoding with the public default key or a user-supplied key, and does not extract unknown keys.

Acknowledgements

SondeFox exists because the radiosonde and SDR communities did the hard work first, in the open. Our sincere thanks to:

• Published radiosonde standards and independent measurements: the public evidence that makes interoperable, independently implemented decoders possible.
• Project Horus and SondeHub: the open community tools and public telemetry network that make radiosonde tracking and chasing a shared, worldwide effort.
• Airspy and RTL-SDR communities: the documented receiver ecosystems and permissive upstreams that enable direct USB reception on Android.
• sdr-fox: the reviewed, permissively licensed companion driver used for SondeFox's RTL-SDR path.
• MapLibre: the open map renderer behind the keyless 2D chase map and supported offline continuity.

Full third-party provenance, immutable versions, licenses, and redistribution terms are maintained in the project's reviewed third-party inventory. Each beta APK ships the required distributable license and notice files for its included third-party material.

Trademarks

Vaisala, Graw, Meteomodem, Intermet, Meisei, and other manufacturer names are trademarks of their respective owners, used here solely to identify the radiosonde models SondeFox can decode or plans to decode. Airspy is a trademark of its owner. Android, Google Maps, and Google Earth are trademarks of Google LLC. SondeHub is an independent community project.

SondeFox is an independent project and is not affiliated with, endorsed by, or sponsored by any of the organizations or projects named above.

---

Questions about this policy or anything else on this page? Write to [email protected].